On the data retention side, the government is also facing several ongoing legal challenges to its surveillance regime under European law — and has lost multiple times including in December 2016 when Europe's top court dealt a major blow to "general and indiscriminate" data retention directives.
However its strategy of publicly consulting on amendments to surveillance law to try to workaround the CJEU's ruling against indiscriminate data retention regimes has drawn withering criticism from privacy groups.
As well as indiscriminate data retention, the court objected to DRIPA's failure to limit access to the data to the prevention and detection of serious crime; to the legislation allowing police and public bodies to authorize their own access to the data; to the law not requiring that people be notified after their data was accessed; and not requiring that data be kept in the EU.
Indeed, the UK has already legislated to be able to demand decryption on request and block use of e2e encryption in the Investigatory Powers Act, which passed into UK law last year — although some elements of the legislation have yet to be implemented, owing to a separate EU legal ruling regarding "generate and indiscriminate" data retention, which the law appears to breach.
US Marshals have even taken Stingrays (or devices that achieve a similar effect) to the air, which involves still more indiscriminate data being sucked up.
Under the program, the NSA was authorized to collect from telephone service providers massive amounts of indiscriminate data about Americans' phone call records.
And even though EU judges have already made it clear EU Member States cannot establish "general and indiscriminate" data retention regimes, the government is trying to drive a wedge between that finding and matters of national security, arguing that the use of bulk data capabilities is "critical" to national security.
By themselves, indiscriminate data dumps don't always advance the public right to know.
Given the concerns this brings for the protection of the fundamental rights to privacy and data protection, the WP29 looks to the forthcoming rulings of the CJEU in cases regarding massive and indiscriminate data collection".
The highest court in Europe today ruled that "general and indiscriminate" data retention directives contravene European Union law — dealing a significant blow to governments and organizations who have been pushing for stronger surveillance and data collection, and giving a boost to privacy advocates in the process.
