UCD School of Law

The role of NGOs in Public Interest Litigation

Digital Rights Ireland

PILA Seminar9 February 2012

TJ McIntyre

Without whom none of this would be possible

• McGarr Solicitors

• Frank Callanan SC

• Fergal Crehan BL

• Mark Dunne BL

Background: Data retention as a tracking mechanism, both geographic...

... and social, monitoring communications and mapping citizens

Timeline – Ireland

• Pre 2001– 6 year data retention– No legal basis

• Nov. 2001 – Irish Times breaks story– Data Protection Commissioner intervenes– Directs 6 month retention period

• Apr. 2002 – Ministerial Direction– s. 110 of the P&TSA 1983– 3 year retention period– Direction secret

Timeline – Ireland

• DPC claims Ministerial Direction inadequate– Not intended use of legislation; ultra vires the 1983

Act– Primary legislation would be required– Judicial review threatened– Enforcement notice issued– All of this happened in secret

• Criminal Justice (Terrorist Offences) Act, 2005– 3 year data retention for all telephone calls and

mobile locations– Does not extend to internet use

The European Dimension

• 2006 Data Retention Directive– EU law; supersedes national laws– Requires telcos, ISPs to log your movements, calls,

texts, email, etc.• Traffic data rather than content

– Up to 2 year retention– Accessible for

• Terrorism, serious crime• Filesharing• Defamation• Whatever national law

allows...

– No warrant required to access

Irish Implementation of Directive

• Communications (Retention of Data) Act 2011– Covers internet use– Retention period:

• 2 year telephony• 1 year internet

– Data access still a matter for internal Garda approval only

Objections?

• Proportionality and principle– Should we monitor the entire population at

all times?

• Risks of abuse– By both state and industry

• No necessity– EU states accepted “data preservation” in

2001 - why hasn’t this been tried?

• Function creep– Calls to extend to search engines , etc.

• Chilling effects

Challenging Data Retention

• National civil rights groups coordinating through EDRi1. Litigation strategies to overturn data retention2. Political strategies to repeal / amend Directive

Digital Rights IrelandORG

AK Vorrat

APTI

FIPRICCL

exgae Winston Smith Project

Electronic Frontier Finland

Bits of Freedom

Electronic Frontier Norway

La Quadrature du Net

(Over 100 organisations in total... this is just a random smattering)

Iuridicum Remedium

ALCEI

Danish Consumer Council

Hungarian Civil Liberties Union

Internet Society Poland

Julia Group

Court challengessuccessful/pending/rejected

• Bulgaria

• Romania

• Germany

• Ireland

• Hungary

• France

• Czech Rep.

• Cyprus

Outcomes?• France (2007)

– Industry challenge rejected

• Bulgaria (2008)– National law void for vagueness

• Romania (2009)– Data retention itself found to breach ECHR for interference with private life

• Germany (2010)– National law unconstitutional for inadequate safeguards– Other litigation pending

• Czech Republic (2011)– Implementing law found vague, open to abuse

• Cyprus (2011)– Police access held too extensive

• Hungary (pending)

• Partial victories only– Helping to form legal / political opinion; but the Directive remains in place

and replacement laws must be passed

Digital Rights Ireland challenge

• Challenge to both Irish law and Directive

• Started 2006

• Favourable venue

• Preliminary hurdles (2010)– Locus standi– Security for costs

Where are we now?

• Irish Human Rights Commission an amicus curiae

• Actio popularis granted– “sincere & serious litigant”

• Security for costs rejected– “issues of significant

public importance”

• Reference to ECJ given

• Order finalised;2 year wait to be heard

• Delay helpful!

What happens if we win?

• If the Directive is struck down:– Data retention returns to political

arena– May be back on the agenda at EU

level– Will probably be back

on agenda atnational levels

Parallel political strategies

• Evaluation of Directive just concluded– Unique opportunity to change political climate– (And to gather evidence for DRI action)– Art. 29 Working Party have found Directive is being abused, ignored

• Content data being held (esp. URLs visited)• Longer retention periods than allowed – 10 years in one case!• No real statistics on use of retained data, evidence of usefulness,

necessity• Data being handed over by ISPs outside legislation• No effective harmonisation

• Over 100 civil society groups have called for repeal

• Growing awareness amongst journalists, doctors, lawyers

Observations

• The decision to litigate– A last resort?– A resource intensive distraction from political activity?– Are there low cost alternatives? Allies?

• Data Protection Commissioner / European Commission?• Advice to criminal practitioners?

– Can the organisation afford to lose?

• Choice of forum– Not just national but now international– National standing rules?– Access to constitutional courts?– Willingness to make references to ECJ?

Observations

• Choice of plaintiff crucial– Corporate plaintiffs still face difficulties

• What rights do they have? To what extent?• Abstract nature of case may harm chances

– Litigation beyond the capacity of an individual• Even in criminal matters

• International dimension increasingly the norm– Domestic law always viewed against ECHR– Action before ECJ may be necessary– International cooperation may be desirable or essential

• Partner groups supply evidence, expertise, etc.• DR policy demands international engagement• Policy laundering more common

Observations• Role of the IHRC

– IHRC resource constrained;• but amicus work is a high impact and (relatively) low cost

exercise

– Immensely useful in establishing credibility before High Court

• What is the endgame?– Judgments aren’t (necessarily) self-executing– What happens once you win your challenge?– Is there a political coalition in place to take advantage? Or

is it back to square one?– Is your challenge substantive or procedural?

UCD School of Law

Thank you

More information:

Web: DigitalRights.ie; TJMcIntyre.com

Twitter: @tjmcintyre

Background reading

• Breyer, “Telecommunications Data Retention and Human Rights: The Compatibility of Blanket Data Retention with the ECHR” (2005) 11(3) European Law Journal 365

• McIntyre, “Data Retention in Ireland: Privacy, Policy and Proportionality” (2008) 24(4) Computer Law and Security Report 326

• Digital Rights Ireland v. Minister for Communications and others [2010] IEHC 221.