United Kingdom Investigatory Powers Tribunal

" It is important to emphasise that the Tribunal and the parties recognise that there is a serious threat to public safety, particularly from international terrorism, and that the SIAs are dedicated to discharging their responsibility to protect the public.  It is understandable in the circumstances that the Respondents, both through Mr. Eadie orally and by their evidence, have emphasised the important part which the use of BCD and BPD have played in furthering that protection, particularly where those who pose the threat are using increasingly sophisticated methods to protect their communications. In a Report published on 19 ^th August 2016 (the "Bulk Powers Review") David Anderson QC, the Independent Reviewer of Terrorism Legislation, concluded that there is a proven operational case for the use of the powers to obtain and use BCD and BPD, that those powers are used across the range of activities of the SIA, from cyber-security, counter-espionage and counter-terrorism to child sexual abuse and organised crime, and that such powers play an important part in identifying, understanding and averting threats to Great Britain, Northern Ireland and elsewhere."

We shall refer further to that Bulk Powers Review by Mr Anderson QC, the then Independent Reviewer of Terrorism Legislation, (which we shall call "the Anderson Report") below.

" (1) The Secretary of State may, after consultation with a person to whom this section applies, give that person such directions of a general character as appear to the Secretary of State to be necessary in the interests of national security or relations with the government of a country or territory outside the United Kingdom.

(2) If it appears to the Secretary of State to be necessary to do so in the interests of national security or relations with the government of a country or territory outside the United Kingdom, he may, after consultation with a person to whom the section applies, give to that person a direction requiring him (according to the circumstances of the case) to do or not to do , a particular thing specified in the direction.

(2A) The Secretary of State shall not give a direction under subsection (1) or (2) unless he believes that the conduct required by the direction is proportionate to what is sought to be achieved by that conduct."

i)                    The use of Bulk Data capabilities is critical to the ability of the SIAs to secure national security;

ii)                  A fundamental feature of many of the SIAs' techniques of interrogating Bulk Data is that they are non-targeted, i.e. not directed at specific targets. Clarification in this regard is given on page 32 of the 2015 report by the Intelligence & Security Committee of Parliament ("ISC"):

" It is essential that the Agencies can "discover" unknown threats. This is not just about identifying individuals who are responsible for threats, it is about finding those threats in the first place. Targeted techniques only work on "known" threats: Bulk techniques (which themselves involve a degree of filtering and targeting) are essential if the Agencies are to discover those threats."

iii)                That the existing safeguards [found to be compliant (with the reservations set out in paragraph 2 above) with the ECHR in our October Judgment] are sufficient to prevent abuse in connection with the SIAs' use of the capabilities derived from BCD/BPD;

iv)                That if applied to the field of national security, the requirements specified by the Grand Chamber in Watson ("the Watson Requirements") would effectively cripple the SIAs' Bulk Data capabilities.

The Facts

" Case study A9/10

This case study related to the London and Glasgow attacks in 2007. Using bulk acquisition data, MI5 was able to establish within hours that the same perpetrators were responsible for both attacks. MI5 was also able, within a similarly short period, to learn more about the details of the attacks, including the methods used and the identities of those involved or associated with the attackers. The ability to conduct this analysis at pace enabled MI5 to support the police in responding swiftly to the attacks and to the threat of further, imminent attacks.

It would not have been possible to achieve the same results with comparable speed, using targeted queries. Speed was essential at the time, when the SIAs and police had to learn as quickly as possible whether other attacks were imminent. Bilal Abdulla was subsequently convicted of conspiracy to murder and conspiracy to cause explosions likely to endanger life. Kafeel Ahmed died of the injuries that he sustained at Glasgow Airport, having set himself alight.

Case study A9/11

In 2010, a network of terrorists - comprising groups in Cardiff, London and Stoke-on-Trent - planned a series of bomb attacks at several symbolic locations in the UK, including the London Stock Exchange. Complex analysis of bulk acquisition data played a key role in identifying the network. The task was made particularly challenging by the geographical separation of the groups. Nine members of the network were subsequently charged and pleaded guilty to terrorism offences relating to the plot. Eight members of the network pleaded guilty to engaging in conduct in preparation for acts of terrorism.

MI5 reiterated to the Review team the assertion it had already made in public that the use of targeted communications data would not have allowed it to identify the attackers and understand the links between them with the speed made possible by the use of bulk acquisition data."

There are several other similar case studies in Annex 9 of the Anderson Report. As the Report noted (at paragraph 2.33) it is an important and distinctive feature of the SIAs' current capability that data obtained pursuant to s.94 can be aggregated in one place.

" I have concluded that:

(a) Bulk acquisition has been demonstrated to be crucial in a variety of fields, including counter-terrorism, counter-espionage and counter-proliferation. The case studies provide examples in which bulk acquisition has contributed significantly to the disruption of terrorist operations and, through that disruption, almost certainly the saving of lives.

(b) Bulk acquisition is valuable as a basis for action in the face of imminent threat, though its principal utility lies in swift target identification and development.

(c) The SIAs' ability to interrogate the aggregated data obtained through bulk acquisition cannot, at least with currently available technology, be matched through the use of data obtained by targeted means.

(d) Even where alternatives might be available, they are frequently more intrusive than the use of bulk acquisition."

" 152) In my capacity as Deputy Director for Data Access and Policy I saw how vital BCD is for the work of MI5, in particular in relation to counter-terrorism work. I am able to say, based on what I have seen myself and been told by colleagues in MI5, that the use of BCD by MI5 has stopped terrorist attacks and has saved lives many times.

153) The acquisition of BCD enables MI5 to identify threats and investigate in ways that, without this capability, would be either impossible or considerably slower. In many case[s] communications data may be the only investigative lead that we have to work from. Further, without BCD, it would be necessary to carry out other and more intrusive enquiries; for example many more individual requests for CD or use other more intrusive powers in order to narrow the scope of a search. The inability to use BCD would therefore involve greater intrusion into the privacy of individuals.

154) I recognise of course that, simply by holding BCD that relates to individuals who are not of intelligence interest, and as with BPD, there is a degree of interference with the privacy of such individuals. However, the BCD in the database is, itself, anonymous. Further, and as with all bulk capabilities, whilst it is right to acknowledge that a significant quantity of information can be collected, only a tiny proportion of the data is ever examined."

In paragraph 9.14(b) of the Anderson Report, the conclusion is recorded that for MI5 the bulk acquisition power " has contributed significantly to the disruption of terrorist operations and the saving of lives".

The disputed impact of Watson

i)                    the conclusions of the Grand Chamber in Watson in respect of DRIPA have no effect, even by extension or analogy, upon BCD acquired and used for the purposes of national security, which requires separate consideration:

ii)                  if it were of application to matters of national security, the Watson judgment would not comply with the TEU, as being inconsistent with the provisions of TEU Articles 4 and 5 (set out below), and with previous decisions of the Grand Chamber.

iii)                the safeguards of ECHR Article 8 are sufficient to control the activities of the States and the SIAs, and achieve a sufficient balance between the protection of the public and the privacy of the individual, and the Watson Requirements do not or should not apply to BCD.

EU Law

i)                    TEU/TFEU

Article 4 TEU

" 1. In accordance with Article 5, competences not conferred upon the Union in the Treaties remain with the Member States.

2. The Union shall respect the equality of Member States before the Treaties as well as their national identities, inherent in their fundamental structures, political and constitutional, inclusive of regional and local self government. It shall respect their essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security. In particular, national security remains the sole responsibility of each Member State.

. . ."

Article 5 TEU

" 1. The limits of Union competences are governed by the principle of conferral. . . .

2. Under the principle of conferral the Union shall act only within the limits of the competences conferred upon it by the Member State in the Treaties to obtain the objectives set out therein. Competences not conferred upon the Union in the Treaties remain with the Member State.

. . ."

Article 6 TEU

" 1. The Union recognises the rights, freedoms and principles set out in the Charter of Fundamental Rights of the European Union of 7 December 2000, as adapted at Strasbourg, on 12 December 2007, which will have the same legal value as the Treaties.

The provisions of the Charter shall not extend in any way the competences of the Union as defined in the Treaties.

The rights, freedoms and principles in the Charter shall be interpreted in accordance with the general provisions entitled VII of the Charter governing its interpretation and application and with due regard to the explanations referred to in the Charter, that set out the sources of those provisions.

2. The Union shall accede to the European Convention for the Protection of Human Rights and Fundamental Freedoms. Such accession shall not affect the Union's competences as defined in the Treaties.

3. Fundamental rights, as guaranteed by the European Convention . . . and as they result from the constitutional traditions common to the Member States, shall constitute general principles of the Union's as law."

Article 16 TFEU

" 1. Everyone has the right to the protection of personal data concerning them.

2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities.

. . ."

ii)                  The Charter

Article 7: Respect for Private and Family Life

" Everyone has the right to respect for his or her private and family life, home and communications".

Article 8: Protection of Personal Data

" 1. Everyone has the right to the protection of personal data concerning him or her.

2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.

3. Compliance with these rules shall be subject to control by an independent authority."

Article 51: Scope

" 1. The provisions of this Charter are addressed to the institutions and bodies of the Union with due regard for the principle of subsidiarity and to the Member States only when they are implementing Union Law. They shall therefore respect the rights, observe the principles and promote the application thereof in accordance with their respective powers.

2. This Charter does not establish any new power or task for the Community or the Union, or modify powers and tasks defined by the Treaties."

iii)                The Data Protection Directive ("DPD") 95/46 EC

Recital 13:

" Whereas the activities referred to in Titles V and VI of the Treaty on European Union regarding public safety, defence, State security or the activities of the State in the area of criminal laws fall outside the scope of Community law, without prejudice to the obligations incumbent upon Member States under Article 56 (2), Article 57 or Article 100a of the Treaty establishing the European Community; whereas the processing of personal data that is necessary to safeguard the economic well-being of the State does not fall within the scope of this Directive where such processing relates to State security matters."

Article 3

" Scope

1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

2. This Directive shall not apply to the processing of personal data:

- in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,

- by a natural person in the course of a purely personal or household activity."

iv)                The E Privacy Directive ("EPD") 2002/58 EC

Recital 11

" Like Directive 95/46/EC, this Directive does not address issues of protection of fundamental rights and freedoms related to activities which are not governed by Community law. Therefore it does not alter the existing balance between the individual's right to privacy and the possibility for Member States to take the measures referred to in Article 15(1) of this Directive, necessary for the protection of public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the enforcement of criminal law. Consequently, this Directive does not affect the ability of Member States to carry out lawful interception of electronic communications, or take other measures, if necessary for any of these purposes and in accordance with the European Convention for the Protection of Human Rights and Fundamental Freedoms, as interpreted by the rulings of the European Court of Human Rights. Such measures must be appropriate, strictly proportionate to the intended purpose and necessary within a democratic society and should be subject to adequate safeguards in accordance with the European Convention for the Protection of Human Rights and Fundamental Freedoms."

Article 1

" Scope and aim

1. This Directive harmonises the provisions of the Member States required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the Community.

2. The provisions of this Directive particularise and complement Directive 95/46/EC for the purposes mentioned in paragraph 1. Moreover, they provide for protection of the legitimate interests of subscribers who are legal persons.

3. This Directive shall not apply to activities which fall outside the scope of the Treaty establishing the European Community, such as those covered by Titles V and VI of the Treaty on European Union, and in any case to activities concerning public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the activities of the State in areas of criminal law."

Article 15

" Application of certain provisions of Directive 95/46/EC

1.       Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.

. . ."

" 108. However, Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not prevent a Member State from adopting legislation permitting, as a preventive measure, the targeted retention of traffic and location data, for the purpose of fighting serious crime, provided that the retention of data is limited, with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted, to what is strictly necessary.

109. In order to satisfy the requirements set out in the preceding paragraph of the present judgment, that national legislation must, first, lay down clear and precise rules governing the scope and application of such a data retention measure and imposing minimum safeguards, so that the persons whose data has been retained have sufficient guarantees of the effective protection of their personal data against the risk of misuse. That legislation must, in particular, indicate in what circumstances and under which conditions a data retention measure may, as a preventive measure, be adopted, thereby ensuring that such a measure is limited to what is strictly necessary (see, by analogy, in relation to Directive 2006/24, the Digital Rights judgment, paragraph 54 and the case-law cited).

110. Second, as regards the substantive conditions which must be satisfied by national legislation that authorises, in the context of fighting crime, the retention, as a preventive measure, of traffic and location data, if it is to be ensured that data retention is limited to what is strictly necessary, it must be observed that, while those conditions may vary according to the nature of the measures taken for the purposes of prevention, investigation, detection and prosecution of serious crime, the retention of data must continue nonetheless to meet objective criteria, that establish a connection between the data to be retained and the objective pursued. In particular, such conditions must be shown to be such as actually to circumscribe, in practice, the extent of that measure and, thus, the public affected.

111. As regard the setting of limits on such a measure with respect to the public and the situations that may potentially be affected, the national legislation must be based on objective evidence which makes it possible to identify a public whose data is likely to reveal a link, at least an indirect one, with serious criminal offences, and to contribute in one way or another to fighting serious crime or to preventing a serious risk to public security. Such limits may be set by using a geographical criterion where the competent national authorities consider, on the basis of objective evidence, that there exists, in one or more geographical areas, a high risk of preparation for or commission of such offences.

112. Having regard to all of the foregoing, the answer to the first question referred in Case C‑203/15 is that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation which, for the purpose of fighting crime, provides for the general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication."

i)                    As summarised in paragraphs 19 and 23 above, DRIPA was a different statute, and related to the retention by providers of communications data beyond their commercial needs, so as to be available for access by the SIAs. S.94 relates to the supply of BCD to the SIAs via the providers, who do not thereafter retain the data (beyond the period of their requirements), which is retained by the State (the SIAs). The Judgment emphasises in paragraphs 70, 78-80 and 92 the obligations of the providers.

ii)                  The judgment in Watson was addressing the targeted access of data in criminal investigations. Paragraph 106 of the Watson judgment refers to and adopts paragraph 59 of the DRI judgment, which emphasises as objectionable the lack of any need for a specified relationship between the data sought and any identified particular persons or group. This falls to be contrasted with the needs of national security, as particularly exemplified in the passage from the ISC Report set out in paragraph 9(ii) above.

i)                    Mengozzi AG's Opinion of 8 September 2016 1/15, in which he refers to Parliament v Council :

" 85. The Court was asked by the Parliament to determine, in particular, whether the Commission was authorised to adopt an adequacy decision, based on Article 25 of Directive 95/46 on the adequate protection of personal data contained in the Passenger name Record of air passengers transferred to the United States, when Article 3(2) of that directive expressly excluded from its scope processing operations concerning, in particular, public security and the activities of the State in areas of criminal law. The Court logically replied in the negative. In fact, the processing of the PNR data in the context of the agreement with the United States could not be associated with the supply of services, but fell within a framework established by the public authorities that related to public security, which did not come within the scope of Directive 95/46."

ii)                  The European Council Notice 2016/C691/01 of February 2016. This was a statement made by the European Council in the context of a hoped for new settlement for the UK within the European Union, which did not take place, but it constituted a statement of the existing law, in Section C (Sovereignty):

" 5. Article 4(2) of the Treaty on European Union confirms that national security remains the sole responsibility of each Member State. This does not constitute a derogation from Union law and should therefore not be interpreted restrictively. In exercising their powers, the Union institutions will fully respect the national security responsibility of the Member States."

Mr Eadie submits that this can be relied upon pursuant to Article 31 of the Vienna Convention on the Law of Treaties 1969.

i)                    It would be Article 1(3) that would thus be " deprived of any purpose";

ii)                  Effect would thus not be given to Article 4 of TEU; and/or

iii)                Contrary to EU law, Article 4, a primary provision of the Treaty, would be replaced/contravened by secondary legislation, namely Article 15 of the Directive, notwithstanding Article 1(3).

i)                    the exercise of a legal power by the government of a Member State to require telecommunications operators to transfer data in order to protect national security (i.e. acquisition) is an activity of the State not within the scope of Union law;

ii)                  on the same basis, the activity of the State in making use of such transferred data for the purpose of protecting national security (i.e. use) must also fall outside Union law;

iii)                the activities of commercial undertakings in processing and transferring data for such purposes, as required by national law, (i.e. transfer) must also fall outside the scope of Union law.

Those issues are determined not by analysing whether under the provisions of the DPD and EPD the activity in question constitutes data processing, but whether in substance and effect the purpose of such activity is to advance an " essential State function" (Article 4(2) TEU), in this case the protection of national security, through " a framework established by the public authorities that relates to public security" (paragraph 56 of Parliament v Council set out in paragraph 22(i) above).

i)                    We have already cited in paragraph 21 above Recital 13 of the DPD, which recites exclusions from the scope of Community Law and of that Directive, where processing " relates to State security matters". Recital 11 to the EPD, also there set out, in terms excludes from that Directive activities relating to (inter alia) public and State security matters referred to in Article 15, so that " the Directive does not affect the ability of Member States to carry out" interception, or (a fortiori) other less intrusive measures, such as the obtaining and processing of BCD. The proviso is that " such measures must be appropriate, strictly proportionate to the intended purpose and necessary within a democratic society and should be subject to adequate safeguards in accordance with the [ECHR]". This proviso would be satisfied by our conclusions (subject to the reserved issues) in our October Judgment.

ii)                  Article 1(3) of the EPD, also there set out, states plainly that the Directive does not apply to activities (inter alia) concerning public security and State security, which fall outside the scope of the Treaty. There is no proviso.

iii)                Article 15 refers to the legislative measures which may be adopted by Member States to safeguard (inter alia) national security. Until its last sentence it appears to add nothing to Recital 11 (and indeed Recital 13 of the DPD) and to Article 1(3). The last sentence then provides that " all the measures referred to in this paragraph shall be in accordance with the general principles of Community Law, including those referred to in Article 6(1) and (2) of the Treaty on European Union". It is this sentence which led the Grand Chamber to the conclusion that the measures in Article 15 fell within the scope of the Directive, and, on its conclusions, the Charter. It seems to us possible, particularly in the light of the impact of Articles 4 and 5 TEU, and the need to construe the Directive so as to comply with the Treaty, that that sentence may not have such meaning; and certainly did not do so when the Directive was originally adopted, because at that time Article 6(1) and 6(2) TEU were in a different form from that in which they now stand as set out in paragraph 21 above. At that time they read as follows:

" 1.  The Union is founded on the principles of liberty, democracy, respect for human rights and fundamental freedoms, and the rule of law, principles which are common to the Member States.

2. The Union shall respect fundamental rights, as guaranteed by the European Convention for the Protection of Human Rights and Fundamental Freedoms signed in Rome on 4 November 1950 and as they result from the constitutional traditions common to the Member States, as general principles of Community law."

It seems to us that it may be that the last sentence of Article 15 should thus be construed as nothing more than a reiteration of Recital 11 (with which it is otherwise in conflict) and that the ECHR does, and the Charter does not, apply to those activities excluded under Articles 4 and 5 TEU.

The Watson Requirements

i)                    Subject to clarification of the impact of paragraph 119 of the Judgment, to which we shall refer, there is a restriction on any non-targeted access to Bulk Data.

ii)                  There must be prior authorisation (save in cases of validly established urgency) before any access to data (paragraph 120).

iii)                There must be provision for subsequent notification of those affected (paragraph 121).

iv)                All data must be retained within the European Union (paragraph 122 and 125: there is doubt as to the effect of paragraph 123, as discussed below).

a.        The BCD regime is not within the scope of the Treaty and the Directive and is only subject to the ECHR.

b.       In any event the Watson Requirements cannot and should not apply, because there is no analogy between the activities and the legal basis for such activities under consideration in Watson and the BCD regime, as summarised in paragraph 29 above.

The Claimant submits that the Watson Requirements apply, and should be imposed either directly or by analogy, and, although Mr de la Mare accepts that it may be that they derive from a ' partial understanding' by the Court in Watson of the necessities of national security and the operation of the SIAs, the Requirements, if reconsidered, should be reapplied in whole or in part.

a.        The use of bulk acquisition and automated processing produces less intrusion than other means of obtaining information.

b.       The balance between privacy and the protection of public safety is not and should not be equal. Privacy is important and abuse must be avoided by proper safeguards, but protection of the public is preeminent.

c.        The existence of intrusion as a result of electronic searching must not be overstated, and indeed must be understood to be minimal.

d.       There is no evidence of inhibition upon, or discouragement of, the lawful use of telephonic communication. Indeed the reverse is the case.

e.        Requirements or safeguards are necessary but must not, as the Respondents put it, eviscerate or cripple public protection, particularly at a time of high threat.

(1)                Bulk acquisition and automated processing

" However, in particular situations, where for example vital national security, defence or public security interests are threatened by terrorist activities, access to the data of other persons might also be granted where there is objective evidence from which it can be deduced that data might, in a specific case, make any effective contribution to combating such activities."

a.        The references to ' particular situations' and ' in a specific case' do not fit the circumstances before us, where the evidence, and in particular the Anderson Report, establishes the necessity of the availability of bulk, i.e. unspecific, automated processing in the interests of national security.

b.       The reference to ' objective evidence' from which it could be deduced that ' the data of other persons', might ' in a specific case' be of use is also inadequate, and appears to refer back to what the Court said in paragraph 111 (quoted above) with regard to the use of geographic criteria, which could not practicably be applied in relation to international terrorism.

(2) Prior authorisation

a.        Prior to the making of a s.94 Direction to supply the data - in lieu of or as well as the Secretary of State;

b.       Prior to obtaining the data electronically by way of an electronic trawl or search - on each occasion? The protection of national security is always ongoing and the same data may be accessed on numerous occasions without any genuine intrusion on the private life of any of those whose data is kept there, save for those who may, as a result of the automated processing of data, be of proper intelligence interest to the SIAs;

c.        Prior to actual access, whether targeted or resulting from an earlier electronic trawl.

a.        The context in Watson is plainly of a particular criminal investigation, which has come to an end. The need to protect national security is on-going, as, sadly, is the continuing involvement of large numbers of people in the planning and execution of terrorist activities.

b.       The danger of notification is not simply related to the circumstances of a particular investigation or a particular person involved in that investigation, but relates also to further operations, including both the methodology of the obtaining or using of the information and the identity of those involved.

(4) Retention of data within the European Union

a.        It would seem that it amounts to an absolute bar on transfer of data out of the EU, because the foundation of this requirement is to be found in DRI, where it was concluded that it should have been a requirement of the data to be retained by reference to the Data Retention Directive, but in particular because of the wording of paragraph 123 of Watson " the national legislation must make provision for the data to be retained within the European Union" and paragraph 125 the " requirement that the data concerned should be retained within the European Union". However, the Claimant submits that it is not an absolute bar, because of the interpolation of paragraph 123 between paragraphs 122 and 125. That paragraph provides for there to be a review by an independent authority of compliance with the level of protection guaranteed by EU Law, and Mr de la Mare submitted that, by virtue of the reference to Article 8(3) of the Charter, this was to be seen as an independent authority supervising the transfer of data out of the European Union, thus making the bar not absolute. It was however common ground during the hearing that there was uncertainty.

b.       The Claimant submits that this is only a requirement for the data itself to remain in the European Union and not the product of the data. If that is so, it is less of a restriction, but the reference in paragraph 123 to a potential claim by a person " seeking the protection of their data" would not seem to support this.

Conclusion on Watson Requirements

Reference

a.        that the UK Parliament had legislated on the basis of there being an obligation on the Member State under Article 15 of the EPD (particularly in relation to the Communications Act 2003 and the Privacy & Electronic Communications (EC Directive) Regulations 2003). This was vigorously debated before us by an exchange of written submissions, in which it seemed to us the Respondents had the better of the argument. But it does not matter, as it is not alleged that there is any kind of estoppel, and there is plainly now a dispute requiring resolution.

Expedition

a.        The issues are important and urgent, and straightforward for the Grand Chamber to decide.

b.       In Watson there was an order for expedition.

c.        If there were an expedited hearing it would remove the necessity for any application to be made to this Tribunal for interim relief.

a.        The issues are not at all straightforward, and their importance to the Member States would run counter to any foreshortening of the opportunity for other Member States to consider whether to take any part, and to participate if so advised.

b.       In Watson there were three grounds for the order of expedition, only the third of which was its importance, as appears from the order of the President of the Court in that case dated 1 February 2016, the other two plainly being primary and significant:

                                                              i.       The desirability of joining Watson with the Swedish case, which was already far advanced.

                                                            ii.       The existence of the 'sunset clause' expiring 31 December 2016 in relation to DRIPA referred to in paragraph 20 above. In the event, the Grand Chamber's Judgment of 21 December 2016 only just met that deadline.

Those reasons plainly do not apply in this case.

c.        That if the Claimant wishes to make an application for interim relief they are free to do so.

POSTSCRIPT