New Data Security Requirements and the Proceduralization of Mass Surveillance Law after the European Data Retention Case

TL;DR

This paper analyzes the European Court of Justice's ruling against the Data Retention Directive, highlighting new security criteria and the risks of proceduralization in mass surveillance law.

Contribution

It introduces new data security criteria from a human rights perspective and discusses the potential risks of procedural safeguards enabling mass surveillance.

Findings

Court invalidated Data Retention Directive due to privacy violations

Developed three new criteria for data security in surveillance

Warns about procedural safeguards enabling lawful mass surveillance

Abstract

This paper discusses the regulation of mass metadata surveillance in Europe through the lens of the landmark judgment in which the Court of Justice of the European Union struck down the Data Retention Directive. The controversial directive obliged telecom and Internet access providers in Europe to retain metadata of all their customers for intelligence and law enforcement purposes, for a period of up to two years. In the ruling, the Court declared the directive in violation of the human rights to privacy and data protection. The Court also confirmed that the mere collection of metadata interferes with the human right to privacy. In addition, the Court developed three new criteria for assessing the level of data security required from a human rights perspective: security measures should take into account the risk of unlawful access to data, and the data's quantity and sensitivity. While organizations that campaigned against the directive have welcomed the ruling, we warn for the risk of proceduralization of mass surveillance law. The Court did not fully condemn mass surveillance that relies on metadata, but left open the possibility of mass surveillance if policymakers lay down sufficient procedural safeguards. Such proceduralization brings systematic risks for human rights. Government agencies, with ample resources, can design complicated systems of procedural oversight for mass surveillance - and claim that mass surveillance is lawful, even if it affects millions of innocent people.