Concept art of data transmission

EU court imposes strict data protection laws for smartphones and internet

Image credit: Dreamstime

The EU Court of Justice (ECJ) has ruled that its member states cannot engage in acts of mass surveillance on phones and internet data unless a country is facing “a serious threat to national security”.

In such cases of "national security", the court ruled that the data could only be held for as long as “strictly necessary” and this period could only be extended if the perceived threat persists.

The EU has had a long history implementing strict data privacy rules on private firms such as Facebook in addition to sanctioning countries like Russia and China over their cyber-espionage efforts.

The latest ruling could impact privacy laws around Europe, such as the UK’s infamous 'snooper’s charter' which allows for broad data collection from internet devices, although in that specific case the new ruling is unlikely to have much effect given that the UK is due to leave the EU at the beginning of 2021.

The ECJ ruled on a series of linked cases from France, the UK and Belgium, three countries that have been hit by extremist attacks in recent years and have reinforced surveillance.

It said that although countries have their own rules around the level of data collection deemed necessary by government agencies, their national legislation “falls within the scope” of the European directive on privacy and electronic communications.

In terrorism cases, data could be collected from individuals, but only in conjunction with a review from an independent body that can assess how necessary it is on a case-by-case basis.

“In urgent cases, the review must take place promptly,” the ECJ said.

National courts should not take into account information collected by authorities that fail to follow the principles stated in the ruling, it added.

However, the ECJ left room for interpretation of the principles stated in its ruling, as it is up to EU member states to define what constitutes a “serious threat for national security”.

“Today’s judgment reinforces the rule of law in the EU,” said Caroline Wilson Palow, legal director, Privacy International.

“In these turbulent times, it serves as a reminder that no government should be above the law. Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies.”

Sign up to the E&T News e-mail to get great stories like this delivered to your inbox every day.

Recent articles