Legitimate interest in practice: EDPB report on one stop shop decisions applying legitimate interest

Last year the European Data Protection Board commissioned me to write a report on legitimate interest as part of the series of One Stop Shop thematic digests and I'm delighted that this has now been published. The report surveys every publicly available OSS decision applying legitimate interest as a legal basis, finding a significant number of interesting decisions applying this concept in areas such as consumer credit, fraud prevention, and regulating user behaviour on online services. One aspect I found surprising was how legitimate interest can diverge between member states, creating what are effectively choice of law issues for supervisory authorities who must decide how far to take into account national law and social norms in different states.

The EDPB register of final OSS decisions is a valuable resource for research, teaching and practice, particularly for jurisdictions like Ireland which do not systematically publish decisions of the supervisory authorities, and I hope that the report will help to promote awareness of the register.

Digital Searches in Ireland: Garda Powers Bill published

The Department of Justice, Home Affairs and Migration has published a draft Garda Síochána (Powers) Bill, with huge implications for digital searches in Ireland.

This follows on from a Heads of Bill originally put forward in 2021. There were clear problems with that proposal, which I discussed in the Irish Times at the time. Many of these were borne out by subsequent judgments which derailed the Bill for some years and ultimately forced a change of approach. In particular, the Supreme Court decisions in Corcoran and Quirke are clearly reflected in the revised Bill. Between them, these judgments have forced much greater emphasis on judicial authorisation of searches and handling legal privilege/journalist source protection, and Parts 3 and 4 are radically changed as a result.

The Bill appears to offer a much improved set of safeguards in relation to digital searches. However the devil is very much in the detail and the text will require close scrutiny. In particular, it will be interesting to see whether the Bill fully takes account of the CJEU judgment in CG v Bezirkshauptmannschaft Landeck, which seems to impose greater procedural safeguards than domestic law. At first glance the Bill also seems to duck the comity and proportionality issues presented by remote searches - which Maria Murphy and I discuss here (p.25).

A summary of the Bill is here.

Police powers to demand passwords - Poptoshev v DPP

Does a law violate the privilege against self-incrimination by requiring an individual to reveal a device password when a search warrant is being executed? The Irish High Court recently considered this issue in Poptoshev v DPP, holding that it doesn't.

In Poptoshev the applicant challenged sections 48 and 49 of the Criminal Justice (Theft and Fraud Offences) Act 2001. Section 48 allows gardaí with a warrant under that section to operate any computer at a place which is being searched, and to require any person at that place, who has lawful access to the information in any such computer, to furnish any password necessary to operate it. Section 49 criminalises failure to provide that password.

The applicant refused to provide passwords for two mobile phones and a laptop seized from him during a search of his home. When charged with failure to provide the passwords he brought a judicial review action claiming that this obligation, and the corresponding criminal penalty for failure to comply, amounted to a disproportionate interference with the privilege against self-incrimination under both the Constitution and the European Convention on Human Rights.

The High Court rejected this claim. The court held that the privilege against self-incrimination did not apply on the basis that 'the passwords in relation to each of these three devices existed independent of the will of the applicant', relying in particular on the similar English judgment in R v S (F). (An important aspect was that the applicant admitted ownership of the devices - there would have been a stronger self-incrimination claim otherwise.)

Separately, the High Court also held that mobile phones were included in the term 'computer' in the 2001 Act, which did not specifically define computers, and that the duty to provide a password applies 'there and then' while a search is being carried out and cannot be met by providing a password subsequently.

It is interesting that it has taken over twenty years for the constitutionality of this provision to be considered. There doesn't seem to have been many (if any?) prosecutions for failure to provide a password before now. According to a 2017 EU review of Irish law on cybercrime, Irish officials indicated that 'prosecution for withholding passwords is generally not done due to the right against self-incrimination' (p.68). After this judgment it's likely that these prosecutions will become more common.

Irish state spyware and the law

In 2022 the European Parliament PEGA committee adopted a damning report on the use of spyware across the EU, following growing evidence of countries such as Spain, Poland, Greece and Hungary abusing spyware to spy on opposition politicians, the media, and civil society.

Ireland featured in that report, but only incidentally as the home of several spyware businesses which had set up shop in Dublin for tax advantages. Consequently the report leaves unanswered the questions of whether the Irish state is using spyware and if so what legal justifications it is using to do so.

Let's have a quick look at those questions.

There's not a lot of direct evidence here - there is no Irish law specifically governing state spyware and the state refuses to comment on its use - but I obtained an interesting document under FOI which might shed some light on this.

This is the Department of Justice's response to a questionnaire from the European Commission looking for "information from all Member States about the use of spyware by national authorities and the legal framework governing such use". (Cianan Brennan had a good summary of the response in the Examiner.)

The letter to the Commission is careful not to confirm or deny that the Garda Síochána or other state agencies agencies use spyware. In fact, it doesn't even mention the word. However, it does suggest that state agencies do. (Unsurprisingly: as far back as 2015 the Defence Forces were in discussion with Hacking Team about purchasing their products.)

Why? The key point is that the letter mentions two separate powers - interception of communications under the Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993 and use of surveillance devices under the Criminal Justice (Surveillance) Act 2009.

Neither of these individually allows state malware - the 1993 Act permits interception only, and does not give power to tamper with devices, while the 2009 Act authorises use of surveillance devices, including access to premises to plant the devices, but does not give any express power to interfere with computer systems and specifically excludes anything (such as monitoring of email traffic) that would constitute an interception under the 1993 Act. Consequently neither power on its own would permit the use of spyware.

However by referring to both powers the letter suggests that spyware is being authorised using both of these powers - possibly combining a warrant from the Minister for Justice under the 1993 Act with a District Court authorisation under the 2009 Act in some cases to provide a (shaky) legal foundation for spyware.

If so, this is a major scandal in itself. The 2009 Act was never put forward as authorising spyware and in fact it is drafted in terms which make it clear that it is intended to apply to physical surveillance tools. The key term "surveillance device" is defined as "an apparatus designed or adapted for use in surveillance" - i.e. a physical device rather than software. Judges may authorise "enter[ing] ... any place" for the purposes of surveillance, but aren't empowered to authorise hacking into a computer.

In March 2024 the Irish government signed up to the US-led Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware. That statement re-commits Ireland to the principle that "Governments should ensure transparency on the applicable general legal framework supporting the use of surveillance technologies. Governments should clearly define the legal basis for using surveillance technology with transparency on the safeguards in place to prevent abuse or discriminatory uses." It is the height of hypocrisy for the Irish government to lecture the world about transparency, when denying it at home.

Data retention in Ireland: When European law meets national recalcitrance

I've just finished writing a chapter on data retention law in Ireland for a forthcoming collection edited by Eleni Kosta and Irene Kamara. It examines how, from the judgment in Digital Rights Ireland onwards, the Irish state has fought a rearguard action against compliance with EU fundamental rights.

Abstract:

This chapter examines the development of data retention in Ireland following the CJEU judgments in Digital Rights Ireland and Tele2 Sverige. It describes how the Irish State continued to enforce national data retention law for six years after Tele2 Sverige confirmed its illegality, attempted to re-litigate the legality of indiscriminate data retention before the national courts, and reformed domestic law only when forced to act by the CJEU decision in GD v Commissioner of An Garda Síochána. It assesses how national oversight mechanisms largely failed to address this illegality and argues that the data retention saga has highlighted significant weaknesses in the criminal justice system, the ‘designated judge’ model of supervising surveillance, and the accountability of the executive to parliament.

Full text on SSRN

The "essence" of the fundamental rights to privacy and data protection in the context of state surveillance

The EDPS has just published a comprehensive study by Prof. Gloria González Fuster on the essence of the fundamental rights to privacy and to protection of personal data, and marked the publication of the study with a one day seminar on the issue earlier this week. As the event wasn't public I won't summarise what the other panellists said, though I'm sure they won't object if I refer to some of their excellent prior work either directly on the topic or touching on it (Prof. Takis Tridimas; Prof. Cecilia Rizcallah; Prof. Maria Grazia Porcedda; Prof. Kathleen Gutman; Prof. Herke Kranenborg (paywalled); Prof. Nóra Ní Loideáin; Prof. Hielke Hijmans).

For my part, I offered some practical thoughts on applying these concepts to state surveillance which I've summarised below.

To set the scene: identifying the "essence" of these fundamental rights is significant because of Article 52(1) of the Charter of Fundamental Rights which provides that "Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms". As the President of the CJEU, Koen Lenaerts, has explained:

Respect for the essence of fundamental rights is laid down in Article 52(1) of the Charter of Fundamental Rights of the European Union, as one of the conditions that must be fulfilled in order for a limitation on the exercise of a fundamental right to be justified. Accordingly, where an EU measure fails to take due account of the essence of a fundamental right, that measure is incompatible with the Charter and must be annulled or declared invalid. Similarly, where a national measure implementing EU law—within the meaning of Article 51(1) of the Charter—fails to respect the essence of a fundamental right, that measure is to be set aside.

While generally fundamental rights can be restricted if a limitation is a necessary and proportionate measure to achieve an objective of general interest or to protect the rights and freedoms of others, a measure which trenches on the essence of the right cannot be justified in this way. As President Lenaerts puts it:

Once it is established that the essence of a fundamental right has been compromised, the measure in question is incompatible with the Charter. This is so without it being necessary to engage in a balancing exercise of competing interests. As the Schrems I judgment shows, a measure that compromises the essence of a fundamental right is automatically disproportionate.

The caselaw on the "essence" of fundamental rights is, however, notoriously terse in its reasoning, especially in relation to state surveillance. That said, we can pick out four key findings:

First, the caselaw recognises a content/metadata distinction: In Digital Rights Ireland legislation requiring telecommunications companies to indiscriminately retain traffic and location data on all users was held not to violate the essence of the right to privacy under Article 7 of the Charter on the basis that "the directive does not permit the acquisition of knowledge of the content of the electronic communications as such". (Tele2 restates this point.) Conversely in Schrems I the CJEU held (regarding US law) that "legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life, as guaranteed by Article 7 of the Charter".

Second, it seems clear that the caselaw requires an individual legal remedy for wrongful surveillance to include deletion of illegally obtained surveillance material; in Schrems I the CJEU held that: "legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter". (Schrems II makes a similar finding in relation to the Privacy Shield ombudsman mechanism without explicitly addressing the point.)

Third, the CJEU seems to have implicitly accepted that indiscriminate state access to metadata would not violate the essence of the fundamental rights to privacy and data protection: in Privacy International the Court assessed UK bulk collection of communications data on a proportionality basis without mentioning the question of whether bulk collection violated the essence of these rights.

Fourth, the caselaw accepts (in the two PNR cases) that indiscriminate state access to travel data does not in itself violate the essence of the fundamental rights to privacy and data protection, at least so long as that data is "limited to certain aspects of that private life" and does not "allow for a full overview of the private life of a person" (Opinion 1/15; Ligue des droits humains).

Overall, therefore, the notion of the essence of rights has played a limited role in relation to EU and Member State surveillance measures, and the CJEU has been unwilling to hold that even what it describes as "very far-reaching [and] particularly serious" interference with these rights (indiscriminate telecommunications data retention) constitutes an interference with the essence. While there are many cases invalidating EU/Member State surveillance measures on proportionality grounds, there are none which find that such measures violate the essence of the rights to privacy or data protection.

Why this reluctance? It may be that preserving institutional capital plays a role: a finding that a particular form of surveillance violates the essence of a right would be very difficult to walk back in the case of Member State pushback, while a finding of disproportionality is more easily finessed in future cases. The one area where the CJEU has found a surveillance tactic to violate the essence of a right - generalised state access to the contents of communications - is precisely the area which has not presented a significant clash with Member States, as their bulk interception activities have largely been shielded from scrutiny by the CJEU by the general exclusion of national security measures from the scope of EU law. Instead, direct Member State activities in this area have generally been assessed by the more lenient standards of the ECHR, under which the ECtHR has held that bulk interception is in principle compatible with Article 8 (Big Brother Watch; Centrum För Rättvisa).

My sense is that this position - in which the CJEU has not had to confront wider issues around the essence of the rights to privacy and data retention, particularly in relation to bulk interception - is about to come to an end.

Multiple current controversies are set to put issues about the essence of these rights in front of national courts and ultimately the CJEU. The Encrochat and SkyECC investigations are already presenting significant issues about the legality of bulk collection of communications from all users of particular services. The proposed CSAM Regulation would mandate indiscriminate examination of all communications on particular services and is certain to be challenged on that basis. The fallout from state use of spyware such as Pegasus across Europe continues. (Indeed, the EDPS has already described such spyware as threatening the essence of the right to privacy.) The EDPB has also described growing use of widescale facial recognition in public places as likely to violate the essence of the right to data protection.

What these situations have in common (with a possible exception in relation to state spyware, depending on the exact context) is that they are certainly within the scope of EU law and therefore do not benefit from the national security cloak of invisibility. It may be that some of these cases can be dealt with solely under the Law Enforcement Directive, the e-Privacy Directive, the forthcoming AI Act, or other relevant legislative measures, but it seems inevitable that the CJEU will ultimately have to address whether these types of large scale surveillance are compatible with the "essence" of the Charter rights to privacy and data retention.

Finally, I should mention an issue about procedural approaches to identifying the essence of these rights in the context of state surveillance. Some of the caselaw (such as Digital Rights Ireland and the PNR decisions) suggests that there is no breach of the essence of the right to data protection provided that the law provides some data protection safeguards, albeit that those safeguards might not be adequate. Other judgments (particularly Schrems I and II) place particular focus on the right to effective judicial protection under Article 47 of the Charter. However it seems to me that to concentrate on procedural safeguards risks conflating assessing the essence of the right with assessing the legality of the interference with the right. Article 52(1) of the Charter already provides that limitations on rights must be "provided for by law". This closely resembles Article 8(1) ECHR which provides that restrictions on the right to privacy must be "in accordance with the law" - a formula which has been used by the ECtHR in cases from Klass v. Germany onwards to read in safeguards such as independent oversight of surveillance as essential components of legality of surveillance systems. If the legality assessment already requires some procedural safeguards, then is it redundant to treat those safeguards as also making up (part of) the essence of these rights? To put it another way, what are the additional procedural or oversight elements that comprise the essence of these rights which are not required by the principle of legality?

Issues with the new Garda Powers Bill

I have a piece in today's Irish Times which identifies some serious concerns with the new Garda Powers Bill. Here's an excerpt:

The sensitivity of your phone means that this week’s proposal from the Department of Justice for a new Garda Síochána Powers Bill requires close scrutiny. That proposal would introduce a new power for gardaí, when carrying out search warrants, to demand your password or PIN and require you to biometrically unlock your phone (or tablet, or computer) using your fingerprint or face.

As well as taking a copy of everything on the device itself, gardaí could also use the device to access any other service you use – such as your webmail, cloud storage, or online banking – and then take a copy of that data also.

The way in which the searches would be carried out is concerning. Failure to comply with the demand there and then (with no right to consult a solicitor) would be an offence exposing you to immediate arrest, punishable by imprisonment for up to five years and a fine of up to €30,000. This power would also apply to the devices of “any person present at the place where the search is carried out”, including for example the parents or siblings of a suspect or someone who shares a house with them.

Full text

The GAA and the GDPR

I have a piece in the Irish Times today discussing the kerfuffle about GAA clubs using WhatsApp to communicate with members. It may be the first time the phrase "dick pics" has appeared on the opinion pages of the paper of record. Here's an excerpt:

Facebook is not providing WhatsApp for philanthropic purposes, and information about who you communicate with, how and when is immensely valuable. When it bought WhatsApp, Facebook attempted to combine that information with individuals’ Facebook activity – to build up a complete picture of your activity, public and private – despite stating to the European Commission that it would not do so. Facebook was eventually stopped by data protection authorities, and in 2017 it was fined €110 million by the European Commission for its deceptive statements during the merger. 

Nevertheless, it has stated that it still aims to use WhatsApp information for Facebook advertising, and presumably will also use your WhatsApp activity for ad targeting as it rolls out advertising on WhatsApp in 2020. 

Given the commercial value of this personal information, clubs and other groups who communicate through WhatsApp are still paying for a service – it’s just that they’re shifting the cost to their members, who pay with their privacy.

Full text