Drip, drip, drip; and the next thing you know, democracy has been washed away

UK CT readers, please read this Open Rights Group myth-buster on the surveillance legislation the three main parties have stitched up behind closed doors, and plan to vote through as an emergency tomorrow. Is your MP planning to vote for it? If they are, ask them if they will support a (to be tabled this afternoon) amendment that will bring the sunset clause down to 6 months – surely enough time to fix the ’emergency’.

(More analysis from Paul Bernal here.)

(Email your MP here.)

What is DRIP?
The Data Retention Investigatory Powers Bill (DRIP) will require internet and phone companies to keep their customers’ communications data for up to a year. It is being rushed through parliament this week: MPs will vote on Tuesday and the Lords will vote on Thursday.

DRIP will replace the Data Retention (EC Directive) Regulations 2009. The legal basis of these regulations has been uncertain since the Court of Justice of the European Union (CJEU) after the CJEU found the EU Data Retention Directive 2006/24/EC to be invalid.
Legal wranglings aside, the ruling was very clear. Keeping everyone’s data in case they commit a crime seriously interferes with our right to privacy and our right to a private family life.

Additionally clauses 3-5 extend UK surveillance law – RIPA – to US and foreign companies. These measures are controversial, not related and there is no evidence that there is any reason for any rush.

Below are five arguments that the Government is using to justify its passing – and the real reason why it shouldn’t.

“This is an emergency”
The CJEU ruling was delivered on 8 April, 2014. The government has had three months to address the court’s findings. We believe that it is the threat of legal action by Open Rights Group and other organisations that has prompted this ‘emergency’ legislation – not the threat of terrorism or criminal activity. The government should not mislead us about the urgency of this legislation. Given its significance and the threat to our civil liberties, It should not be rushed through without proper parliamentary scrutiny.

Background: After the CJEU ruling, Open Rights Group and other organisations contacted the Home Office to ask them if they would be asking internet service providers to stop retaining data. In May, the Home Office responded by saying that ISPs should continue to retain data. Last month, over 1,500 ORG supporters wrote to their ISPs asking them to stop keeping their data. They responded by saying that they were acting under the instructions of the Home Office.

“This is not an extension of powers, it’s restoring the status quo”
The Prime Minister said, “we are not introducing new powers or capabilities” but in fact DRIP does not just deal with Regulations that were made illegal by the CJEU ruling. Clauses 3 to 5 of the Bill make amendments to the Regulation of Investigatory Powers Act (RIPA). DRIP extends the government’s surveillance powers in two ways:

It extends the territorial scope of RIPA – this means that the government can issue interception warrants for communciations data to companies outside of the UK.
It extends the definition of “telecommunications service” within RIPA. The effect of this is unclear, but it appears possible the new definition could include services such as Gmail.

“It’s the only way we can catch criminals”
We agree that the targeted retention of communications data can help the police to tackle serious crimes, such as terrorism and child abuse. However, the CJEU ruling outlined a low threshold for deciding to retain data. For example, if a serious crime if committed, data could be retained for a particular geographical region to support a criminal investigation. This means that the police could still retain data for specific investigations, rather than the blanket surveillance of all citizens.

The CJEU ruling was clear that blanket data retention interfered with our right to privacy and our right to a private family life. Other European countries, including Austria, Belgium, Bulgaria, Germany, Greece, Romania and Sweden, have rejected it. These countries continue to tackle serious crime without undermining their citizens’ civil liberties through blanket data retention.

“There is a sunset clause”
The Bill will expire on 31 December 2016. The government claims that this will ‘strengthen oversight and transparency’ but that is two and a half years away. Given that the Bill is to be rushed through parliament in a week, we believe that this date is too late to allow for proper parliamentary scrutiny. If legislation is to be rushed through without debate, an earlier expiry date of 31 December 2014 would allow for scrutiny in six months.

“The Bill includes concessions that take into account the CJEU ruling”
DRIP ignores the main part of the CJEU ruling – that blanket data retention severely interferes with the fundamental rights to respect for private life and to the protection of personal data. The government has claimed that other aspects of the Bill will strengthen oversight and transparency. For example, they claim it will restrict the number of public bodies that can request communications data. Yet this concession does not appear in DRIP or the secondary legislation that will implement it.