The National Council for Civil Liberties (Liberty), R (On the Application Of) v Secretary of State for the Home Department & Anor

Where primary legislation is incompatible with directly effective EU law, disapplication is not automatically required with immediate effect. The court must consider the nature and extent of the incompatibility, the practical consequences, and the constitutional position of Parliament. Where compliance requires a new legislative scheme, a declaration may identify the incompatibility and require its correction within a reasonable time.

A statutory scheme permitting targeted data retention is not necessarily a system of general and indiscriminate retention merely because broad categories of data may be retained. The legislation must be assessed as a whole, including its necessity, proportionality, safeguards and review mechanisms. A seriousness threshold applies to retention for combating crime, but not necessarily to intrinsically important objectives such as national security or public safety.

The claimant challenged Part 4 of the Investigatory Powers Act 2016, which permits the Secretary of State to require telecommunications operators to retain communications data. The challenge concerned compatibility with EU law, particularly the safeguards identified by the CJEU in the Watson litigation.

The defendants conceded that Part 4 was incompatible in two respects: access to retained data was not restricted, in criminal investigations, to combating serious crime; and access was not subject to prior review by a court or independent administrative body. The claimant sought an order of disapplication, together with rulings or references on further issues including general and indiscriminate retention, entity data, national security, data retained outside the EU and notification.

1. Outcome and remedy. The claim succeeded in part. Part 4 of the Investigatory Powers Act 2016 was incompatible with EU law because, in the area of criminal justice, access to retained data was not limited to combating serious crime and was not subject to prior review by a court or independent administrative body. The appropriate remedy was a binding declaration, not an order of disapplication. The incompatibilities were required to be remedied within a reasonable time, specified as 1 November 2018, with liberty to apply.
2. Disapplication. The effect of EU supremacy in domestic law is that incompatible legislation is ineffective to the extent of the inconsistency. But immediate disapplication is not automatic. The court must examine the nature of the incompatibility. Where the defect consists of omitted safeguards and compliance requires positive legislative action to create an alternative scheme, constitutional and practical considerations may justify allowing Parliament a reasonable period to legislate.
3. Retention scheme. Part 4 did not require or permit general and indiscriminate retention. The scheme required the Secretary of State to consider necessity and proportionality, limited retention to a maximum of 12 months, required consideration of specified factors, consultation and, once in force, approval by a Judicial Commissioner. The legislation therefore had to be assessed as a whole rather than by isolating provisions capable of describing broad categories of data.
4. Entity data. “Events data” under section 261(4) of the Act encompassed traffic and location data within the e-Privacy Directive. Entity data falling outside those definitions did not fall within the relevant part of the CJEU’s decision in Watson. The issue was acte clair and required no further reference.
5. Seriousness threshold. The serious-crime limitation applied to the crime objective. It did not follow that every other legitimate objective required an additional seriousness threshold. National security, public safety and the investigation of miscarriages of justice were capable of justifying interference in principle; necessity and proportionality remained essential.
6. Other issues. The court declined further references on national security and retention within the EU because materially overlapping questions were already before the CJEU in Privacy International. Those parts of the claim were stayed. Notification was relevant to access, not merely retention. The court declined to determine hypothetical arguments concerning codes of practice.

First-instance judicial review proceedings. The judgment records related proceedings concerning the Watson litigation, including the Divisional Court decision, a reference to the CJEU and the subsequent Court of Appeal judgment, but this claim was determined in the High Court.