David Davis MP and Others v The Secretary of State for the Home Department Open Rights Group and Others (Interveners)

Hearing dates: 4–5 June and 9 July 2015

This is the judgment of the court to which we have both contributed.

The claimants in three separately issued claims, which we heard together, apply for judicial review of the data retention powers in section 1 of the Data Retention and Investigatory Powers Act 2014 ("DRIPA"). Mr Brice and Mr Lewis, the claimants for whom Mr Drabble QC appeared, are concerned about the width of the powers to retain and gain access to their data on a number of grounds, including (but not limited to) the confidentiality of communications with solicitors. Mr Davis and Mr Watson, who are joint claimants in case CO/3794/2014, do so as members of the House of Commons who share those general concerns but also in addition have particular concerns about the confidentiality of communications to and from constituents. Mr Davis is Conservative MP for Haltemprice and Howden; Mr Watson is Labour MP for West Bromwich East.

Permission to seek judicial review was initially refused on the papers by Blake J but was granted at an oral hearing by Lewis J on 8 ^th December 2014. Lewis J also permitted Open Rights Group and Privacy International to submit an intervention by way of written submissions (on terms that the interveners would bear their own costs). We granted an application by the Law Society made shortly before the hearing to intervene by way of written submissions on the same basis.

The challenge is to the validity of s 1 of DRIPA and the Regulations made under it as being contrary to European Union law, as expounded in the decision of the Grand Chamber of the Court of Justice of the European Union ("the CJEU") in Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and others and the conjoined case of Kärntner Landesregierung, Michael Seitlinger, Christof Tschohl and others delivered on 8 ^th April 2014 and reported at [2015] QB 127. We shall refer to this decision as " Digital Rights Ireland".

At common law, Acts of the United Kingdom Parliament are not open to challenge in the courts. But the position under EU law is different. Decisions of the CJEU as to what EU law is are binding on the legislatures and courts of all Member States. The subtleties of the relationship between UK domestic courts and the European Court of Human Rights at Strasbourg arising, since 2000, from the duty under s 2(1) of the Human Rights Act 1998 to "take account" of the jurisprudence of that court, do not arise. The claimants (as a fallback to their EU law arguments) have pleaded an alternative claim for a declaration under s 4 of the HRA 1998 that s 1 of DRIPA is incompatible with their Convention rights; but this was scarcely mentioned in oral argument. Indeed, as will be seen later in this judgment, it was mainly counsel for the Home Secretary, not counsel for the claimants, who asked us to take account of the jurisprudence of the Strasbourg court in support of his arguments.

The present claims involve, as did Digital Rights Ireland, the CJEU's interpretation of Articles 7 and 8 of the Charter of Fundamental Rights of the EU. Article 7 provides:

"Everyone has the right to respect for his or her private and family life, home and communications."

Article 8 provides:

"1. Everyone has the right to the protection of personal data concerning him or her.

2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.

3. Compliance with these rules shall be subject to control by an independent authority."

The first of these Articles is in identical terms to Article 8(1) of the ECHR, except that the word "correspondence" is replaced by "communications". The second has no counterpart in the ECHR.

In Rugby Football Union v Consolidated Information Services Ltd (formerly Viagogo Ltd) [2012] 1 WLR 3333 Lord Kerr of Tonaghmore JSC, with whom the other Justices of the Supreme Court agreed, said at paragraphs 27–28:—

"The Charter was given direct effect by the adoption of the Lisbon Treaty in December 2009 and the consequential changes to the founding treaties of the EU which then occurred. Article 6(1) of the Treaty on European Union (TEU) now provides:

"The Union recognises the rights, freedoms and principles set out in the Charter of Fundamental Rights of the European Union of 7 December 2000, as adapted at Strasbourg, on 12 December 2007, which shall have the same legal value as the Treaties.

The provisions of the Charter shall not extend in any way the competences of the Union as defined in the Treaties.

The rights, freedoms and principles in the Charter shall be interpreted in accordance with the general provisions in Title VII of the Charter governing its interpretation and application and with due regard to the explanations referred to in the Charter, that set out the sources of those provisions."

Although the Charter thus has direct effect in national law, it only binds member states when they are implementing EU law — article 51(1). But the rubric, "implementing EU law" is to be interpreted broadly and, in effect, means whenever a member state is acting "within the material scope of EU law"…….Moreover, article 6(1) of TEU requires that the Charter must be interpreted with "due regard" to the explanations that it contains."

The Secretary of State's Detailed Grounds of Defence are thus correct in stating at paragraph 38 that "the test of validity of the Act [DRIPA] and the 2014 Regulations is whether they are compliant with Articles 7 and 8 of the EU Charter and/or Article 8 ECHR." Data protection law has been within the scope of EU law for 20 years. The Data Protection Act 1998 was enacted to implement the Data Protection Directive (95/46/EC). The Explanations referred to in the Charter and printed in the Official Journal of the EU make it clear that Article 8 of the Charter was based on Article 286 of the Treaty establishing the European Community (as amended) and on the Data Retention Directive, among other sources. This is not a case in which any party has argued that Article 8 of the Charter lies outside the proper scope of EU law, although it will be seen that there is a dispute as to whether it covers access to data as well as retention.

Article 52(3) of the Charter provides:-

"In so far as this Charter contains rights which correspond to rights guaranteed by the [ECHR], the meaning and scope of those rights shall be the same as those laid down by the said Convention. This provision shall not prevent Union law providing more extensive protection."

The Secretary of State prays in aid the first sentence; the Claimants the second. As to the second, Mr Eadie submitted that it does not entitle the CJEU (or this court) to hold that the scope of anyone's rights has been extended by virtue of the Charter, since it was not intended to give fresh rights but to consolidate existing rights. This approach, he submitted, is confirmed by Protocol 30 to the EU Treaties, negotiated by the UK and Poland, which provides:-

"The Charter does not extend the ability of the Court of Justice, or any court or tribunal of Poland or of the UK, to find that the laws, regulations or administrative provisions or action of Poland or of the UK are inconsistent with the fundamental rights, freedoms and principles that it reaffirms.

In particular, and for the avoidance of doubt, nothing in Title IV of the Charter creates justiciable rights applicable for Poland or the UK except in so far as Poland or the UK has provided for such rights in the national law." [Title IV is not relevant in this case]

The precise scope of Protocol 30 is far from clear, since it only precludes the extension by the CJEU or domestic courts of their existing powers to find that UK laws are not in accordance with the Charter. It cannot be used to prevent the court from defining the extent of rights contained in the Charter which set out provisions within the material scope of EU law.

The extent of the State's powers to require the retention of communications data and to gain access to such retained data are matters of legitimate political controversy both in the UK and elsewhere. The Queen's Speech opening the new Parliament on 27 May 2015 indicated that "new legislation will modernise the law on...