Following on from my last article, the European Court of Justice (ECJ) has ruled that the Investigatory Power Act is unlawful in that the mass collection of data is unlawful. Therefore the Act exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society, as required by the directive.
I am particularly happy that the court highlighted my concern about how much information about its citizens is simply too much.
In that connection, the court stated that:
with respect to retention, the retained data, taken as a whole, is liable to allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained.
The court also ruled that:
As regards the access of the competent national authorities to the retained data, the Court confirms that the national legislation concerned cannot be limited to requiring that access should be for one of the objectives referred to in the directive, even if that objective is to fight serious crime, but must also lay down the substantive and procedural conditions governing the access of the competent national authorities to the retained data.
In other words, it is not sufficient to limit after-the-fact access to the data: The data must not be collected at all except in a specific case where a serious crime can be shown to be likely.