Ireland / Supreme Court / 2019/18

Dwyer vs. The Commissioner of An Garda Siochana, Minister for Communications, Energy and Natural Resources, Ireland and Attorney General
Deciding body type
National Court/Tribunal
Deciding body
Supreme Court
Type
Decision
Decision date
24/02/2020
  • Ireland / Supreme Court / 2019/18
    Key facts of the case:
    Graham Dwyer was convicted in 2015 of the murder of Elaine O’Hara in 2012. Key evidence at the trial was data gathered from Dwyer’s phone which placed his phone at specific places at particular times and dates. Phone data was also used to link Dwyer’s phone to one of a pair of phones which were discovered in a body of water with some of the victim’s belongings. The phone data was acquired under the Communications (Retention of Data) Act 2011 ‘the 2011 Act’, which, inter alia, requires all service providers to retain telephony data to identify source, destination, timing, geographic location and type of equipment used, for two years. The 2011 Act was put in place to give effect to Directive 2006/24/EC on data retention. However, the 2006 Directive had been declared invalid by the ECJ in [ECLI:EU:C:2014:238] (“Digital Rights”). In ‘Digital Rights’, the ECJ held that the adoption of the Directive contravened Articles 7, 8 and 52(1) of the Charter, and the Directive was declared invalid. This meant that the earlier 2002 Directive on processing of personal data and privacy now applies. The plaintiff argued the 2011 Retention of Data Act contravened EU law, including the Charter, the ECHR, and the Irish constitution, in that the Act permits holding of data in a manner which is general and indiscriminate.
     
    Key legal question raised by the Court:

    In January 2019, Justice O’Connor in the High Court made the following declaration: “that s. 6(1)(a) of the Communications Retention of Data Act 2011, (“the Act”), insofar as it relates to telephony data, as defined in Part 1 of Schedule 2 of the Act, and which is retained on a general and indiscriminate basis as provided for in s. 3 of the Act, is inconsistent with Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, read in light of Article 7, 8 and 52(1) of the Charter of Fundamental Rights of the European Union.” (“the Declaration”). ([2019] IEHC 48). The respondents then appealed this decision to the Supreme Court, which was heard in December 2019. Judgment was then issued in February 2020.

    The key legal question for the Court to decide was whether the 2011 Retention of Data Act was compatible with EU law, specifically the 2002 Directive interepreted in light of the Charter.

     
    Outcome of the case:

    In terms of factual outcome, the Supreme Court referred the case to the CJEU for further consideration, but it is worth noting that the Chief Justice in the Supreme Court hearing took a different approach from Justice O’Connor in the High Court from which it was appealed. The Supreme Court submitted a preliminary reference to the CJEU on the grounds that three points needs clarification of law: 1. where a system of universal retention of metadata for a fixed period of time is never permissible irrespective of how robust any regime for allowing access may be. Essentially, the Chief Justice argued that distinction should be made between retention (in this case, universal telephony data, for two years) and access (subject to narrower restrictions). He argued that ‘significant regard would have to be attributed to the fact that many serious crimes against vulnerable people are most unlikely, on the undisputed evidence, to be capable of successful prosecution in the absence of a system of universal retention.’ (para 6.18). 2. The criteria whereby an assessment can be made as to whether any access regime to such data can be found to be sufficiently independent and robust In this respect, the Chief Justice stated that: ‘it does not seem to me that the access system which is to be found in the 2011 Act is sufficiently robust to meet the standards identified by the CJEU in its jurisprudence’, but that a question remains as to whether it would be appropriate to make such a final determination without referring questions to the CJEU in respect of the proper approach to the assessment of the access regime.

    3. whether a national court, should it find that national data retention and access legislation is inconsistent with European Union law, can decide that the national law in question should not be regarded as having been invalid at all times but rather can determine invalidity to be prospective only. He noted the fact that the 2011 Act has been put in place to give effect to Directive 2006/24/EC, and that Ireland had in fact been brought tho the CJEU by the European Commission in Commission v. Ireland (Case C-202/09) [2009] E.C.R. I-203, ECLI:EU:C:2009:736, for its failure to transpose the 2006 Directive and was held at the time by the Court to have failed to have fulfilled its obligations thereunder (see para 1.3). However, following ‘Digital Rights’ the 2006 Directive and by extension, the 2011 Act were held to be invalid. He highlights the argument made by the State that: ‘any determination should not be retrospective and might indeed be prospective from a date in the future, not least precisely because Ireland had been required by the CJEU itself to enact the 2011 Act.’ [emphasis added]. In his judgment, the Chief Justice highlighted that retaining of telephony data has been particularly instrumental in obtaining evidence of crimes against vulnerable people, such as in the case concerning Mr Dwyer, where the circumstances do not generally lead to prior suspicion. In his dissenting opinion, Mr Justice Peter Charleton went further in citing two well known serious criminal cases which involved retention and recovery of data, one concerning a 1996 gang related murder of a journalist, and the other concerning the 1998 Omagh bombing. His contention was that Article 47 of the Charter provides for effective remedy and that ‘without the secure retention of metadata and the potential to access and analyse it for strictly limited purposes related criminal investigation, the most serious crime against life and limb would remain undetected. Victims, including the survivors of victims’ families, would be deprived of their human right to access a court proceeding in pursuit of justice.’ (Dissent, para 9).

     

  • Paragraphs referring to EU Charter

    1. Introduction

    1.1 The extent to which it is permissible for public authorities both to require private telephony service providers to retain certain data about communications and, potentially, to disclose that information to investigating and prosecuting authorities, has been a significant issue within the European Union for a number of years. In particular, a directive dealing with such matters, Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly

    available electronic communication services or of public communications networks and amending Directive 2002/58/EC (“the 2006 Directive”), was found by the Court of Justice of the European Union (“CJEU”) to be in breach of rights guaranteed by the Charter of Fundamental Rights of the European Union (“the Charter”) and thus deemed invalid (see, Digital Rights Ireland Limited v. Minister for Communications, Marine and Natural Resources & Ors and Kärntner Landesregierung and Others (Joined Cases C-293/12 and C-594/12), ECLI:EU:C:2014:238, (“Digital Rights”)). …1.7 The defendants/appellants (“the State”) have appealed to this Court against the finding of the High Court. The net issue for this Court is, therefore, confined to the question of the validity or otherwise of the 2011 Act, having regard to the 2002 Directive properly interpreted in the light of the Charter. ….3.9 The CJEU, as already noted, determined in Digital Rights that the 2006 Directive was inconsistent with EU law and, in particular, the Charter. The key passages from the judgment of the CJEU in Digital Rights are as follows:- “24. It follows from Article 1 and recitals 4, 5, 7 to 11, 21 and 22 of Directive 2006/24 that the main objective of that directive is to harmonise Member States’ provisions concerning the retention, by providers of publicly available electronic communications services or of public communications networks, of certain data which are generated or processed by them, in order to ensure that the data are available for the purpose of the prevention, investigation, detection and prosecution of serious crime, such as organised crime and terrorism, in compliance with the rights laid down in Articles 7 and 8 of the Charter. … 37. It must be stated that the interference caused by Directive 2006/24 with the fundamental rights laid down in Articles 7 and 8 of the Charter is, as the Advocate General has also pointed out, in particular, in paragraphs 77 and 80 of his Opinion, wide-ranging, and it must be considered to be particularly serious. Furthermore, as the Advocate General has pointed out in paragraphs 52 and 72 of his Opinion, the fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance.”

    3.10 Turning to assess the justification of this interference, the Court considered that such an interference did not adversely affect the essence of those rights guaranteed by Articles 7 and 8 of the Charter. … 3.11 The CJEU then considered the proportionality of the interference with these rights, ultimately concluding that by adopting Directive 2006/24, the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality in the light of Articles 7, 8 and 52(1) of the Charter. … 53. In that regard, it should be noted that the protection of personal data resulting from the explicit obligation laid down in Article 8(1) of the Charter is especially important for the right to respect for private life enshrined in Article 7 of the Charter. … 60. Secondly, not only is there a general absence of limits in Directive 2006/24 but Directive 2006/24 also fails to lay down any objective criterion by which to determine the limits of the access of the competent national authorities to the data and their subsequent use for the purposes of prevention, detection or criminal prosecutions concerning offences that, in view of the extent and seriousness of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, may be considered to be sufficiently serious to justify such an interference. On the contrary, Directive 2006/24 simply refers, in Article 1(1), in a general manner to serious crime, as defined by each Member State in its national law. … 65. It follows from the above that Directive 2006/24 does not lay down clear and precise rules governing the extent of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter. It must therefore be held that Directive 2006/24 entails a wide-ranging and particularly serious interference with those fundamental rights in the legal order of the EU, without such an interference being precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary. 66. Moreover, as far as concerns the rules relating to the security and protection of data retained by providers of publicly available electronic communications services or of public communications networks, it must be held that Directive 2006/24 does not provide for sufficient safeguards, as required by Article 8 of the Charter, to ensure effective protection of the data retained against the risk of abuse and against any unlawful access and use of that data…” 3.12 Obviously the validity or otherwise of various national measures which predated the decision of the CJEU in Digital Rights came into question thereafter. In the first major case on that topic, Tele2 Sverige AB v. Post- och telestyrelsen and Secretary of State for the Home Department v. Tom Watson and Others (Joined Cases C-203/15 and C- 698/15), ECLI:EU:C:2016:970 (“Tele2 Sverige”), the CJEU approached the question of the validity of national measures governing data retention in the light of the 2002 Directive, interpreted in accordance with the terms of the Charter, … 108. However, Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, does not prevent a Member State from adopting legislation permitting, as a preventive measure, the targeted retention of traffic and location data, for the purpose of fighting serious crime, provided that the retention of data is limited, with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted, to what is strictly necessary. …3.13 In response to a further question referred, the CJEU set out the correct approach to be taken by national courts in determining whether national legislation satisfies the requirements of Article 15(1) of the 2002 Directive, read in light of Articles 7, 8, 11 and 52(1) of the Charter, with respect to the access of the competent national authorities to retained data, at paras. 118-123:- …123. In any event, the Member States must ensure review, by an independent authority, of compliance with the level of protection guaranteed by EU law with respect to the protection of individuals in relation to the processing of personal data, that control being expressly required by Article 8(3) of the Charter and constituting, in accordance with the Court’s settled case-law, an essential element of respect for the protection of individuals in relation to the processing of personal data. If that were not so, persons whose personal data was retained would be deprived of the right, guaranteed in Article 8(1) and (3) of the Charter, to lodge with the national supervisory authorities a claim seeking the protection of their data (see, to that effect, the Digital Rights judgment, paragraph 68, and the judgment of 6 October 2015, Schrems, C 362/14, EU:C:2015:650, paragraphs 41 and 58).”

    …3.30 At least some of the issues earlier identified are to an extent dependent on the facts. The key assessment of the validity of a measure which undoubtedly impacts on rights but which may be justified in the pursuit of legitimate objectives comes down to a question of proportionality. The jurisprudence of the CJEU in that regard can be found in, for example, Schaible (Case C-101/12) EU:C:2013:661, where the Court was asked to assess the validity of provisions of Council Regulation (EC) No 21/2004, which imposed certain obligations on the keepers of sheep and goats in respect of their identification and registration, in Union law, in light of the freedom to conduct a business guaranteed under Article 16 of the Charter. In Schaible, it was recalled that the principle of proportionality requires that measures adopted by European Union institutions do not exceed the limits of what is appropriate and necessary in order to attain the objectives legitimately pursued by the legislation in question. In addition, where there is a choice between several appropriate measures, recourse must be had to the least onerous, and the disadvantages caused must not be disproportionate to the aims pursued. The Court held that the aim of the measures, being to prevent the spread of infectious diseases, constituted a legitimate objective in the public interest. Having considered the alternative means of identification proposed by the applicant in the main proceedings, the CJEU concluded that the measures implemented under Regulation No 21/2004 were appropriate for attaining that objective, that the contested obligations were necessary to achieve that aim and that the disadvantages resulting from those obligations were not disproportionate to that objective pursued by the Regulation. …6.2 It is, of course, the case that the Irish Constitution, in common with the European Convention on Human Rights (“the Convention”) and the Charter, recognises significant privacy rights encompassing a right of privacy in relation to personal data. It has not been suggested to date (and, in my view, could not be suggested) that the separate identification of a right to protection of personal data in Article 8 of the Charter should lead to any divergent analysis of the issues involved when it is sought to challenge the introduction of evidence obtained under a statutory regime permitting retention of data generated by fixed and mobile telephony networks and internet usage …6.3 The Charter itself recognises the possibility of processing of such data on a legitimate basis laid down by law. The analysis, whether under the Charter, the Convention or the Constitution, of any measure provided for by law permitting retention and access to such data is essentially similar. First, it is necessary to consider whether the measure affects a protected right. If so, it is necessary to determine whether any such interference pursues a legitimate objective. Next, and again if so, it must be determined whether the interference is no greater than is necessary to achieve the lawful object and is proportionate in so doing.

    ...6.6 The analysis of the data protection regime implemented in Ireland under the provisions of the 2006 Directive has tended to treat the questions of retention and access as separate issues. It may be open to some doubt as to whether this is necessarily helpful or indeed truly possible. It is clear that the objective of retention is to permit access. It has no function otherwise. On the evidence adduced in this case, it is clear that the data retained in bulk is not itself related to any individual person holding rights under the Constitution, the Charter or the Convention. It is only when access is sought and obtained that it is possible to connect an individual to any specific retained data. …6.15 This contention is troubling from the perspective of Irish constitutional law and the analysis which an Irish court would apply under the Constitution, the Convention and the Charter. First, it appears to be based on a hypothesis which is not supported by any evidence and is indeed contradicted by such evidence as has been adduced in these proceedings. Second, it is apparent that any question of retention of data in advance by reference to geographical criteria would itself involve questions of profiling and differential treatment of individuals on the basis of location and/or their association with others. Assuming, however, that such a course of action would be permissible, it would in principle be something quite different to the regime established by the 2011 Act and would be more intrusive of the rights of the individuals concerned, who themselves may have no necessary connection to any suspected or anticipated crime. Such measures, described as targeted retention, would almost inevitably involve not merely retention but also access to relevant data, identification of the individual and normally access to the content of the communication concerned. 6.16 Most significantly, it is apparent, both as a matter of logic and as established by the evidence in this case, that any such measure cannot achieve the objective of permitting the investigation of serious crimes such as the subject matter of these proceedings, where there is no reason to suspect a particular individual or group in advance. The conclusion therefore that a regime of universal data retention in bulk is per se impermissible, irrespective of the terms of such retention or the conditions of access, would appear not to be a conclusion that the legitimate and important objective of investigating serious crime could be achieved by methods less intrusive of the rights of individuals, but rather a conclusion that the objective of investigating serious crime cannot justify the universal retention of bulk communications data however regulated or controlled. This is a value judgment but one not apparent from the Charter nor, it would appear, one which would be made either under the Convention or the Irish Constitution. In circumstances where the Charter refers to and embodies the common constitutional traditions of the Member States, it is arguable that it should not be interpreted in such a way as to impose such a value judgment on Member States at odds with their constitutional traditions, particularly in circumstances where Article 15(1) of 2002 Directive is permissive and does not require Member States to adopt any system of retention. Thus, a Member State whose traditions would lean against any system of universal retention is free to adopt such a course of action.

    FROM THE DISSENT: Crime as human rights violations …9. Murder, rape and other serious crimes are fundamental violations of human rights, going so far as to remove all human rights by violent death. Article 47 of the Charter of Fundamental Rights of the European Union provides: “Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article.” Experience puts this following proposition beyond any doubt: without the secure retention of metadata and the potential to access and analyse it for strictly limited purposes related criminal investigation, the most serious crime against life and limb would remain undetected. Victims, including the survivors of victims’ families, would be deprived of their human right to access a court proceeding in pursuit of justice. Investigators would be shorn of an indispensable tool for detecting human rights violators. Justice must be an energetic search for the truth upon which alone any fair verdict against an accused person or any vindication of human rights violations can be based. Cutting out the truth in the form of useful and convincing evidence leads to the distortion of the legal process and its being severed from the good sense of the European peoples. Criminologists agree that the fear of detection is central to the deterrence of crime. Ireland has suffered, as the two examples given illustrate, from both organised crime and from terrorism. As the examples also elucidate, these threats to society are dampened by a detection approach which is moderate, protective of private rights and which is founded on the certainty of the legal order. …12. It is a matter for national courts to resolve any issues of compliance. Certainly under Article 8 of the Charter, everyone has the “right to the protection of personal data concerning him or her” and that same “must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law.” This right need not clash with rights to life or bodily integrity guaranteed under Articles 1, 3 and 6 of the Charter since Article 52 provides that any “limitation on the exercise” of any guaranteed right “must be provided for by law and respect the essence of those rights and freedoms.” Section 98 of the 1993 Act, s 53 of the 2005 Act and the other guarantees as to inertness and storage in Irish legislation demonstrate such respect. As Article 52 also provides: “Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.” Legitimate concerns about terrorism and really serious organised crime are behind the legislative provisions and Ministerial directions from the earliest stage. There is no other basis; such as governmental snooping. That does not happen. Further, there is no evidence that any Irish person feels that the inert storage of data with access only on the basis of law excites any fears. An absence of such protection for the population is, instead, a terrifying prospect.

  • Paragraphs referring to EU Charter (original language)