The role of NGOs in Public Interest Litigation

The role of NGOs in Public Interest Litigation Digital Rights Ireland PILA Seminar 9 February 2012 TJ Mc. Intyre UCD School of Law

Without whom none of this would be possible • Mc. Garr Solicitors • Frank Callanan SC • Fergal Crehan BL • Mark Dunne BL

Background: Data retention as a tracking mechanism, both geographic. . .

. . . and social, monitoring communications and mapping citizens

Timeline – Ireland • Pre 2001 – 6 year data retention – No legal basis • Nov. 2001 – Irish Times breaks story – Data Protection Commissioner intervenes – Directs 6 month retention period • Apr. 2002 – Ministerial Direction – s. 110 of the P&TSA 1983 – 3 year retention period – Direction secret

Timeline – Ireland • DPC claims Ministerial Direction inadequate – Not intended use of legislation; ultra vires the 1983 Act – Primary legislation would be required – Judicial review threatened – Enforcement notice issued – All of this happened in secret • Criminal Justice (Terrorist Offences) Act, 2005 – 3 year data retention for all telephone calls and mobile locations – Does not extend to internet use

The European Dimension • 2006 Data Retention Directive – EU law; supersedes national laws – Requires telcos, ISPs to log your movements, calls, texts, email, etc. • Traffic data rather than content – Up to 2 year retention – Accessible for • • Terrorism, serious crime Filesharing Defamation Whatever national law allows. . . – No warrant required to access

Irish Implementation of Directive • Communications (Retention of Data) Act 2011 – Covers internet use – Retention period: • 2 year telephony • 1 year internet – Data access still a matter for internal Garda approval only

Objections? • Proportionality and principle – Should we monitor the entire population at all times? • Risks of abuse – By both state and industry • No necessity – EU states accepted “data preservation” in 2001 - why hasn’t this been tried? • Function creep – Calls to extend to search engines , etc. • Chilling effects

Challenging Data Retention • National civil rights groups coordinating through EDRi 1. Litigation strategies to overturn data retention 2. Political strategies to repeal / amend Directive Electronic Frontier Finlan Julia Group Electronic Frontier Norway FIPR Danish Consumer Council ORG Internet Society Bits of Freedom Poland AK Vorrat Iuridicum Remedium La Quadrature du Net Hungarian Civil Liberties APTI Union ICCL Digital Rights Ireland (Over 100 organisations in total. . . this is just a random smattering) ALCEI exgae Winston Smith Project

Court challenges successful/pending/rejected • Bulgaria • Romania • Germany • Ireland • Hungary • France • Czech Rep. • Cyprus

Outcomes? • France (2007) – Industry challenge rejected • Bulgaria (2008) – National law void for vagueness • Romania (2009) – Data retention itself found to breach ECHR for interference with private life • Germany (2010) – National law unconstitutional for inadequate safeguards – Other litigation pending • Czech Republic (2011) – Implementing law found vague, open to abuse • Cyprus (2011) – Police access held too extensive • Hungary (pending) • Partial victories only – Helping to form legal / political opinion; but the Directive remains in place and replacement laws must be passed

Digital Rights Ireland challenge • Challenge to both Irish law and Directive • Started 2006 • Favourable venue • Preliminary hurdles (2010) – Locus standi – Security for costs

Where are we now? • Irish Human Rights Commission an amicus curiae • Actio popularis granted – “sincere & serious litigant” • Security for costs rejected – “issues of significant public importance” • Reference to ECJ given • Order finalised; 2 year wait to be heard • Delay helpful!

What happens if we win? • If the Directive is struck down: – Data retention returns to political arena – May be back on the agenda at EU level – Will probably be back on agenda at national levels

Parallel political strategies • Evaluation of Directive just concluded – Unique opportunity to change political climate – (And to gather evidence for DRI action) – Art. 29 Working Party have found Directive is being abused, ignored • Content data being held (esp. URLs visited) • Longer retention periods than allowed – 10 years in one case! • No real statistics on use of retained data, evidence of usefulness, necessity • Data being handed over by ISPs outside legislation • No effective harmonisation • Over 100 civil society groups have called for repeal • Growing awareness amongst journalists, doctors, lawyers

Observations • The decision to litigate – A last resort? – A resource intensive distraction from political activity? – Are there low cost alternatives? Allies? • Data Protection Commissioner / European Commission? • Advice to criminal practitioners? – Can the organisation afford to lose? • Choice of forum – – Not just national but now international National standing rules? Access to constitutional courts? Willingness to make references to ECJ?

Observations • Choice of plaintiff crucial – Corporate plaintiffs still face difficulties • What rights do they have? To what extent? • Abstract nature of case may harm chances – Litigation beyond the capacity of an individual • Even in criminal matters • International dimension increasingly the norm – Domestic law always viewed against ECHR – Action before ECJ may be necessary – International cooperation may be desirable or essential • Partner groups supply evidence, expertise, etc. • DR policy demands international engagement • Policy laundering more common

Observations • Role of the IHRC – IHRC resource constrained; • but amicus work is a high impact and (relatively) low cost exercise – Immensely useful in establishing credibility before High Court • What is the endgame? – Judgments aren’t (necessarily) self-executing – What happens once you win your challenge? – Is there a political coalition in place to take advantage? Or is it back to square one? – Is your challenge substantive or procedural?

Thank you More information: Web: Digital. Rights. ie; TJMc. Intyre. com Twitter: @tjmcintyre UCD School of Law

Background reading • Breyer, “Telecommunications Data Retention and Human Rights: The Compatibility of Blanket Data Retention with the ECHR” (2005) 11(3) European Law Journal 365 • Mc. Intyre, “Data Retention in Ireland: Privacy, Policy and Proportionality” (2008) 24(4) Computer Law and Security Report 326 • Digital Rights Ireland v. Minister for Communications and others [2010] IEHC 221.