Persona Non Data: How Courts in the EU, UK and Canada are Addressing the Issue of Communications Data Surveillance vs. Privacy Rights

Abstract

When we make a phone call, send an email, connect to the internet or use an app on a connected device, our service provider gathers the “communications data” that we generate that identifies us and reveals details of our activities. This data is increasingly used by law enforcement and intelligence services in the detection and prosecution of crime and the prevention of terrorism. There is, however, anxiety in some quarters, fueled by the Snowden revelations that some western governments have been engaged in mass surveillance of the communications of their citizens, that the existing rules governing retention of our communications data and access to it do not afford adequate protection against state incursion into our private lives. This paper examines how the United Kingdom, the European Union and Canada -- three jurisdictions that share with the United States a strong commitment to personal rights and freedoms -- are approaching the task of safeguarding personal security while protecting personal privacy. We do so through an examination of recent court decisions ruling on the conformity of communications data retention and access laws with privacy rights. These cases present a picture of active judicial engagement in the data retention/access issue that is focused on three main topics: justification (In what circumstances can data retention and access laws justifiably intrude upon privacy rights?); accountability (Is some form of judicial or other independent overview of requests for communications data retention/access necessary to protect privacy rights?); and transparency (How much is the public entitled to know about the state’s practices relating to surveillance of communications data in light of the need to conduct some investigations of serious crimes and terrorist offences in secrecy?) The courts have either declared legislation invalid or imposed safeguards designed to protect privacy rights where communications data retention/access laws do not provide satisfactory answers to these questions.