Spies can pry into phone data only in crises, says EU court

British and French spies can only be handed access to the personal data of phone and internet users when there’s a “serious threat” to national security, the European Union’s top court ruled.

In a judgment welcomed by citizens’ rights campaigners, the EU Court of Justice said the bloc’s law bans wide-scale measures forcing internet and phone operators to carry out “the general and indiscriminate transmission or retention of traffic data and location data.”

“However, in situations where a member state is facing a serious threat to national security that proves to be genuine and present or foreseeable” a government may sidestep the obligation to ensure confidentiality of electronic communications, the court said in its ruling in Luxembourg on Tuesday.

Privacy International and La Quadrature du Net, campaigners for citizens’ right to privacy, brought separate challenges in the UK and in France, arguing that the practices in the nations went too far and violated fundamental rights.

“While the police and intelligence agencies play a very important role in keeping us safe, they must do so in line with certain safeguards to prevent abuses of their very considerable power,” Caroline Wilson Palow, legal director at Privacy International, said in an emailed statement. “Effective, targeted surveillance systems that protect both our security and our fundamental rights” are needed instead, she said.

Also Read: Big US tech firms fail to comply with curb on Europe data transfers

Tuesday’s ruling is the latest in a long line cases seeking to rein in the rights of authorities to keep tabs on citizens. A top EU court ruling in 2014 toppled rules requiring internet and phone companies to store swathes of customer data. Judges said this trampled on people’s privacy rights.

The 2014 case set the scene for years of challenges, including one in which EU judges ruled against the UK over its data retention plans. It also sparked concern in some countries, including in Britain, that the EU judges’ rulings deprive authorities of a crucial power to protect national security and fight terrorism.

National courts in the UK, Belgium and France that had sought the EU judges’ guidance, will now have to apply the EU court’s binding decisions in their final judgments in each of the cases.

While the UK has officially departed from the EU, a transition period is in place until the end of the year, meaning Tuesday’s decision still applies to Britain.

The cases are: C-623/17 Privacy International, Joint Cases C-511/18 La Quadrature du Net e.a., C-512/18 French Data Network & Case C-520/18 Ordre des barreaux francophones et germanophone e.a.