Epigenetic methods are state-of-the-art scientific methods that reveal features of genetic material (DNA), named epigenetic marks, which change in response to environmental factors, without affecting the genetic information carried by DNA. Epigenetic changes, however, affect gene activity, making genes more active or less active.
This paper reviews scientific evidence indicating that traumatic experiences are associated with changes in epigenetic marks and argues that, given that torture is an extremely traumatic event, it is likely to be associated with epigenetic changes as well. The article contends that it is worth testing whether epigenetic methods can be used to provide evidence consistent with torture because, if this potential were realised, it would contribute to preventing, documenting and prosecuting torture, and bringing justice and reparations to torture survivors. Perhaps it could even help to refine the definition of torture. The paper also discusses the importance of taking into account the limitations and ethical implications of epigenetic methods.
You can read the article in the Torture Journal (volume 30, issue 2, pp. 19-34), by clicking on this link.
On November 2 2020, London’s High Court handed down its hotly anticipated judgment in the high-profile libel case brought by Hollywood actor Johnny Depp over a newspaper article which labelled him a “wife-beater”. In his 585-paragraph ruling the presiding judge, Mr Justice Nicol, dismissed the actor’s claim, holding in essence that the words used in The Sun’s report were legally acceptable.
Depp brought a libel action against The Sun’s publisher (and the newspaper’s executive editor Dan Wootton) in respect of an 2018 article which was first published online under the headline: “GONE POTTY: How can JK Rowling be ‘genuinely happy’ casting wife beater Johnny Depp in the new Fantastic Beasts film?” The story asserted that Depp was violent towards his ex-wife Amber Heard during their relationship.
Depp’s case was that the article made seriously defamatory allegations which bore the meaning that he was guilty of serious domestic violence against his former wife. The defence maintained that the evidence showed the claimant “was violent towards Ms Heard on multiple occasions” during their relationship, and thus the “wife-beater” claim was justified. They relied on 14 alleged incidents of serious physical assault against Heard which had occurred between 2013 and 2016. However, Depp consistently denied the “reputation-destroying and career-ending” allegations.
The case was heard over the course of 16 days at London’s Royal Courts of Justice in July 2020. Importantly, neither Depp nor Heard was on trial. And this wasn’t a criminal trial either. In this libel dispute, there were two central issues: the meaning of the articles complained of; and whether the imputation conveyed by them (that the Hollywood actor engaged in unprovoked attacks and violent conduct against his ex-wife) was true in substance and fact. Mr Justice Nicol held that the meaning of the words complained of was as contended for by The Sun, namely that Depp was violent to Heard, “causing her to suffer significant injury and on occasion leading to her fearing for her life”.
The judge also expressly acknowledged that Depp proved the necessary elements of his cause of action, that his reputation had been damaged. But, under UK defamation law, if a defendant proves that the published words are “substantially true”, they will have a complete defence: they cannot be successfully sued regardless of the gravity of the allegations. In this case, the judge found that the great majority of alleged incidents of violent physical assault against his ex-wife were proved to be substantially true and dismissed Depp’s claim.
Was it all worth it?
Anyone following the case may have reasonably queried whether Depp’s action was ill-advised. Traumatic, intensely intimate and unflattering details of a tumultuous relationship apparently punctuated with blazing rows, a drug and alcohol-fuelled lifestyle and allegations of domestic abuse – strenuously denied – were uncovered in court and made front-page news worldwide.
A parade of witnesses, including A-list actors, strode into London’s High Court to support each side’s versions of events. The court heard details of a costly trail of destroyed property, a severed finger apparently caused by a thrown vodka bottle, profoundly acrimonious texts and “a large pile of faeces” left in a bed.
In addition to the revelation of unattractive details of his personal affairs, Depp had to shoulder a taxing evidential burden as a result of a recent Supreme Court ruling. The court’s decision in a 2019 defamation case involving two UK newspaper publishers established that the threshold test for “serious harm” in defamation actions has been significantly raised under the 2013 Defamation Act. This has made it more difficult for claimants to succeed in their actions.
Nevertheless, Depp must have considered that the trial was the lesser of two evils compared to unanswered reputational attacks of this magnitude. The conduct alleged was essentially criminal and highly defamatory, especially in the post-#MeToo landscape. The judge’s ruling suggests that the actor correctly assessed the potential reputational damage that the words “wife-beater” would cause to his future.
The heavy focus on Depp’s alleged criminal wrongdoing in The Sun’s article, the extent of its publication, the long-term effect of online libel and the undesired prospect of the actor’s removal from his role in a major film franchise provided a strong impetus for the claimant.
NGN took an equally bold, yet somewhat risky, decision. By relying on the defence of truth, the publisher was required to establish the essential truth of the “sting” of the libel. This means that it was not necessary for NGN to prove that every single aspect of the statement complained of was absolutely true, so long as, taken as a whole, it was accurate.
The standard of proof needed for a truth defence is that used in civil cases generally – the material must be proved true “on the balance of probabilities”. This is a lower bar to achieve than the usual criminal standard of being sure “beyond a reasonable doubt”.
Although one might think that NGN had a relatively easier task to achieve, it should not be forgotten that, when the truth defence is used, the burden rests on the publisher to prove that the allegations were true, rather than on the claimant (in this case, Depp) to show that they were false. This can give rise to further complications, as the success of a claim will regularly turn on the evidence in each individual case.
And when opposing accounts of what happened in private cannot be entirely ruled out, lawyers will struggle to persuade the court which version is more likely to be true. This is apparent in the position taken by Depp’s lawyers that “the claimant was not violent towards Ms Heard; it was she who was violent to him”.
Hence, media organisations may often be reluctant to defend libel actions and may opt for an out-of-court settlement to avoid the risk of high legal costs or damages. This was not the case with NGN, which nevertheless sought to prove true a very serious allegation. It succeeded, despite the challenges associated with this defence.
The case continues
The outcome was bitterly unfavourable to Depp, who arguably suffered a crushing defeat, with all that this might entail for his career. Moreover, his case has reportedly led to an estimated £5m in legal costs, and on top of that, he is likely to be made to cover a significant percentage of the winner’s legal costs.
The Sun, meanwhile, emerged victorious from a tense legal battle. The outcome may stiffen the resolve of the English press to report on matters of domestic violence, but it does not necessarily follow that the approach taken by the High Court in Depp’s trial is a uniform one in all cases.
The High Court’s decision doesn’t seem to spell the end of the legal battle. Depp’s representatives said they found the decision “as perverse as it is bewildering” and announced their intention to appeal. It will also be interesting to see whether the outcome in London can carry some weight and indirectly affect the libel rematch next May in the US against Heard herself over an opinion piece she wrote for Washington Post.
An Essex human rights expert has been awarded major funding to look at the impact of Artificial Intelligence-assisted decision-making on individual development and the functioning of democracy.
Dr Daragh Murray said: “Governments around the world are already using AI to help make important decisions that affect us all. This data-driven approach can offer key benefits, but it also relies on the ever-increasing collection of data on all aspects of our personal and public lives, representing both a step change in the information the state holds on us all, and a transformation in how that information is used.
“I want to look at the unintended consequences of this level of surveillance – the impact on how individuals develop their identity and how democratic society flourishes. Will a chilling effect emerge that changes individual behaviour? And what might the impact of this be? Will the knowledge that our activities are tracked and then translated into government decisions affect how we, for example, develop our sexual identity or our political opinions? Will we all be pushed towards the status quo in fear of the consequences of standing out?
“Ultimately what will the effect of this be on the well-being of our democracy?”
The Future Leaders Fellowships scheme is designed to establish the careers of world-class research and innovation leaders across the UK.
Dr Murray’s project will be interdisciplinary, working across human rights law, sociology and philosophy.
Dr Murray said: “We will be looking at lived experience in the context of wider discussions about how individuals and societies flourish. The intention is to re-imagine the human rights framework to address this very 21st century problem.”
The Fellows appoint mentors. In addition to Essex mentors Professor Lorna McGregor and Professor Pete Fussey, Dr Murray will benefit from the involvement of a stellar group of global experts: Professor Yuval Shany, from the Hebrew University of Jerusalem, is Vice-Chair of the United Nations Human Rights Committee, and Deputy President of the Israel Democracy Institute; Professor Ashley Deeks is a Research Professor of Law at University of Virginia Law School, Director of the School’s National Security Law Center and a member of the State Department’s Advisory Committee on International Law; Professor Alexa Koenig is Executive Director of University of California Berkeley’s Human Rights Center and sits on a number of national and international bodies looking at the impact of technology, as well as the board of advisors for ARCHER, a UC Berkeley-established non-profit that “leverages technology to make data-driven investigations accessible, smarter and more scalable.”
Launching the latest round of Future Leaders Fellowships, UK Research and Innovation Chief Executive, Professor Dame Ottoline Leyser, said: “Future Leaders Fellowships provide researchers and innovators with freedom and support to drive forward transformative new ideas and the opportunity to learn from peers right across the country.
“The fellows announced today illustrate how the UK continues to support and attract talented researchers and innovators across every discipline to our universities and businesses, with the potential to deliver change that can be felt across society and the economy.”
This story originally appeared on the University of Essex news webpage and is reproduced here with permission and thanks.
On 2 September 2020, the Information Commissioner’s Office (ICO), the United Kingdom’s independent body established to uphold information rights, formally issued its Age Appropriate Design Code of Practice which should be followed by online services to protect children’s privacy.
The Age Appropriate Design Code of Practice, the first of its kind, is a statutory code required under Section 123 of the Data Protection Act 2018 and aims to address the increasing “datafication” of children. The Code was first published on 12 August 2020 and, following completion of its parliamentary stages, it came into force on 2 September 2020. The Information Commissioner, Elizabeth Denham CBE, stated: “For all the benefits the digital economy can offer children, we are not currently creating a safe space for them to learn, explore and play. This statutory Code of Practice looks to change that, not by seeking to protect children from the digital world, but by protecting them within it.”
The Code’s primary focus is to set a benchmark for the appropriate protection of children’s personal data and provide default settings which ensure that children have the best possible access to online services whilst minimising data collection and use, by default. It sets out 15 standards on data collection and protection, and reflects a risk-based approach. Section 123(7) of the DPA 2018 defines “standards of age-appropriate design” as “such standards of age-appropriate design of such services as appear to the Commissioner to be desirable having regard to the best interests of children.” The 15 points of the Age Appropriate Design Code include a duty to conduct data protection impact assessments; transparency; policy and community standards; data sharing and minimisation; geolocation; parental controls; nudge techniques; and online tools, among others. For a brief overview of the standards laid out in the Code, see here. Due to the fact that different services will need to implement various technical solutions, the ICO acknowledges that these are not intended as technical standards, but as a bundle of technology-neutral design principles and practical privacy features.
These principles apply to any online products or services (including, for instance, educational websites, social media platforms, apps, online games, and connected toys with or without a screen) that process personal data and are likely to be used by children under 18 in the UK; therefore, they are not limited to services specifically aimed at children. The Code covers entities based in the UK as well as entities based outside of the UK if their services are provided to (or monitor) users based in the UK. Services provided on an indirect charging basis (for example, funded by advertising) also fall within its remit.
The ICO and the courts will take the Code into account in determining whether the GDPR and PECR requirements have been met for the purposes of enforcement action. Although the Code is now in effect, the industry has been given a 12-month implementation period to get up to speed and introduce suitable changes. After a year in force, the ICO will undertake a review of the Code and its effectiveness.
Dr. Antonio Coco, Lecturer in Law at the University of Essex, has co-drafted The Oxford Statement on International Law Protections Against Foreign Electoral Interference through Digital Means, which has been signed by 139 international lawyers so far.
The Statement is the third in a series — informally known as the “Oxford Process” — aiming to clarify the rules of international law applicable to cyber operations which threaten areas of pressing global concern.
The first Statement (May 2020) concerned the protection of the healthcare sector. The second Statement (July 2020) focused on the protection of vaccine research. The third and most recent one (October 2020) tackles foreign electoral interference, and can be read at EJIL:Talk!, Opinio Juris and JustSecurity.
CODE BLUE (29-30 October 2020) is an international conference where the world’s top information security specialists gather to give cutting edge talks, and is a place for all participants to exchange information and interact beyond borders and languages. As technology and society move forward and IoT (Internet of Things) is becoming a reality, security is increasingly becoming an urgent issue. The Internet world also needs to gather researchers to collaborate and think together about ways to respond to emergency situations, and come up with possible solutions. CODE BLUE aims to be a place where international connections and communities form and grow, and will contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans).
This year, Dr Audrey Guinchard (Senior Lecturer in Law, University of Essex) gave a keynote on ‘Reforming cybercrime legislations to support vulnerability research: the UK experience and beyond’.
Cybercrime legislations – or hacking laws- tend to be notoriously broad, resting on a set of assumptions about what ‘unauthorised access’ means, assumptions which hardly match those of the technical or ethical fields. The result is that the offences of unauthorised access and misuse of tools have the potential to criminalise most aspects of legitimate vulnerability research (discovery, proof of concept, disclosure). Independent security researchers are notably at risk of criminal prosecution as they work, by definition, without vendors’ prior authorisation.
The UK is a particular case in point, having drafted its original Computer Misuse Act 1990 in such a way that even switching a computer on can constitute unauthorised access. Further reforms in 2006 and 2015 have expanded even more the scope of the legislation by modifying or adding other offences as broad in scope as the original ones. While the UK is in that respect an outlier, the EU Directive 2013/40/EU on attacks against information systems as well as the Convention on cybercrime n.185 (which is de facto the international treaty) are not without their own weaknesses, despite serious and effective efforts to restrict the scope of criminal law and protect security researchers.
Prosecution guidelines or a memorandum of understanding between the security industry and prosecutorial authorities are a welcome step to avoid outlandish prosecution of security researchers, but I argue that they are not sufficient to protect them once a prosecution starts. Their motive (and the methods used) to improve security will not constitute a legal argument unless a public interest defence exists.
Hence, Audrey’s proposal to reform the cybercrime legislations (UK, EU and the Convention) by incorporating a public interest defence to cybercrime offences, in particular to the ‘hacking’ offence (unauthorised access). Momentum is certainly gathering in the UK. The Criminal Law Reform Now network (CLRNN) has now released a comprehensive study of the UK Computer Misuse Act with a series of recommendations. It is time to make cybercrime legislations fit for the 21st Century, to borrow the slogan of a significant part of the security industry in the UK endorsing the report and the reform.
To read some of Dr Guinchard’s research papers which formed the background of this research, please see here and here.
An Essex legal expert has been recognised in the Queen’s Birthday Honours for her work on internet safety.
Professor Lorna Woods, from our School of Law, has been working since 2017 with William Perrin of the Carnegie UK Trust to develop a workable solution to ‘online harms’, a term that covers a range of internet safety issues. Professor Woods and Mr Perrin are to both receive OBEs.
Professor Woods said: “I am delighted, if a little surprised, by this honour. I’d like to thank Will, of course, but also Maeve Welsh and everyone at the Carnegie UK Trust – without their support, we would not have been able to develop our approach further or undertake the vital, ongoing engagement with those working in this area.
“Recent events have raised new concerns about the role of social media. The need for a statutory duty of care, overseen by an independent regulator, is not going away. In fact, it is more urgent than ever. We look forward to publication of the promised Online Harms Bill, and its consideration in this parliament.”
In October 2017, Professor Woods and Mr Perrin sat down to review the just-published Green Paper on Internet Safety Strategy.
Near-daily stories of bullying, self-harm and extremism had created a febrile debate. The challenge? To reset the online world and reduce the risk of harm.
The pair agreed the government response was inadequate. Drawing on their experience of the sector, they consulted with a range of actors, researched models already in use and started to write.
Across seven co-authored blogs, completed between February and May 2018 (and subsequently collected into a report, with funding from The Carnegie UK Trust), they sought to shift the debate from ”publishing” and the removal of specific content, to harm prevention, developing a detailed plan involving a statutory duty of care, overseen by an independent regulator.
The duty of care approach re-casts social media as a series of “public or quasi-public spaces”. In creating these spaces, the providers’ goal must be not maximising profit, or engagement, but user safety. The more vulnerable an audience, the greater the responsibility.
At a time of significant public concern, their research has been a game-changer, offering a workable solution, inspiring a national newspaper campaign, rallying civil society groups and influencing lawmakers, at home and abroad.
In December 2019, they published their own draft Online Harm Reduction Bill, to maintain momentum. The draft bill was endorsed by organisations including the NSPCC, 5Rights Foundation, The Institute for Strategic Dialogue and the Royal Society of Public Health.
In January 2020, the authors and the Carnegie UK Trust also supported Lord McNally in the preparation of a short paving Bill to require Ofcom to prepare for the introduction of an Online Harms Reduction Regulator. The paving Bill was introduced into the Lords on 14 January 2020 and is currently awaiting a second reading.
Four Essex graduates have also been recognised in this year’s Queen’s Birthday Honours:
Dr Philip Orumwense (MA Political Behaviour, 1991) will receive a CBE for public service. Philip was Commercial Director of IT at Highways England and is recognisesd for his work across the public sector.
Sir David Attenborough (Honorary Graduate), has received a GCMC for his services to broadcasting and conservation.
Miss Carrie Anne Philbin (BA History, 2002) has received an MBE for services to education, championing diversity and inclusion in computing.
Ms Clare Woodman (BA Government & Sociology, 1989) has received a CBE for services to finance in her role as Head of EMEA and CEO of Morgan Stanley & Co. International PLC.
This story originally appeared on the University of Essex news webpage and is reproduced here with permission and thanks.
Lorna Woods, Professor of Internet Law, University of Essex
Background
This case concerns the collection of bulk communications data (BCD) from network operators by the security and intelligence agencies (SIAs). It formed part of an action brought by Privacy International challenging the SIAs’ acquisition, use, retention, disclosure, storage and deletion of bulk personal datasets (BPDs) and BCD which started in 2015 before the Investigatory Powers Tribunal (IPT). Privacy International’s claim is based on its understanding of the safeguards required by the Court of Justice in Tele2/Watson – a 2016 CJEU judgment on UK data retention law, discussed here.
In Tele2/Watson the Court of Justice held that any data retention obligation must be targeted and limited to what is strictly necessary in terms of the persons affected, the sorts of data retained and the length of retention. It also suggested that access to retained data should be subject to prior review by an independent body and that parties affected should be informed of the processing (unless this would compromise the investigations); and that the data should be retained within the EU. The authorities must take steps to protect against misuse of data and any unlawful access to them. Privacy International argued that the safeguards provided by British law are insufficient. The British government claimed that the SIAs’ activities fell outside the scope of EU law and that the rules were compliant with Article 8 ECHR. It argued that providing the safeguards as required by Tele2/Watson would undermine the ability of the SIAs. The IPT referred two questions – but only in relation to BCD not BPD – to the Court of Justice. This was the basis for the Court’s judgment handed down yesterday.
Questions in Issue
The two questions referred were:
whether the activities of the SIAs fall within the scope of EU law bearing in mind Art 4 TEU and Art 1(3) of Directive 2002/58 (ePrivacy Directive);
if the answer is that the situation falls within EU law, do any of the “Watson Requirements” (as above) (or any other requirements) apply?
The Court of Justice decided to deal with this case with two other cases that had been referred to it: Joined cases C-511/18 and C-512/18 La Quadrature du Net & Ors and Case C-520/18 Ordre des barreaux francophones et germanphone & Ors, which were also the subject of a separate judgment yesterday. The cases also dealt with the bulk collection of communications data but in addition the court in La Quadrature du Net also asked whether real-time measures for the collection of the traffic and location data of specified individuals, which, whilst affecting the rights and obligations of the providers of an electronic communications service, do not however require them to comply with a specific obligation to retain their data are permissible. It also asked whether the Charter required persons concerned by surveillance to be informed once such information is no longer liable to jeopardise the investigations being undertaken by the competent authorities, or may other existing procedural guarantees which ensure that there is a right to a remedy suffice? Ordre des barreaux francophones et germanphone & Ors raised the question of whether a general obligation might be justified to identify perpetrators of secual abuse of minors. If national law has not usfficiently guaranteed human rights may the effects of that law be temporarily retained in the interests of certainty and to achieve the objectives set down in the law.
The Advocate General handed down separate opinions on each of the cases (see here, here and here) but all on the same day (15 January 2020) to similar effect, that:
the e-privacy directive (and EU law in general) applies in this situation because of the required co-operation of private parties;
limitations on the obligation to guarantee the confidentiality of communications must be interpreted narrowly and with regard to the rights in the EU Charter on Fundamental Rights;
the case law in Tele2/Watson (summarised above) should be upheld: general and indiscriminate retention of traffic and location data of all subscribers is an interference with the fundamental rights enshrined in the Charter but real-time collection of traffic and location data of individuals suspected of being connected to a specific terrorist threat could be permissible provided it down not impose a requirement on communications service providers to retain additional data beyond that which is required for billing/marketing purposes; and that the use of such data for purposes less serious than the fight against terrorism and serious crime was incompatible with EU law.
Note that there are two more cases pending Case C-746/18 H.K. v Prokurator (Opinion handed down by AG Pitruzzella 21 Jan 2020) as well as references from Germany from 2019 and Ireland from 2020.
Summary of Judgment
Privacy International
In its Grand Chamber judgment, the Court confirmed that requirements on communications service providers to retain data fell within the scope of EU law and specifically the e-Privacy Directive. The Court argued that the exclusion in Article 1(3) e-Privacy Directive related to “activities of the State or of State authorities and are unrelated to fields in which individuals are active” (para 35, citing Case C-207/16 Ministerio Fiscal, discussed here, para 32), whereas Art 3 makes clear that it regulates the activities of communications service providers. As held in Ministerio Fiscal, the scope of that directive extends not only to a legislative measure that requires providers of electronic communications services to retain traffic data and location data, but also to a legislative measure requiring them to grant the competent national authorities access to that data.
The legislative measures, permissible as a derogation under Article 15, “necessarily involve the processing, by those providers, of the data and cannot, to the extent that they regulate the activities of those providers, be regarded as activities characteristic of States” (para 39). given the breadth of the meaning of ‘processing’ under the GDPR, the directions made under s 94 Telecommunications Act fall within the scope of the ePrivacy Directive. The Court re-affirmed (para 43) the approach of its Advocate General in this case (and in La Quadrature du Net) that ‘activities’ in the sense of Art 1(3) cannot be interpreted as covering legislative measures under the derogation provision; to hold otherwise would deprive article 15 of any effect (following reasoning in Tele2/Watson) and Article 4(2) TEU does not disturb that conclusion (despite the Court’s reasoning in the first PNR case (Cases C-317/04 and C-318/04, paras 56 to 59). For the e-Privacy Directive (by contrast to the former Data Protection Directive in issue in the PNR case), what is important is who does the processing; it is the communications providers. The Court took the opportunity to confirm that the GDPR should not be interpreted the same way as the Data Protection Directive but in parallel with the e-Privacy Directive.
As regards the second question, the Court re-stated the scope of s. 94 orders thus:
That data includes traffic data and location data, as well as information relating to the services used, pursuant to section 21(4) and (6) of the RIPA. That provision covers, inter alia, the data necessary to (i) identify the source and destination of a communication, (ii) determine the date, time, length and type of communication, (iii) identify the hardware used, and (iv) locate the terminal equipment and the communications. That data includes, inter alia, the name and address of the user, the telephone number of the person making the call and the number called by that person, the IP addresses of the source and addressee of the communication and the addresses of the websites visited.
Such a disclosure of data by transmission concerns all users of means of electronic communication, without its being specified whether that transmission must take place in real-time or subsequently. Once transmitted, that data is, according to the information set out in the request for a preliminary ruling, retained by the security and intelligence agencies and remains available to those agencies for the purposes of their activities, as with the other databases maintained by those agencies. In particular, the data thus acquired, which is subject to bulk automated processing and analysis, may be cross-checked with other databases containing different categories of bulk personal data or be disclosed outside those agencies and to third countries. Lastly, those operations do not require prior authorisation from a court or independent administrative authority and do not involve notifying the persons concerned in any way.
Paras 51-52
The Court stated that the purpose of the e-Privacy Directive was to protect users from threats to their privacy arising from new technologies. It ‘gave concrete expression to the rights enshrined in Articles 7 and 8 of the Charter’ (para 57) and the exceptions thereto under Article 15(1), ie necessary, appropriate and proportionate in the interests of purposes listed in Art 15(1): national security, defence and public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system. The exceptions cannot permit this exception to become the rule (citing Tele2/Watson, but also the ruling in La Quadrature du Net). Restrictions must also comply with the Charter. This is the same whether the legislation requires retention of the transmission of data to third parties (citing EU-Canada PNR Agreement, discussed here, paras 122-123). Drawing on Schrems II, discussed here, the Court held:
any limitation on the exercise of fundamental rights must be provided for by law implies that the legal basis which permits the interference with those rights must itself define the scope of the limitation on the exercise of the right concerned.
Para 65
It also re-iterated that derogations from the protection of personal data any restriction on confidentiality of communications and traffic data may apply only in so far as is strictly necessary and “by properly balancing the objective of general interest against the rights at issue’ (para 67). Proportionality also requires the legislation to lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, to protect effectively against the risk of abuse. The legislation must set down conditions for the application of the measures so as to restrict them to those ‘strictly necessary’; the legislation must be binding. Automated processing gives rise to greater risks. These considerations are the more pressing in the context of sensitive data.
The Court noted that the transmission of data to SIAs constituted a breach of confidentiality in a general and indiscriminate way and thus:
has the effect of making the exception to the obligation of principle to ensure the confidentiality of data the rule, whereas the system established by Directive 2002/58 requires that that exception remain an exception.
Para 69
it also constitutes an interference with Articles 7 and 8 of the Charter, no matter how the data are subsequently used. Re-iterating its approach in EU-Canada PNR Opinion, the Court stated that:
it does not matter whether the information in question relating to persons’ private lives is sensitive or whether the persons concerned have been inconvenienced in any way on account of that interference.
Para 70
Here, given the potential to create a personal profile of individuals the intrusions was particularly serious and “no less sensitive than the actual content of communications” (para 71). The court also emphasised the impact of the feeling of being under constant surveillance, following its reasoning in Digital Rights Ireland (discussed here) and Tele2/Watson. Such surveillance may have an impact on freedom of expression, especially where users are subject to professional secrecy rules or are whistleblowers. The Court also note that given the quantity of data in issue, their “mere retention” entails a risk of abuse and unlawful access (para 73).
The Court distinguished between ‘national security’ understood in the light of Article 4(2) TEU and ‘public security’ and matters within Article 15 ePrivacy Directive. While measures safeguarding national security must still comply with Art 52(1) of the Charter, given the seriousness of threats comprised in ‘national security’ in principle the objective of safeguarding national security is capable of justifying more intrusive measures that those would could be justified by other objectives (cross referring to its reasoning in La Quadrature du Net).
Even in relation to national security, the underlying national legislation must also lay down the substantive and procedural conditions governing use of the data and not just provide for access. National legislation must rely on objective criteria in order to define the circumstances and conditions under which the competent national authorities are to be granted access to the data at issue. Here, the national legislation requiring providers of electronic communications services to disclose traffic data and location data to the security and intelligence agencies by means of general and indiscriminate transmission exceeds the limits of what is strictly necessary and cannot be considered to be justified, within a democratic society even in the interests of protecting national security.
La Quadrature du Net/Ordre des barreaux francophones et germanophone
The Court’s approach to Article 15 and the sorts of activities in the service of which surveillance may be undertaken by contrast with Article 3(1) was, unsurprisingly, the same as can be seen in Privacy International, as was its approach to interpreting the directive – emphasising the confidentiality of communications as well as Articles 7 and 8 EU Charter. Again, the Court took the approach that the exception to communications confidentiality should not become the rule and that exceptions must be strictly necessary and proportionate to their objectives. Retention of communications data is a serious interference with fundamental rights – including freedom of expression. The retention of the data constitutes such an interference whether or not the data are sensitive or whether the user was inconvenienced.
In similar terms to Privacy International, the Court again came to the conclusion that the general and indiscriminate retention of data was impermissible under the Charter and Article 15. The Court also re-stated the limitations on derogating measures made under Art 15. The point of difference in this analysis is that the Court recognised the conflicting rights that might need to be reconciled – particularly with regard to crimes against minors and the State’s positive obligation to protect them. This does not mean that the limits as regards necessity and proportionality may be overlooked.
The Court then considered the meaning of national security – approaching the matter in the same terms as it did in Privacy International. This higher threshold meant that neither the directive nor the Charter precludes recourse to an order requiring providers of electronic communications services to retain, generally and indiscriminately, traffic data and location data. This however is only so when the Member State concerned is facing a sufficiently serious threat to national security (which includes matters more serious than those listed in Art 15), a threat that is genuine and actual or foreseeable. In such a case retention can only be for a period of time limited to that which is strictly necessary. If any such order is to be renewed it must be for a specified length of time. The retained data must be protected by strict safeguards against the risk of abuse. The decision must be subject to effective review by an independent body (court or administrative), whose decision is binding, in order to verify that such a situation exists and that the conditions and safeguards laid down are observed.
The Court observed that general and indiscriminate surveillance refers to that which covers virtually all the population. The Court recognised the duties of the State under positive obligations and the need to balance potentially conflicting rights. It then held that in situations such as those described at paras 135-6 of its judgment, that is those falling in Article 4(2) TEU, the e-Privacy Directive and the Charter do not preclude measures for targeted retention of traffic and location data. Such measures must be limited in time to what is strictly necessary, and focused on categories of persons identified on the basis of objective and non-discriminatory factors, or by using geographical criteria. It then relied on similar reasoning in relation to the fight against crime and the protection of public safety.
Similarly, IP addresses may be retained in a general and indiscriminate manner subject to a requirement of strict necessity. Further, the directive also does not preclude the retention of data beyond statutory data retention periods when strictly necessary to shed light on serious criminal offences or attacks on national security, when the offences or attacks have already been established, or if their existence may reasonably be suspected. Real-time data may also be used when it is limited to people in respect of whom there is a valid reason to suppose that they are involved in terrorist activities. Such use of data must be subject to prior review by an independent body to ensure that real-time collection is limited to what is strictly necessary. The Court notes that in urgent cases that the review should take place promptly (presumably rather than after the event).
Finally, a national court may not apply a provision of national law empowering it to limit the temporal effects of a declaration of illegality which declaration the national court must make in respect of national legislation due to incompatibility with the e-Privacy Directive, and evidence obtained illegally should not be relied on in court.
Comment
The common theme across the cases was the acceptability of the retention and analysis of communications data generally. The Court has re-iterated its general approach, unsurprisingly linking – as the Advocate General also did – between the Privacy International ruling and that in La Quadrature du Net. In its approach, the Court relied generously on its previous rulings, which demonstrates that there is quite a thick rope of cases, all to broadly the same effect. While the Court based its ruling on the ePrivacy directive (which is specific to communications and communications data), it also based its ruling more generally on Articles 7 and 8 of the Charter. It is noteworthy that the Court did not just refer to its case law on communications data but also to the Canada PNR opinion, underlining that there is a similar approach no matter the type of data in issue. The Court also relied on Schrems II, implicitly confirming aspects of its approach there and embedding that decision in its jurisprudence. The underlying concern in Schrems II was the same as here: that is, data collected by private actors are accessed by state actors. In sum, even in the interests of national security, general and indiscriminate surveillance does not satisfy the test of strict necessity and proportionality. While its general approach might be similar to what has gone before, there are still some points of interest and new ground covered.
The IPT seems to have been the only court amongst those making references that still has not accepted that the retention of data falls within the scope of the e-Privacy Directive, relying on the reasoning of the Court on the Data Protection Directive in relation to passenger name records in an early case. In addition to re-establishing the well-trodden principles regarding the impact of requiring electronic service providers to retain data bringing the entire scheme within scope of the e-Privacy Directive, and different functions of Article 1(3) (scope of directive) and Art 15 (derogation from directive), the Court took the opportunity to say something about the scope of the GDPR, the successor legislation to the Data Protection Directive. In effect, the Court has stopped the line of reasoning found in that early PNR judgment – it cannot be used to determine the scope of the GDPR which should be understood in line with Art 1(3) of the e-Privacy Directive.
The Court has emphasised a couple of aspects of the legal regime surrounding surveillance that are worth a second look. Firstly, while the Court says nothing about the form of law on which a surveillance may be based, in its analysis of Article 52(1) Charter it does say that the same law must contain the constraints. The principle then has wider application than just communications data. This raises questions about forms of surveillance rolled out by the police based on broad common law powers, or – as in the recent Bridges decision – in a mix of legislation, common law and code. These sorts of surveillance – although in public – may also give rise to a feeling of being subject to constant surveillance, though the Court’s jurisprudence on video-surveillance under the GDPR has not yet grappled with this issue. It may be, however, that the Court would take a different view on the extent to which ‘private life’ would be engaged in such circumstances. It is also worth noting that the views of the independent body must be binding on the SIAs; this reiterates the point that in principle approval must be sought in advance.
The Court also made clear that the rights in issue are not just privacy and data protection; it specifically referred here to freedom of expression and flagged the distinctive of those under professional duties of confidentiality (doctors, lawyers) and whistleblowers. It did not, however, consider whether any infringement was justified in this context. The list of possible rights affected is not limited to freedom of expression: in Schrems II the Court highlighted the right to a remedy. It is not inconceivable that the right to association could also be affected. Presumably the same points of analysis apply – that general and indiscriminate monitoring cannot be justified even in the interests of national security. The Court also recognised, in La Quadrature du Net, the positive obligations on the State in relation to Article 3 and 8 ECHR and the corresponding article in the Charter – Articles 4 and 7. The balancing of these positive obligations provided the framework for the Court’s analysis of types of surveillance that did not immediately fall foul of its prohibition of of general and indiscriminate data retention. In this context, it might almost be said that the Court is reformulating public interest objectives (such as national security or the fight against sexual abuse of children) as positive obligations and thus bringing them in a rights balancing framework.
The Court’s reasoning in both cases also gave us some insight into the meaning of national security. It is distinct from and covers more serious issues that the objectives listed in Art 15. While this in principle seems to allow more intrusive measures to be justified, it seems that the Court has limited the circumstances of when it can be used. It does not overlap seemingly with those grounds in Article 15 e Privacy Directive. So, even might be argued reading this part of the judgments that serious crime cannot be blurred with national security. The devil will be in the detail here, a tricky one for any independent body to patrol – and in terms of permitted surveillance it is not clear what the consequences in practice would be.
The headline news, however, must be the ruling of the Court relating to measures that do not fall within the prohibition as general and indiscriminate measures. This on one level is not totally novel; it is implied, for example, in Tele2/Watson, para 106. The questions relate to what level of generality of surveillance would be permissible, and in relation to what sort of objective? Para 137 seems to limit targeted retention of communications data to matters of national security (including terrorism), but the Court then wheels out the same reasoning in relation to serious crime and public safety, and seems to envisage similar safeguards in both cases. This then means that the test of ‘strict necessity’ is doing a lot of work in distinguishing between the legitimate and illegitimate use of surveillance measures. The Court has historically not been particularly strong on what it requires of a necessity test – let alone one requiring strict necessity – in other cases involving the interference with Charter rights.
The final point relates to the procedural questions. The Court was clear that striking down incompatible law cannot have suspended effect. Yet, that is precisely what the English court did in Watson when allowing the UK government several months to get its house in order. The Court of Justice also held here that illegally obtained evidence cannot be used in court, relying on the need to ensure that the rights granted by EU law are effective. While the status of EU law in the British courts may currently be uncertain on the face of it this might mean that convictions based on data between the handing down of Tele2/Watson, or at latest its application by the English courts, until the revision of the regime might be open to challenge whatever the domestic rules on evidence might say. Of course, even if we did not have to deal with the jurisprudential consequences of Brexit, the Court of Appeal, in its approach to Tele2/Watson ignored the aspects of the judgment directed at Tele2 referring court despite the fact that element of the judgment was an interpretation of EU law having general application, so it is to be assumed that still more would it ignore a ruling in a different case altogether.
This post first appeared on the EU Law Analysis blog and is reproduced here with permission and thanks.
Digitisation has enabled access to and availability of cultural heritage to an extent previously unknown and, in addition, it has enhanced preservation and modern research opportunities, e.g. through text mining and data analytics. The availability of and access to cultural materials in digital form can provide significant support to conservation, renovation, research, study and promotion of cultural assets and, in this regard, digital cultural heritage can serve as a resource for education, enjoyment or re-use, including use towards the development of new knowledge. The need for digital transformation has been revealed and become as relevant as ever as a result of the COVID-19 pandemic. Despite its benefits, the digitisation of cultural heritage challenges traditional legal norms, such as copyright law.
In their position paper, they recommend that digitisation should enable preservation of cultural artefacts, including world heritage properties, access to the public, and accessibility by people with special needs and educational institutions.
They also recommend that law and policy should offer further support to cultural institutions towards developing digitisation initiatives (e.g. the legislative framework on orphan works should be revisited in terms of its breadth and parameters of application).
They warn against the creation of digital monopolies (e.g. public domain material should remain in the public domain after digitisation) and urge for the development of legal provisions ensuring the security of computer infrastructure both to safeguard digital culture and avoid the spread of misinformation.
Click below to download a copy of the position paper:
Join us for this online workshop, which aims to bring together scholars to support the development of research.
The purpose of this workshop is to bring together scholars at an early stage in their careers to support the development of research on critical perspectives on global law and the environment. The workshop will be hosted by the School of Law and Human Rights Centre, University of Essex and held entirely online.
The workshop calls for papers that use innovative or (broadly) alternative approaches to the study of the relationship between global law and the environment.
This includes, but is not limited to, perspectives that examine:
North-South dimension of environmental issues, including from a TWAIL, and/or a critical race or post-colonial perspective;
critical perspectives on human rights and the environment;
uses of interdisciplinary methodologies to explore the role of law and the environment;
critical readings of the law in the Anthropocene/Capitlocene/Cthulecene;
relationship between law, environment and capitalism;
indigenous perspectives on the law and the environment;
critical international, transnational and domestic environmental law scholarship;
posthuman and new/neo materialist analyses of law and the environment;
queer theory, gender theory, intersectional theory and the relationship between law and the environment;
eco-centric and earth jurisprudence, including its limitations and critiques.
We warmly welcome papers that explore such questions from an interdisciplinary, theoretical, empirical, and practical perspective.
Applicants and papers from all disciplines are encouraged to apply.
Workshop Format
The workshop will be held via video conference over 2 days, with 8 to 10 papers selected. The workshop will bring together early career academics (up to 5 years post-PhD) and (late-stage) PhD researchers.
Each paper will receive comments and feedback from senior academic(s) as discussant(s), as well as other workshop participants who are expected to have read each other’s papers.
Invited participants will be expected to:
send a full paper (8,000 words) unpublished and not currently under consideration for publication, by 1 April 2021;
to read the papers of the other participants before the workshop and to engage actively in the discussion of the others’ papers.
The best papers presented at the workshop will be considered for a Symposium in the Asian Journal of International Law, subject to the journal’s review process and criteria of having a significant transnational or international component, in line with the journal’s focus.
Keynote Address
Professor Carmen G. Gonzalez, Morris I. Leibman, Professor of Law at Loyola University of Chicago, will deliver a keynote address on the topic of racial capitalism and global environmental law.
Carmen Gonzalez (BA, Yale University and JD, Harvard Law School) is a world-renowned expert in international environmental law, human rights and the environment, environmental justice, and food security.
Recent publications include International Environmental Law and the Global South (Cambridge University Press 2015) and Energy Justice: US and International Perspectives (Edward Elgar Publishing, 2018). She previously taught at Seattle University School of Law.
Submission of Abstracts
Abstracts of no longer than 500 words must be sent for consideration by 1 December 2020.
To submit an abstract, please write to Dr Birsha Ohdedar at b.ohdedar@essex.ac.uk with the subject heading ‘Early Careers Workshop 2021’. Along with your abstract, please include name, affiliation /institution, stage of career (number of years post-PhD, or PhD stage).
Successful applicants will be notified in early January 2021.
Essex Law Research Blog 