LONDON — The top court in the European Union has delivered another blow to governments seeking to keep tabs on citizens through controversial spying techniques.
The European Court of Justice (ECJ), the EU’s highest legal authority, ruled Tuesday that member states cannot collect mass mobile and internet data on citizens.
Forcing internet and phone operators to carry out the “general and indiscriminate transmission or retention of traffic data and location data” is against EU law, the court explained in its ruling.
“However, in situations where a member state is facing a serious threat to national security that proves to be genuine and present or foreseeable, that member state may derogate from the obligation to ensure the confidentiality of data relating to electronic communications,” it continues.
Even in these emergency scenarios, there are rules that must be adhered to.
“Such an interference with fundamental rights must be accompanied by effective safeguards and be reviewed by a court or by an independent administrative authority,” the court said.
The ruling, which has been eagerly anticipated by civil rights campaigners, is in response to several cases brought about by Privacy International and La Quadrature du Net.
The campaign groups argued that surveillance practices in the U.K., France and Belgium go too far and violate fundamental human rights. The groups specifically took issue with the U.K.’s Investigatory Powers Act, a 2015 French decree related to specialized intelligence services, and a Belgian law on collection and retention of communications data that was introduced in 2016.
“Today’s judgment reinforces the rule of law in the EU,” said Caroline Wilson Palow, legal director of Privacy International, in a statement. “In these turbulent times, it serves as a reminder that no government should be above the law. Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies.”
Palow added: “While the Police and intelligence agencies play a very important role in keeping us safe, they must do so in line with certain safeguards to prevent abuses of their very considerable power. They should focus on providing us with effective, targeted surveillance systems that protect both our security and our fundamental rights.”
Opinion from EU court advisor
The ruling comes after an advisor to the ECJ argued that the surveillance practices in the U.K, France and Belgium breached EU laws.
Advocate General Manuel Campos Sanchez-Bordona said in January that EU law prohibits governments from forcing private companies to engage in bulk indiscriminate surveillance.
He said it applies to all situations where governments force telecommunications companies to participate in mass surveillance programs.
The ECJ ruling is the latest in a string of cases trying to limit the powers of governments to keep tabs on citizens.
In July, the ECJ ruled that U.S. national security laws don’t protect EU citizens’ privacy.
The court restricted how U.S. firms could send European user data to the U.S. after concluding EU citizens had no effective way to challenge American government surveillance. U.S. agencies such as the NSA can theoretically ask internet companies like Facebook and Google to hand over data on an EU citizen and that EU citizen would be none-the-wiser.
The decision came after Austrian privacy activist Max Schrems filed a law suit in light of the Edward Snowden revelations arguing that U.S. law did not offer sufficient protection against surveillance by public authorities. Schrems raised the complaint against Facebook which, like many other firms, was transferring his and other user data to the U.S.