On Wednesday 21 December 2016 the Court of Justice of the European Union ruled that it would be unlawful for a member state to enact laws that “provide for general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication”, even to fight serious crime (Tele2 Sverige and Watson, C-203/15 and C-698/15). Data retention as a preventive measure, the court said, must be targeted, with a specific reason, and access to the retained data must be controlled by a court or an independent body. The case had been brought by, among others, Tom Watson MP against the United Kingdom’s earlier retention law, and it landed three weeks after Parliament had passed the Investigatory Powers Act 2016.
The Act authorised the intelligence agencies and the police to require telecoms companies to retain communications data, to disclose it, to intercept communications and to assist with equipment interference, in addition to the agencies’ existing power to obtain personal datasets in bulk under warrants issued by ministers. It was intended to regulate and to limit the agencies’ powers and to bring them under closer parliamentary scrutiny. My view at the time, which I hold still, was that our safety is not in the hands of European judges, that the agencies would carry on obtaining data one way or another, and that the sensible course was to let them do their job and to have Parliament keep them under control. After all, Facebook, Google, Twitter and Yahoo’s snooping is lawful just because we clicked “yes” to terms and conditions that most of us never read. The security services have no app and no small print, but at least their snooping is done to keep us safe.
What happened next
The ruling did not render the Act unlawful, as I suggested it might, but it did force a change. In April 2018 the Divisional Court, in a challenge brought by Liberty, held that Part 4 of the Act was inconsistent with the Watson judgment in two respects, because it allowed communications data to be retained and accessed for crime that was not serious and without independent authorisation, and gave the Government until November 2018 to fix it (Liberty v Home Secretary [2018] EWHC 975 (Admin)). The court rejected Liberty’s central argument that the Act allowed general and indiscriminate retention. Parliament responded with the Data Retention and Acquisition Regulations 2018, which restricted retention and acquisition to serious crime and other listed purposes and created the Office for Communications Data Authorisations to approve requests independently of the police. Since the United Kingdom left the European Union the Watson judgment no longer binds the courts here, and the Investigatory Powers (Amendment) Act 2024 has widened the agencies’ powers again, particularly over bulk datasets. The settlement I argued for in 2016, the agencies doing their job under Parliament’s control and with judges checking the warrants, is broadly the one we have; whether Parliament’s control is real is another matter, and one I return to in Thirty-four arrests a day.
First published 22 December 2016. Reviewed and updated 28 September 2026.