Submit to Digest

DRIP Bill Expands UK’s Data Surveillance Power

Privacy Telecommunications
By Yixuan Long – Edited by Insue Kim HL Bill 37 – Data Retention and Investigatory Powers Bill (“DRIP”) Full text of DRIP The House of Lords passed the bill without a vote on July 17, 2014. The House of Commons passed the bill by 498 votes to 31 on July 15, 2014. On July 17, 2014, the Data Retention and Investigatory Powers Bill (“DRIP”) became law of the land after the House of Lords passed it without a vote. This legislation grants the government power to mandate all companies, both operating in the UK and abroad, to retain customer metadata for 12 months, so long as the companies provide telecommunications services to UK customers. DRIP also changes the Regulation of Investigatory Powers Act (“RIPA”) to expand the UK government’s ability to directly intercept phone calls and digital communications from any remote storage, including iCloud and Google Drive. Grounds for interception include national security and preventing or detecting serious crime. Prime Minister David Cameron introduced the bill on July 10, 2014 as an “emergency” law with an accelerated time frame. Parliament had a week to examine the bill, with a one-day debate in the House of Commons and two days in the House of Lords. According to the BBC, the purpose of the legislation is to replace legislation that became invalid when the Court of Justice of the European Union (CJEU) ruled in April that blanket data retention breaches the right to privacy. A summary of the bill and its history is available on the BBC and Human Rights Watch. NSA whistle-blower Edward Snowden compared DRIP to the ‘Protect America Act of 2007’ introduced by former-President George W. Bush. Wired UK summarizes academics’ criticism of the bill. David Allen Green warns citizens of the danger of passing DRIP. The Guardian describes the harm in a more sarcastic and memorable way. Prime Minister David Cameron justifies the fast-track procedure by claiming that the government is only responding to the CJEU’s ruling, which invalidated the UK’s data retention practice. He claims that if the government does not act immediately, people’s safety would be at risk, and that the bill only restores existing measures without introducing new powers. However, the CJEU has ruled that the existing measures, EU Directive 2006/24/EC, unlawfully interfere with the right to privacy and violate the protection of personal data under the WU Charter of Fundamental Rights. Many critics claim that DRIP does not heed the CJEU’s concerns and goes far beyond what is necessary. In addition, its fast-track procedure prevents a full debate on its scope. Yixuan Long is a 2L at Harvard Law School.