The High Court has ruled that provisions of Ireland’s Communications (Retention of Data) Act 2011 requiring service providers to retain telephony data for two years were incompatible with EU law. It also found that the Act’s access regime breached EU law and the European Convention on Human Rights because access was not subject to prior review by a court or independent administrative authority and lacked adequate legislative safeguards against abuse.
Mr Justice Tony O’Connor delivered the judgment on 6 December 2018 in proceedings brought by Graham Dwyer against the Garda Commissioner, the Minister for Communications, Energy and Natural Resources, Ireland and the Attorney General. The court’s consideration was confined to mobile telephony data used to investigate serious offences. It did not address access for State security or saving human life, or the separate rules for internet data.
The court concluded that the Act’s requirement for all service providers to retain telephony data was “general and indiscriminate” under the Court of Justice of the European Union’s 2016 Tele2 ruling. It rejected the State defendants’ argument that the EU ruling should be read narrowly to permit general retention where the State considered targeted retention ineffective.
On access, the court found that the Garda Telecommunications Liaison Unit’s internal review and the Act’s oversight arrangements did not meet the required standard of independent prior review. The judge acknowledged the diligence of the senior Garda officer who handled the requests concerning the phone attributed to Dwyer, and said there was no evidence that access had been abused in this case. But the court held that individual care could not make up for the statutory safeguards missing from the regime.
The court did not find that the actual use of the retained data in Dwyer’s case was inappropriate, unnecessary or disproportionate. Nor did it decide whether that evidence should have been admitted at his trial. Dwyer was convicted of murdering Elaine O’Hara in 2015 and sentenced to life imprisonment. His appeal against the conviction, including a challenge to the admission of phone data, remained pending when this judgment was delivered.
The court declined to suspend the effect of its EU-law declarations, saying the State had been on notice of the legislation’s defects and that the consequences for criminal trials could be considered case by case. It did not rule on Dwyer’s constitutional challenge, finding that an EU-law remedy made that analysis unnecessary. The judgment set out proposed declarations and invited further submissions on their final wording and whether a separate declaration under the ECHR Act was needed. The final orders were therefore still to be settled.