The Department of Justice says it will wait until a key European decision on the case of convicted murderer Graham Dwyer is made before fixing Ireland’s data retention law.
Last week, the Court of Justice of the European Union (CJEU) indicated to the Irish Supreme Court that any decision it makes with regard to the mobile phone data used in part to incriminate Dwyer in 2015 is likely to be in his favour.
The case has dragged up a persistent problem which has dogged the State, Ireland’s compliance with European data laws, into the limelight, with thousands of criminal convictions secured using Ireland’s 2011 data retention Act potentially set to be appealed as a result.
That Act was rendered invalid in 2014 following a prior judgement made by the CJEU, in a case taken by advocacy group Digital Rights Ireland, which ruled that Irish law surrounding the retention of phone records and other personal data amounted to mass State surveillance.
A further three rulings by the CJEU in the interim have affirmed that stance. However, the 2011 Act has never been amended, despite assurances from then Minister for Justice Charlie Flanagan to the Dáil in 2017 that an amended Bill would be published before the end of that year.
That same piece of legislation, the Communications (Data Retention and Disclosure) Bill, is “being drafted” at present, according to a spokesperson for the department, and will “take account of the outcome of the Supreme Court referral to the CJEU”.
“The judgement will inform the development and timing of the introduction of the general scheme of the communications Bill with a view to achieving the most effective and proportionate crime prevention and investigative regime possible for Ireland, having regard to the legal environment which is continuing to evolve,” they added.
Hearings in the case are now due to begin in January 2021, with a decision expected by March.
A senior legal source said a raft of appeals of criminal convictions secured under the 2011 Act is not likely before that Dwyer ruling. “However, when the dam breaks, you can expect a large range of appeals,” they added.
The Department of Justice said its new or updated Bill will “take account” of the CJEU ruling regarding both Digital Rights Ireland and the case of Tele2 versus Sverige (which saw a Swedish mobile phone company cease the retention of customer phone records on the back of the DRI judgement), along with “more recent findings”.
Those recent findings likely refer to the CJEU rulings in the cases of Privacy International and La Quadrature du Net, both of which upheld the principles upheld in the DRI judgement in 2014.
“The CJEU's consideration of the questions referred will assist in bringing clarity to an evolving area of jurisprudence,” the Department of Justice said, echoing the words of Mr Flanagan in 2017 who had said his proposed legislation would “take account of evolving ECJ jurisprudence in this area”.
However, the European court’s rulings since 2014 have all espoused the same principles and ruled Ireland’s data retention regime to be unlawful.
