Murray report: Thin line between personal privacy and national security

State access to the heaving digital sea that is people’s personal data was at the centre of two legal inquiries yesterday.

While the High Court addressed the transnational movement of data held by Facebook from its European headquarters in Ireland to the US, Mr Justice John Murray was examining access by law enforcement bodies to the communication data of journalists and citizens here.

And both inquiries pivot around the European Union Court of Justice: The High Court is now seeking a preliminary ruling from it, while the same court has driven jurisprudence on communications data.

These include the case taken by Digital Rights Ireland, striking down the EU Data Retention Directive in 2014; and last December’s Tele2 ruling, which ruled against indiscriminate retention.

The dual inquiries highlight the state of flux regarding — and the search for a balance between — the legal protection afforded to people’s privacy and the requirements of the State to investigate serious crime and protect national security.

While people understand the seriousness of bugging a person’s phone or their home, accessing communications data, also known as their metadata, has not aroused as much concern.

It includes who you call/text, when you call/text and how long you speak for. It can build a picture of your movements throughout the day, every day. It covers the same kind of data for emails or social media and what websites you look at and how frequently.

The Irish Human Rights and Equality Commission (IHREC) put it thus: “When accessed and analysed, metadata can create a comprehensive profile of a person’s life — where they are at all times, with whom they talk and for how long, their interests, medical conditions, political and religious views and shopping habits.”

In his report, Murray said the metadata is a “vast store of private information [that] touches every aspect of an individual’s private and professional communications profile”.

He said 5bn text messages were sent in Ireland in 2016, there were 6m mobile phone subscriptions and 1.8m fixed line subscriptions.

The IHREC previously said that up to 8,000 data requests were made a year over a five-year period.

The changes proposed by Murray include judicial authorisation for all requests (High Court for journalists) and a resourced independent monitoring body for service providers.

While the Government’s proposed legislation adopts judicial authorisation, it does not mention a High Court judge for journalists, nor does the legislation refer to an independent monitoring body.

Murray also suggested a skilled tribunal body as an alternative to judges, but the bill does not provide for this possibility.

Other recommendations by Murray on journalists are also not in the proposed legislation — in fact the scheme does not mention journalists at all.

The inclusion in the bill of a ministerial power to order, on foot of applications from gardaí and others, the “retention” of a category or specified categories of data may be a consequence of the Tele2 ruling.

Murray mentions this and says Tele2 appears to accept that data retention that isn’t “wholly indiscriminate” would be compatible with European law.

It is not yet clear from the legislation how this discrimination, or specification of categories, will be done.