K.U. v. Finland: No Data Retention Obligation
December 15th, 2008The European Court of Human Rights has issued its judgment in the case K.U. v. Finland. The Court concludes that Article 8 of the Convention puts member states under a positive obligation to protect people against grave interferences with their private life by others on the Internet. This obligation includes that the member state has to criminalize grave interferences with the right to private life and provide for a legal framework that allows for the identification and effective prosecution of offenders.
The Court mentions that this framework has to respect the right to freedom of expression and private life of internet users. The Court does not say that the member state has to make sure that data to identify individuals are available. In fact, it says that only on occasion the right to private life and freedom of expression of internet users can be interfered with legitimately. The Court makes very clear that if identifying data of an alleged offender (the offense being a grave interference with the right to private life) are available, the law must provide for access to those data to allow effective prosecution. Here a few of the key conclusions and considerations:
The Court concludes that grave interferences with the right to private life must be criminalized:
While the choice of the means to secure compliance with Article 8 in the sphere of protection against acts of individuals is, in principle, within the State’s margin of appreciation, effective deterrence against grave acts, where fundamental values and essential aspects of private life are at stake, requires efficient criminal-law provisions
The State’s positive obligation under Article 8 ECHR to prosecute grave interferences with Article 8 ECHR may extend to questions of criminal procedural law:
the State’s positive obligations under Article 8 to safeguard the individual’s physical or moral integrity may extend to questions relating to the effectiveness of a criminal investigation even where the criminal liability of agents of the State is not at issue.
The Court concludes that Article 8 implies that there needs to be a way to identify offenders and bring them to justice:
It is plain that both the public interest and the protection of the interests of victims of crimes committed against their physical or psychological well-being require the availability of a remedy enabling the actual offender to be identified and brought to justice, in the instant case the person who placed the advertisement in the applicant’s name, and the victim to obtain financial reparation from him.
Obviously, this need runs into other fundamental rights of internet users. In the following excerpt, the court notes that also offenders (I would say alleged offenders) can rely on the guarantees of the Convention, in particular the right to respect for private life and the right of freedom of expression:
Another relevant consideration is the need to ensure that powers to control, prevent and investigate crime are exercised in a manner which fully respects the due process and other guarantees which legitimately place restraints on crime investigation and bringing offenders to justice, including the guarantees contained in Articles 8 and 10 of the Convention, guarantees which offenders themselves can rely on.
The Court makes clear that the prevention of crime and disorder and the protection of the rights and freedom of others makes this consideration relative:
Although freedom of expression and confidentiality of communications are primary considerations and users of telecommunications and Internet services must have a guarantee that their own privacy and freedom of expression will be respected, such guarantee cannot be absolute and must yield on occasion to other legitimate imperatives, such as the prevention of disorder or crime or the protection of the rights and freedoms of others.
From the perspective of data retention, the words to note here are “on occasion”. That could reasonably be interpreted as standing in the way of blanket data retention of Internet traffic and location data.
As TJ McIntyre concludes, the judgment raises a lot of very difficult questions. The Court concludes it is primarily up to the member states to resolve them:
Without prejudice to the question whether the conduct of the person who placed the offending advertisement on the Internet can attract the protection of Articles 8 and 10, having regard to its reprehensible nature, it is nonetheless the task of the legislator to provide the framework for reconciling the various claims which compete for protection in this context.