By Heini Järvinen

The European Court of Justice published on on 8 April its verdict on the Data Retention Directive, ruling it invalid. The court’s decision follows years of strict enforcement by the Commission, which has gone so far as to seek financial penalties from a number of Member States that did not implement the measure on time. It is also worth considering, however, the impact of the Directive on other states and their citizens. The court ruling is likely to have a tangible impact elsewhere, particularly in candidate and “potential candidate” countries for EU membership, such as Kosovo. This is evident in an obscure Kosovan “Draft Law on Interception of Electronic Communication” that plans to enable dragnet data collection operations and enshrine murky legal boundaries for intelligence agencies’ activities.

The proposal in question would grant law enforcement agencies extensive powers of surveillance on the basis of “lawful authorisation”. Worryingly, the document states that “typically” “this refers to a court order or warrant issued by the competent court, and in certain cases the prosecution or the director of the Kosovo Intelligence Agency”. Problems with “competent courts” (let alone non-judicial safeguards) are well established. In the US, between 2010-2012 the NSA’s supposed oversight body FISA did not deny a single application and complained of being systematically misled. For the same reason, a UK Member of Parliament recently likened The Government Communications Headquarters’s (GCHQ) oversight mechanism to an episode of the satirical British comedy “Yes Prime Minister” in which a minister is manipulated into doing whatever his civil servants wanted – a tongue-in-cheek reference to the blanket approval of GCHQ’s proposals.

So it’s clear that a “competent court” doesn’t inspire much enthusiasm for meaningful oversight. What’s even more concerning is that the director of Kosovo’s intelligence agency appears to be granted extra-judicial authority in granting lawful authorisation for surveillance. The document defines “data” as “location data and other necessary data to identify the subscriber or user”. The intent to personally identify citizens through a process that does not even require judicial oversight should be a cause for alarm.

In terms of how this “lawful authorisation” can be used, the draft law would require network operators to, “without undue delay, make available to the Authorized Institution call-related data, such as … outgoing calls … incoming calls … [and] all signals emitted by the interception target”. It would give law enforcement agencies extensive powers to intercept telecommunications data of all forms. It also includes provisions for data retention established in Article 12.

What’s clear is that the impact of the Data Retention Directive has been to establish mass surveillance and the lack of due process as a precedent in the international sphere. Kosovo’s concern for European law stems from its application for accession to the European Union. For this reason, the Minister for European Integration Vlora Citaku responded to criticism of the draft law in a Tweet saying:

“the law was in Brussels for 6 months, council of Europe and EU commission made sure best EU practices are reflected.”

That is the legacy of the Data Retention Directive. As members of the European Parliament discuss taking the lead on digital rights, it is crucial that the Commission recognises the impact of its legislation on both Member States and their neighbours. We hope that, in keeping with what are now much better EU practices, the draft Kosovan legislation will be abandoned.

UPDATE: On 8 April the draft law was updated in response to the ECJ’s ruling. Minister Vlora Citaku has publicly stated that EU standards will apply, although the amendments to the draft law that would bring it into line with the ECJ ruling so far appear to be insufficient.

Draft Law on Interception of Electronic Communication
https://drive.google.com/folderview?id=0B2sSnMCRBnyKYWRiOEN1Umw0RzQ&usp=drive_web

Tweet referenced (03.04.2014)
https://twitter.com/vloracitaku/status/451688612523175936

New draft legislation proposed 8 April 2014
https://drive.google.com/file/d/0B2sSnMCRBnyKREE0X2tBbmVLOUl1cXZrRlNGTjBjSHBfVklZ

Minister Vlora Citaku’s Tweet addressing changes to legislation (08.04.2014)
https://twitter.com/ronsalaj/status/453612577244061696

(Contribution by Andrew Walsh – EDRi intern)