Standards for Independent Oversight: The European Perspective

There are many ways to approach the question of government access to private-sector data. Much of the recent public debate has focused on access in the context of national security and traditional law enforcement, with respect to both targeted and untargeted access to data collected and processed by third parties. As more and more data is collected and stored by the private sector (“big data”), the amount of data that can be retrieved by governments is steadily increasing. A new “third domain” has emerged, where data is used for social security and tax surveillance and other types of non- traditional law enforcement. The Digital Rights Ireland case is the point of departure of this chapter. Next, two recent judgments by national courts are described, in which national data retention rules were tested against the ruling in the Digital Rights Ireland case and the necessity of independent oversight was discussed in further detail. This chapter draws from a recent study by the Institute for Information Law (IViR) to formulate standards for independent oversight. These standards are based on a broader analysis of the relevant jurisprudence of the European Court of Justice— including the Digital Rights Ireland case— and of the European Court of Human Rights (ECtHR). The analysis is also based on selected studies, reports, resolutions, and recommendations.