The Gist: Too Urgent To Get Right
Ireland has been ploughing a lonely furrow, passing laws that probably don't comply with EU law. This is the Gist
You probably remember the push to jam an entire national survellance act through the Oireachtas in the last two weeks before Summer recess. (See previous Gist, National Surveillance, the Rush Job).
What you probabaly haven't heard since then is that the Government, who claimed that this law was so urgent it couldn't allow time for debates or amendments to be completed, haven't actually turned that Act on yet. It hasn't been 'commenced', which requires a further Ministerial Order.
Meaning we're still all living under the terms of the predecessor act, which the Government (and everyone else) acknowledges created an illegal mass surveillance database of the population. The replacement was too urgent to be scrutinised, and yet apprently not urgent enough to be actually used.
One of the issues the Government faces is that, in their rush to force the law through the legislature, they seem to have skipped the step at draft stage that would require it to be assessed by the EU Commission. This is the TRIS procedure.
If you thought ESB smart meters were wonky as a topic, wait until you get a load of this one.
A TRIS-kit,
Here's how it works.
If a member state (a country that is part of the EU) is going to bring in some new law or rules or technical regulations that might create a lumpiness in the smooth and seamless European Single Market then a draft of those rules should be sent to the EU Commission for their thoughts through the Technical Regulation Information System (TRIS) procedure. [1]
The Commission can make suggestions for changes, or can decide no changes are required. However, the EU really, really values the Single Market. It does not want, for example, France inventing new regulations that would give an advantage to French internet services ahead of Spanish internet services and slipping them through. To prevent that sort of shenannigans, it has a nuclear button if a country just fails to send the legislation through to them at all.
If you pass a regulation that ought to have been submitted to the TRIS, but wasn't, then your law is forefit.
This has been settled case law following a series of decisions by the CJEU[2], confirming the dire consequences of non-notification of a draft technical regulation, which failure, the court has found, “constitutes a substantial procedural defect, [and] renders a technical regulation adopted in breach of either of those articles inapplicable”[3]. (emphasis added)
Ireland does know about the need for these kinds of notifications, obviously. You can search for what has been notified to the EU Commission here. And, if you think you, as an interested party, have things to tell the Commission as a comment on the government's submission, you can send in thoughts. For example, here's the State's submission on the Online Safety and Media Regulation Bill, submitted in 2020.
But, if you take a look, you won't find any sign of any submission by Ireland through the TRIS process regarding this year's Data Retention law.
A Task-it
In July of this year, Dr. TJ McIntyre of Digital Rights Ireland [4] wrote to the EU Commission and told them that a 'technical provision', as per Article 1(f) of the 2015/1535 Directive that defined the TRIS process, had been passed as the Communications (Retention of Data) (Amendment) Act 2022.
The EU Commission wrote back saying that the Government had missed their chance to enter the TRIS process.
we would like to inform you that the procedure laid down by Article 5(1) of the Directive (EU) 2015/1535 (the ‘SMT Directive’) requires the notification of draft measures containing technical regulations within the meaning of that Directive and provides that the Commission and Member States may issue a reaction on the notified measures that are in a draft stage.
Considering that the measure was not notified to the Commission and is in fact not in a draft stage anymore, the Commission and the Member States are not in the position to issue any reaction in the framework of the aforementioned Directive.
The current national law is still the 2011 Data Retention act, which the Government accepts (and which the CJEU found) was in breach of EU law, every state entity, including the police, have a legal duty to apply the EU law directly.
Where a state body encounters a disagreement between a national law and an EU law, it is the duty of the state body to directly disapply the national law.[5]
We've lost our yellow basket.
Rumour has it that the Government is currently attempting to gesture towards an argument that they are OK because, maybe, if you squint at it and tilt your head to the side, it looks like the law might be exempt from TRIS.
This is what Sir Humphry Appleby would have described as a 'couragous' argument. And indeed, it is telling that even the Department of Justice doesn't feel like it can actually assert that TRIS doesn't apply. It's left limply saying they're still considering 'whether any further steps are necessary'.
Except, as the EU Commission has confirmed, if they missed their chance to board the TRIS-train, then that's it. The station is now boarded up.
One point the Department does want to stress is that it just had to hurry and pass the Act quickly. But the problem with this half-voiced excuse is that the TRIS procedure actually has a method for dealing with urgent cases, where the ususal 3 month delay can be skipped.
At heart, we have a continuation of the same line of administrative failure we have seen from the Department of Justice since the Digital Rights Ireland case made it clear that the EU Directive on data retention was invalid.
The Department has allowed critical laws, dealing with some of the most intrusive and sensitive surveillance powers, to float unsupported. This lets uncertainty grow as to whether they can or can't be relied upon in investigation and prosecution of serious crimes as well as continuing an unlawful mass surveillance system of nearly the whole adult population of the country.
Now, by its own admission, even the Department doesn't know what it's going to do next.
The department can confirm that, to date, a notification under the TRIS regime has not been made in respect of the Communications (Retention of Data) (Amendment) Act 2022.” They said the department is considering whether or not certain exclusions to TRIS may apply, and “whether any further steps are necessary”.
1. Article 5 of EU Directive 2015/1535 requires that "Member States shall immediately communicate to the Commission any draft technical regulation"
2. C-144/16 Municipio de Palmela, C-303/15 Naczelnik Urzędu Celnego I w Łodzi, C-98/14 Berlington, C-336/14 Sebat Ince, C-613/14 James Elliott Construction, Joined cases C-213/11, C-214/11, C-217/11 Fortuna Grand Forta, C-194/94 CIA Security, C-443/98 Unilever
3. Paragraph 50, Unilever C-443/98
4. My client.
5. The CJEU has most recently addressed this longstanding duty of all organs of the State in Case C-378/17 Minister for Justice and Equality, Commissioner of An Garda Síochána v Workplace Relations Commission. Yes, that's right, Ireland was trying to deny that too.
