The Gist: Too Wrong To Fix

This is a continuation of our last exciting instalment "Too Urgent to Get Right" on the way the Irish Government rushed through a new mass surveillance law in the last week of the July Oireachtas term, skipping the bit where they needed to alert the EU Commission. Now, four days before Christmas, they've tried to submit the same law they refused to send into a process the EU Commission has already said they can't use any more.

The Story So Far

Back in the days of Saturday morning kids clubs serials in cinemas, this would be the follower-upper. So, a short recap is in order. You will have to imagine the booming voice for yourself.

When last our isolated heroes, the Department of Justice, were seen, they were dangling over a pit of their own construction. Below them- (legislative) Oblivion!

Can the great office of state escape this trap of their own devising?!!

Now find out!

With one leap our hero was... oh no.

You will recall that, having been asked about their failure to submit the new Communications (Retention of Data) (Amendment) Act 2022 to EU Commission for the TRIS procedure, the Department of Justice didn't appear to know what they were going to do next or what arguments they might make to justify doing it.

The department can confirm that, to date, a notification under the TRIS regime has not been made in respect of the Communications (Retention of Data) (Amendment) Act 2022.” They said the department is considering whether or not certain exclusions to TRIS may apply, and “whether any further steps are necessary”.

In subsequent media and industry briefings, I understand that they had settled on a particular line. They were telling anyone who asked about TRIS that they had the benefit of an exemption to the requirement to submit.

This was an implicit acceptance that TRIS would apply but for the working of this mighty exemption. Given the consequences for the law (being non-applicable from the start because that's how seriously the EU takes the TRIS and the Single Market it protects) all interested parties wanted to know what special exemption they were citing.

Problem: it’s not a specially exempted law.

But in an effort to try to fit the Ugly Stepsister’s legislation-foot into a glass slipper of exemption, the Department were briefing from mid-December that the Data Retention law is exempt because it is 'giving effect to a CJEU decision.'

This argument lasts exactly as long as it takes to say “Which CJEU decision requires EU member states to bring in a Data Retention regime?”

The Communication Corncobs (Not Owned) Act

Now, on the day the Irish Courts closed, the Department has tried a last, desperate move to save their fatally-flawed legislation.

They've submitted it to the EU Commission- the thing they said they were certain didn't need to be done- through the TRIS procedure. Here, take a look at it. It comes with a Big Notice at the front. The Notice says

Communications (Retention of Data) (Amendment) Act 2022 ("the 2022 Act") The 2022 Act has been approved by the Irish parliament (Oireachtas) but has not been legally implemented via Ministerial order.  Therefore the legislation is not, as of yet, in operation in Ireland. Further details are provided below.

This is the Department trying to come up with a way to argue it isn't too late to do this. Gordon's Alive!, they want Brian Blessed to bellow.

Except the EU Commission has already confirmed, in a letter to Digital Rights Ireland's Chairman Dr. TJ McIntyre, that they'll be having none of that.

we would like to inform you that the procedure laid down by Article 5(1) of the Directive (EU) 2015/1535 (the ‘SMT Directive’) requires the notification of draft measures containing technical regulations within the meaning of that Directive and provides that the Commission and Member States may issue a reaction on the notified measures that are in a draft stage.

Considering that the measure was not notified to the Commission and is in fact not in a draft stage anymore, the Commission and the Member States are not in the position to issue any reaction in the framework of the aforementioned Directive. (emphasis added)

You can't claim your law is only a draft if the President has already signed it and it's become an Act. Imagine the chaos across the EU if the Commission let that stand as the criteria.

And how does Ireland explain why it is sending in a law that's already passed its TRIS-by date?

Accordingly, the position of Ireland is that the 2022 Act is exempt from the notification requirements under the Technical Records Information System (TRIS) under Article 7(1)(e) of Directive 2015/1535. This states that the notification requirements of the Directive do not apply to technical regulations which "restrict themselves to implementing a judgment of the Court of Justice of the European Union".

Notwithstanding Ireland's clear legal position in this regard, Ireland is making a TRIS notification in respect of the 2022 Act on a strictly precautionary and without prejudice basis.

Ouch. I guess the first argument hasn't been as persuasive as they might have hoped.

Submitting the TRIS application revealed one more home truth. The Department didn't claim there was any particular urgency in its consideration. They've accepted a three month standstill on implementing the law.

Which rather undermines the rationale for pushing it through the Oireachtas in the teeth of warnings from experts, opposition and civil society in one week last July.

Maybe our heroes should look before they leap.

Hi there! Thanks for sticking with me through this year's Gisting. I'll be doing some festive ones over the interregnum between Christmas and New Year. But I want to say thanks to you all for your interest in the sometimes-niche thoughts that fill my head and for the nice emails and comments during the year. I've a new daily home as @Tupp_ed@mastodon.ie if you'd like to join me there.

Have a great break everyone and mind yourselves.