The Data Privacy/National Security Balancing Paradigm as Applied In The U.S.A. and Europe: Achieving an Acceptable Balance Paul Raphael Murray, B.A. H.Dip in Ed. LL.B. LL.M Ph.D. (NUI) Submitted for the Degree of Doctor in Philosophy at Trinity College, Dublin School of Law August 2017 Declaration and Online Access I declare that this thesis has not been submitted as an exercise for a degree at this or any other university and it is entirely my own work. I agree to deposit this thesis in the University’s open access institutional repository or allow the library to do so on my behalf, subject to Irish Copyright Legislation and Trinity College Library conditions of use and acknowledgement. Paul Raphael Murray Acknowledgements I would like to record my thanks to my Supervisor, Professor Neville Cox, School of Law, and Dean of Graduate Studies, Trinity College, Dublin, for his help and guidance. i ii Abstract The Data Privacy/National Security Balancing Paradigm as Applied In The U.S.A. and Europe: Achieving an Acceptable Balance Paul Raphael Murray The overall research question addressed in this thesis is the data privacy/national security balancing paradigm, and the contrasting ways in which this operates in Europe and the U.S. Within this framework, the influences causing the balance to shift in one direction or another are examined: for example, the terrorist attacks on two U.S. cities in 2001 and in various countries in Europe in the opening decade of the new millennium, and the revelations by Edward Snowden in 2013 of the details of U.S. mass surveillance practices. The thesis is divided into three main parts. The first part deals with European attitudes and practices in relation to the balancing paradigm. The second part deals with U.S. attitudes and practices on the same basis. It deals with the influence of the various branches of Government in determining this balance. In the third part, consideration is given to the contracts and similarities between the U.S. and Europe in relation to the balancing process, and in particular to the factors underlying the contrasts. The conclusion to the thesis gives details of the findings arrived at. iii iv Table of Contents Acknowledgements ....................................................................................................... i Abstract ....................................................................................................................... iii Summary ..................................................................................................................... ix Overall Introduction.................................................................................................... 1 Chapter One ................................................................................................................. 7 The Privacy/National Security Balance from a European Perspective .................. 7 Introduction ................................................................................................................ 7 Section I: The Council of Europe ............................................................................ 13 1.0 The Basis for the Data Privacy/National Security Balance .......................... 13 2.0 The Influence of the ECHR on National Legal Systems .............................. 14 3.0 The Jurisprudence of the ECtHR and the Data Privacy/National Security Balance ................................................................................................................. 27 4.0 Shortcomings in the Jurisprudence of the ECtHR - The Application of the Margin of Appreciation ........................................................................................ 43 Section II: The European Union .............................................................................. 67 1.0 The European Union and Human Rights Protection in the Context of the data privacy/national security balance ......................................................................... 73 2.0 The Growing Involvement of the EU in Human Rights Protection, particularly in data protection and the circumstances influencing this. ............... 77 3.0 Data Retention Directive 2006/24/EC and the Alteration of the Data Privacy/National Security Balance ....................................................................... 79 4.0 Features of Directive 2006/24/EC ................................................................ 81 5.0 Responses to Data Retention Directive 2006/24/EC .................................... 82 6.0 Institutional Responses to Directive 2006/24/EC......................................... 94 7.0 Judgment of the CJEU (Grand Chamber) on the Validity of Directive 2006/24/EC......................................................................................................... 103 8.0 The Ruling of the CJEU ............................................................................. 105 9.0 Significance of the Digital Rights Ireland and Seitlinger Judgment and its Context ............................................................................................................... 109 10.0 Consequences of the Digital Rights Ireland Judgment for Data Privacy/National Security in Europe .................................................................. 114 11.0 Judgments of the CJEU in the Google Spain and Schrems Cases .............. 122 12.0 Developments following the Invalidation of the Safe Harbour Agreement 131 13.0 Impact of the CJEU decisions in the Digital Rights Ireland, Google Spain, and Schrems cases on the data privacy/national security balance ...................... 135 14.0 The Alternative Data Privacy/National Security Balance: Circumventing v Data Privacy Protections in the EU: The Mass Surveillance of Personal Data by Spy Agencies in some EU Member States ..........................................................135 15.0 Two Parallel Systems of Surveillance .........................................................146 16.0 The Council of Europe Versus The European Union: Which Regime Provides Greater Protection For Data Privacy Rights? .......................................148 17.0 Contrasting the European and U.S. positions on the Balancing of Data Privacy Rights against National Security Interests .............................................153 18.0 Conclusion ...................................................................................................156 Chapter Two .............................................................................................................165 The Privacy/Security Balance in the U.S. pre-9/11 ................................................165 1.0 Introduction .................................................................................................165 2.0 U.S. Understandings of the Right to Privacy and Particularly Data Privacy .............................................................................................................................168 3.0 Major Interferences with data privacy for national security reasons pre-9/11 in the context of the data privacy/national security balance, with emphasis on the background and role of the NSA. ........................................................................179 4.0 Major Scandals Relating to Data Retention: Privacy Rights Illegally Infringed by the Executive and its Agencies .......................................................186 5.0 Church Committee Report and the Balance Between National Security and Personal Liberties Pre-9/11 .................................................................................191 6.0 Judicial Oversight of Surveillance in the name of National Security: Implications for the Data Privacy/National Security Balance. ............................194 7.0 FISA: Adjusting the Data Privacy/National Security Balance? Restricting the Interpretation of Personal Data in the Context of Intelligence Surveillance by the Executive Branch in the name of National Security ...........................................197 8.0 Balancing Rights which are Qualitatively Different: Philosophical Issues Underlying the Data Privacy/National Security Balancing Paradigm ................209 9.0 Two Data Privacy/National Security Balancing Systems Pre-9/11:The Influence of NSA Surveillance Activity. The Legal and the Actual Balances....220 10.0 Conclusion ...................................................................................................224 Chapter Three ...........................................................................................................229 The Privacy/Security Balance in the U.S. Post-9/11 ..............................................229 1.0 Introduction ...................................................................................................229 2.0 Background ...................................................................................................230 3.0 The Administration's Defence of Its Surveillance Policies and a Scholarly Response .............................................................................................................244 4.0 Ideological Context of the Patriot Act ...........................................................252 5.0 Provisions of the Patriot Act .........................................................................253 vi 6.0 Executive Dominance, Congressional Acquiescence and Marginalisation of Data Privacy Concerns ......................................................................................