Two UK Broadband ISPs Trial New Internet Snooping System

Isn't this basically the US model though? And ...

> the tax burden would shift quite a bit.

Hasn't really happened for them (unless you're in the 1%, obvs.)

> Today 6 October 2020, the Court of Justice of the European Union (CJEU) delivered its verdict on four data retention cases in France, Belgium and the UK, in the context of these countries surveillance programmes. The European Court of Justice ruled that the surveillance laws of France, Belgium, and the United Kingdom fail to safeguard fundamental rights and freedoms. The CJEU rules that general and indiscriminate data retention is allowed under EU law when the State faces a “serious threat to national security” that is present or foreseeable, but only under the scrutiny of courts or independent administrative bodies and when this is done only temporarily. Finally, the CJEU specifies that national courts cannot use information obtained from bulk retention regimes against suspects in criminal proceedings.

> “Today’s judgement is a massive blow to existing laws in France, UK and Belgium and to other current data retention practices by Member States”, said Diego Naranjo, Head of Policy at European Digital Rights (EDRi). “With this judgement, the CJEU essentially rules that, States can only engage in general and indiscriminate data retention when they face a “serious threat to national security” that is present or foreseeable, when subject to a court or administrative body review. The CJEU has put a stop to current illegal practices and disregards practices that are not under a national court’s scrutiny in the name of national security or in the fight against “terrorism””, he added.

> Data retention practices entail the storage of traffic and location data (metadata) by telecommunications companies for an extended period of time in order to ensure the availability of such data for law enforcement purposes. As electronic communications technologies are increasingly used in the course of criminal activity, electronic communications data can play an important role in criminal investigations. Mandating the bulk retention of this data, however, poses serious risks to the right to privacy and communications freedoms.

https://edri.org/our-work/press-release-the-data-retention-r...

This was October 2020. The CJEU still held jurisdiction over the U.K court during the transition period after brexit (31 jan 2020 - 1 jan 2021) per the withdrawal agreement.

> The Court of Justice of the European Union continues to have jurisdiction over the United Kingdom during the transition period. This also applies to the interpretation and implementation of the Withdrawal Agreement.

https://ec.europa.eu/commission/presscorner/detail/en/qanda_...

The U.K. is free to do whatever with little to no recourse for U.K. citizens beyond appeal to their own Supreme Court to challenge the constitutionality of data retention / surveillance laws.

That said, the EU is not without it's own particular faults and shortcomings, but there are times when it does pay off to be able to challenge national legislation and policy making when it threatens human rights and freedoms such as they are purported to be upheld on the West-European continent.

As far as "governments" go, across the EU, the separation of powers is a thing. If data retention laws are enacted, that's a reflection of the prevailing winds / power balances between the legislative, executive and judicial bodies.

So for one thing, using the data collected for anything else or providing it to anyone else would be an immediate and severe breach of both data protection and security laws. That would have serious consequences for the ISP doing it.

For another, it would bring that monitoring system into disrepute and damage the credibility of a government that wants to be seen as strong on security. As a previous government learned to its cost when it tried to introduce personal ID cards here, even voters in the UK (who traditionally have a majority in favour of tough policing and security measures) still have lines they aren't willing to cross.

In short, while there is plenty of scope to debate whether a system like this is necessary or justified as a security measure, it's highly unlikely that it will also be turned into the kind of sell-all-your-data exercise that might be a concern in some other parts of the world.