UK prime minister Theresa May’s Data Retention and Investigatory Powers Act (DRIPA) isn't necessarily incompatible with European fundamental rights, a senior advisor at Europe's top court said on Tuesday.

European Court of Justice (ECJ) advocate general Henrik Saugmandsgaard Øe has published his non-binding legal opinion on DRIPA arguing that “a general obligation to retain data imposed by a member state on providers of electronic communication services may be compatible with EU law.”

The case was brought by a cross-party alliance of British MPs—the now Brexit secretary of state David Davis and deputy Labour leader Tom Watson.

On Monday night, however, Davis withdrew his name from the case following his appointment to May's cabinet. The group is concerned that the far-reaching surveillance rights granted in DRIPA could undermine the European right to privacy.

DRIPA allows the home secretary—which had been May's job before she became PM on July 13—to require public telecommunications operators to retain, for up to a year, communications data to identify and locate the source and the destination of the information, data relating to the date, time, and duration of communication, and data identifying the type of communication and the type of equipment used. The content of communications is not included.

However, in 2014 the ECJ struck down the European Data Retention Directive in the Digital Rights Ireland case, concluding that blanket data retention was a breach of fundamental rights. In the court’s opinion, such data retention “constituted serious interference with the fundamental rights to respect for private life and to the protection of personal data, and was not strictly necessary for the purpose of the fight against serious crime.”

Davis, Watson, and others had successfully argued to the UK High Court in July 2015 that DRIPA was also incompatible with EU law on data retention powers. May appealed against it, however, arguing that in the Digital Rights Ireland case, the court had simply examined the Data Retention Directive and annulled it for its failings, and did not set standards to be respected by all legislation, including domestic law.

In his opinion today—which the court isn't obliged to heed, but typically does fall into line with—advocate general Saugmandsgaard Øe said that while DRIPA may be legal, “it is imperative that that obligation be circumscribed by strict safeguards,” however he said it was up to the national courts to decide whether those requirements are met.

Outlining those safeguards he said:

First, the general obligation to retain data and the accompanying guarantees must be laid down by legislative or regulatory measures [including] adequate protection against arbitrary interference. Secondly, the obligation must respect the essence of the right to respect for private life. Thirdly, the AG notes that any interference with fundamental rights should be in the pursuit of an objective in the general interest. He considers that solely the fight against serious crime is an objective in the general interest, whereas combating ordinary offences and the smooth conduct of proceedings other than criminal proceedings are not. Fourthly, the general obligation to retain data must be strictly necessary to the fight against serious crime, which means that no other measure or combination of measures could be as effective. Finally, the general obligation to retain data must be proportionate, which means that the serious risks engendered by that obligation within a democratic society must not be disproportionate to the advantages it offers in the fight against serious crime.

Just as DRIPA was rushed through UK parliament in 2014 by then home secretary May, the ECJ considered the current case important enough to put it on the fast-track “expedited” procedure.

The case was linked to a similar data retention case from Sweden. The day after the judgment in Digital Rights Ireland, Swedish telco Tele2 Sverige notified the country's officials of its decision to cease retaining the data and of its proposal to delete the subscriber information that had already been registered. Swedish law requires providers of electronic communication services to retain certain personal data of their subscribers, and it was referred to the ECJ. The AG’s opinion also pertains to that case.

Eduardo Ustaran, partner in Hogan Lovells legal firm, said: "I think it is important to appreciate the huge importance of this case for data protection in the UK post Brexit. The AG opinion will give us a glance of how the UK would fare if it seeks to be deemed adequate to receive data from the EU."

The final day of the House of Lords' committee stage on the Investigatory Powers Bill—which, among other things, seeks to replace DRIPA when it expires at the end of this year—will take place on Tuesday afternoon.