On 25 May 2021, the European Court of Human Rights (ECtHR) announced a judgment that the United Kingdom’s bulk surveillance powers breached human rights law and that the UK’s Government Communication Headquarters (GCHQ) intercepted the public’s communications unlawfully for decades.

CONTEXT OF CASE

This landmark ruling was brought about by an appeal from parts of a 2018 ruling, which found aspects of the UK’s bulk interception regime under the Regulation of Investigatory Powers Act 2000 (RIPA) unlawful. The lengthy legal battle leading to the May 25th judgment dates back to the 2013 Snowden revelations and was led by a coalition of non-governmental organisations (NGOs), including Big Brother Watch, Liberty, Amnesty International, Privacy International, and other local, regional, and international organisations.

Mass surveillance gives the government control over our data—control that most of us cannot question and are unaware of. This data can include information we consider personal, private, and protected, such as our political views and sexual orientation. This may, and did, as the Court found, breach our human rights and fundamentally is antithetical to a democratic society.

COURT FINDINGS

The Bulk Interception of Communications: Violation of Article 8, Right to Privacy

Two areas of concern were identified by the court in the recent ruling: the lack of oversight and the lack of any real safeguards. The applicants (the NGOs) argued that the bulk interception was neither necessary nor proportionate as required by human rights law. There was substantial interference with privacy in obtaining communications and safeguards were inadequate, including the lack of independent authorisation, failure to define content or purposes of communications to be examined, and ineffectiveness of applicable safeguards due to lack of resources and remedies. The government (the respondent) argued that the regime was necessary for national security reasons. “Selectors,” the government argued, were carefully controlled and records were kept, but the government provided no clarification on the aspects of the scheme that the Chamber found not to have provided adequate safeguards against abuse.

The Court found that “even the mere storing of data relating to the private life of an individual amounts to an interference within the meaning of Article 8,” and therefore safeguards are needed even more so as data is further processed and examined. Interference with article 8 is justified if it is in accordance with the law, pursues a legitimate aim (e.g., national security and investigation of crime, as argued), and is necessary and proportionate to achieve that aim. The Court found that to be necessary and proportionate, there must be “end-to-end safeguards,” i.e., an assessment at each stage of the process.

Under RIPA, the secretary of state alone had the power to issue a warrant for interception with “no possibility for their necessity and proportionality to be assessed at [this] stage”. The Court, however, held that before intercepting, the government should first obtain judicial authorisation and notify it of the selectors and reasons for interception. RIPA “lacked one of the fundamental safeguards; namely, that bulk interception should be subject to independent oversight at the outset”. The Court found that the procedures to be followed for selecting, examining, and using intercept material were deficient, with selectors set out in insufficiently precise terms.

The Court conclusively identified “the following fundamental deficiencies in the regime: the absence of independent authorisation, the failure to include the categories of selectors in the application for a warrant, and the failure to subject selectors linked to an individual to prior internal authorisation”. There were not adequate safeguards.

Bulk Interception of Communication: Violation of Article 10, Freedom of Expression

The scope of article 10 of the European Convention on Human Rights (ECHR) was in question to the extent it concerned privileged communications of journalists. This article protects the freedom of expression and access to information—once again, only limitable as provided by law and necessary and proportionate to a legitimate aim in the public interest. The applicants argued that large scale surveillance has “a chilling effect on freedom of communication for journalists” because the regime could identify personal information of journalistic sources without ex ante authorisation. The government countered that there was no case law authority for this proposition. The ECtHR, however, with this judgment arguably set that very precedent.

Under the RIPA regime, such material was a “bycatch” and could not be authorised beforehand. Nevertheless, the significant risk of capturing and examining journalist communications leading to the identification of their sources requires “robust safeguards regarding the storage, examination, use, onward transmission and destruction of such confidential material”. Further, when it became known to be such material, it ought to be “authorised by a judge or other independent and impartial decision-making body”.

The Court held that while there were additional safeguards specific to journalistic material, these lacked the same elements as found in the Court’s article 8 analysis. Namely, there was no requirement that a judge authorise the use of selectors or the selection for examination of such confidential material. “On the contrary, where the intention was to access confidential journalistic material, or that was highly probable in view of the use of selectors connected to a journalist, all that was required was that the reasons for doing so, and the necessity and proportionality of doing so, be documented clearly,” and “[only] particular consideration [had to] be given to any interception.”

Receipt of Intelligence from Foreign Intelligence Services: No Violation

The Court found there to be clear and detailed rules governing the sharing of intelligence with foreign counterpart agencies with sufficient guarantees and adequate safeguards, including the oversight of the Interception of Communications (IC) Commissioner and possibility for review by the Investigatory Powers Tribunal (IPT).

Judges Lemmens, Vehabović, and Bonšjak dissented on this judgment—both concerning article 8 and article 10—stating that new developments in technology lead to more significant infringements of our rights, which the Court ought to have given greater weight to. Further, the Court should have set clear minimum standards for bulk interception schemes, rather than merely requiring a well-defined domestic legal framework. The dissenting judges argued that internal authorisation is not satisfactory to prevent abuse. The Court “missed an excellent opportunity to fully uphold the importance of private life and correspondence when faced with interference in the form of mass surveillance”.

Acquisition of Communications Data from Communications Service Providers: Violation of Articles 8 and 10

UK law required that any regime permitting the authorities to access data retained by communications service providers (CSPs) should limit access to the purpose of combating “serious crime” and be subject to prior review by a court or independent administrative body. Further, in cases concerning journalistic communications, there should be special provisions. These safeguards were not present and, therefore, the regime was not in accordance with the law.

EFFECTS OF JUDGMENT

The Court held that the scheme lacked the necessary safeguards protecting it from abuse and even less oversight to prevent this. Confidential journalistic material was not adequately protected—a vital safeguard to protect both the profession of journalism and reporting and to protect sources and whistleblowers from reprisal. Further, the ECtHR held that the government’s method of obtaining the communications, including from private companies, breached our rights to privacy and our freedom of expression (articles 8 and 10 of the ECHR, respectively). As neatly put by Ilia Siatitsa, acting Legal Director at Privacy International:

“The Court reiterated that intelligence agencies cannot act on their own, in secret and in the absence of authorisation and supervision by independent authorities. They must be accountable because their capabilities to access personal data about each and every one of us—even if we’re not suspected of any wrongdoing—pose serious risks in a democratic society.”

In the partly concurring and partly dissenting opinion of Judge Pinto De Albuquerque, among the other partly dissenting opinions, there are strong hints of a more progressive outlook with stronger rights’ protection regarding mass surveillance and bulk intelligence sharing:

“The Court’s standards today should be more exacting than those of [earlier cases in] 2006 or 2008. This is exactly the opposite of what this judgment has delivered. In the present judgment the Court has succumbed to the fait accompli of general bulk interception, dangerously accepting that if it is useful it should be permissible. Usefulness is not the same thing as necessity and proportionality in a democratic society.”

The UK surveillance regime, which the Court ruled on, was replaced in 2016 by the Investigatory Powers Act (IPA, also well known as the “Snoopers’ Charter”), which further expanded the very mass surveillance powers found to have been unlawful. The NGO Liberty brought another case against the government regarding this Act which may, following this appeal, continue and now has hope of success.

Maria is an LLM Human Rights graduate from Central European University in Budapest, Hungary. She is a volunteer for multiple human rights-focused organisations, a locum support worker and an aspiring barrister.

LinkedIn