UK Surveillance Regime Violates Human Rights to Privacy and Free Speech, European Court of Human Rights holds

Big Brother Watch and Others v The United Kingdom (Applications nos. 58170/13, 62322/14 and 24960/15) (13 September 2018)

Summary

The European Court of Human Rights has found that the UK's bulk interception regime violates Article 8 of the European Convention on Human Rights (right to respect private and family life)because of insufficient safeguards governing the selection of intercepted communications and related communications data. Further, the Courtheld that the regime for obtaining data from communications providers violated Article 8 of the Convention because it was not in accordance with EU law that requires data interference to combat "serious crime" (not just "crime"), and for access to retained data to be subject to prior judicial or administrative review. Finally, the Court found that the bulk interception regime and the regime for obtaining communications data from communications service providers violated Article 10 (right to freedom of expression) because of insufficient safeguards for confidential journalistic material. 

Facts 

This case followed revelations by Edward Snowden, a former US National Security Agency (NSA) contractor, about the existence of surveillance and intelligence sharing programmes run by the intelligence services of the United States and the United Kingdom. Three applications (nos. 58170/13, 62322/14 and 24960/15) were lodged by 16 journalists and rights organisations against the United Kingdom of Great Britain and Northern Ireland under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (the Convention). 

The applicants complained about the scope and magnitude of three different UK surveillance regimes: (1) the regime under section 8(4) of the Regulation of Investigatory Powers Act(RIPA) (bulk interception of communications); (2) intelligence sharing with foreign governments; and (3) the obtaining of communications data from communications providers (the Chapter II Regime). In particular, the applicants believed that the nature of their activities meant that their electronic communications and/or data were likely to have been intercepted or obtained by the UK intelligence services. 

The Decision 

Violation of Article 35 of the Convention (Admissibility Criteria)

The Court first decided whether the first and second applicants had exhausted domestic remedies pursuant to Article 35(1) of the Convention, as they had not brought their complaints before the Investigatory Powers Tribunal (IPT). The Court found that Article 35(1) was satisfied on the basis that at the time the applicants introduced their applications, they could not be faulted for relying on Kennedy v the United Kingdom, no. 26839/05, 18 May 2010 as authority for the proposition that the IPT was not an effective remedy for a complaint about the general Convention compliance of a surveillance regime. 

Violation of Article 8 of the Convention (Right to Respect Private and Family Life)

The Court first addressed the bulk interception of communications under section 8(4) of the RIPA. Citing Weber and Saravia v Germany (Application no. 54934/00), the Court reaffirmed the 'six minimum requirements' of surveillance schemes, that they identify by law the nature of offences which may give rise to an interception order; a definition of the categories of people liable to have their communications intercepted; a limit on the duration of interception; the procedure to be followed for examining, using and storing data obtained; the precautions taken when communicating the data to other parties; and the circumstances in which intercepted data may be erased.

The Court found that while the interception regime was not in itself unlawful, the regime lacked oversight of the entire selection process of intercepted communications and any real safeguards against abuse of the selection of related communications data for examination. In view of the nature and extent of these shortcomings, the Court held that section 8(4) of the RIPA violated Article 8 because it did not meet the "quality of law" requirement, and went beyond interference that was "necessary in a democratic society." 

The Court went on to find that the UK's receipt of material intercepted by the NSA under PRISM and Upstream, and foreign intelligence services generally, had not breached Article 8 of the Convention. The Court found that the domestic law, together with clarifications brought by the amendment of the Interception of Communication Code of Practice, indicated with sufficient clarity the procedure for requesting the interception or conveyance of interceptedmaterial from foreign intelligence agencies. In particular, it found that the high threshold recommended by the Venice Commission was satisfied, namely that the material transferred should only be able to be searched if all material requirements of a national search from UK security services were fulfilled. 

Lastly, the Court considered whether Chapter II of RIPA violated Article 8 for allowing a wide range of public bodies to request access to communications data from communications companies in ill-defined circumstances. The Court found that the Chapter II regime did violate Article 8 because it was incompatible with EU law that required data interference to combat "serious crime" (not just "crime"), and for access to retained data to be subject to prior judicial or administrative review. 

Alleged Violation of Article 10 of the Convention (Freedom of Expression)

The applicants in the third of the joined cases complained under Article 10 of the Convention about the section 8(4) regime and the intelligence sharing regime, arguing that the protection afforded by Article 10 was of critical importance to them as NGOs involved in matters of public interest, who were exercising a role of public watchdog of similar importance to that of the press. The applicants in the second of the joined cases, being a journalist and newsgathering organisation, complained under Article 10 of the Convention about both the section 8(4) regime and the Chapter II regime.

The Court found that the section 8(4) regime violated Article 10 because there were no requirements circumscribing the intelligence services’ power to search for confidential journalistic or other material (for example, by using a journalist’s email address as a selector), or requiring analysts, in selecting material for examination, to give any particular consideration to whether such material is or may be involved. It appeared that analysts could search and examine without restriction both the content and the related communications data of these intercepted communications.

The Court also found that the chapter II regime violated Article 10. The Court acknowledged that the Chapter II regime afforded enhanced protection where data was sought for the purpose of identifying a journalist's source. However, such provisions did not apply in every case of a request for the communications data of a journalist. Further, in cases concerning access to a journalist communications data there were no special provisions restricting access for the purpose of combating "serious crime." 

No Violation of Article 6 of the Convention (Right to a Fair Trial) 

The applicants in the third of the joined cases complained that the conduct of the IPT proceedings impaired the very essence of their right to a fair trial under Article 6 of the Convention. In particular, they argued that the IPT's conduct lacked independence and impartiality, as evidenced through the IPT holding a secret meeting with the Security Services in 2007, the applicants being ineffectively represented in the closed proceedings, and the IPT failing to require the defendants to disclose key internal guidance. 

The Court found that the IPT's powers were employed to ensure procedural fairness to the applicants' proceedings. The IPT scrutinised all relevant material, material was only withheld from the applicants where the IPT was satisfied that it was in the public interest to do so and the IPT appointed Counsel to the Tribunal to make submissions on behalf of the applicants in the closed proceedings. Further, the applicants did not adequately explain how the IPT meeting with Security Services in 2007 impacted on the fairness of their IPT proceedings in 2014 and 2015. As a result, the Court found that the complaint under Article 6(1)of the Convention was to be rejected as "manifestly ill-founded" pursuant to Article 35(3)(a) of the Convention.

No Violation of Article 14 of the Convention(Prohibition of Discrimination) Combined with Articles 8 and 10 of the Convention

The applicants in the third of the joined cases also complained under Article 14 of the Convention, read with Articles 8 and 10, that the section 8(4) regime was indirectly discriminatory on grounds of nationality because persons outside the UK were disproportionately likely to have their private communications intercepted; and section 16 of the RIPA provides additional safeguards only to persons in the British Islands. 

The Court found that the applicants had not substantiated their claim that persons outside the UK were disproportionately likely to have their private communications intercepted under the section 8(4) regime. Further, in so far as section 16 prevented intercepted material from being selected for examination according to an individual being in the British Islands, any resulting difference in treatment would be based on geographical location and not nationality. Article 14 of the Convention only relates to "personal characteristics" (Magee v the United Kingdom, no 28135/95, s 50, ECHR 2000-VI), of which geography is not one. In any event, the Court thought that difference in treatment based on geography was justified, as the British Government has considerable powers to investigate persons in the British Islands. Accordingly, the Court found that the complaint under Article 14, read together with Articles 8 and 10 was also "manifestly ill-founded" pursuant to Article 35(3)(a) of the Convention.

Commentary

The decision represents a partial victory for privacy and free speech rights activists. As anticipated, the Court recognised the legitimacy of bulk interception regimes in principle, noting that such regimes fall within the State's margin of appreciation in "choosing how best to achieve the legitimate aim of protecting national security." However, the Court surprised rights activists by rejecting the claim that "reasonable suspicion" should be a requirement of bulk interception. The rationale provided was that such a standard would be inconsistent with the Court’s acknowledgment that the operation of a bulk interception regime in principle falls within a State’s margin of appreciation. Further, requiring subsequent notice of interception was found to "assume the existence of clearly defined surveillance targets, which is simply not the case in a bulk interception regime." 

Nevertheless, the Court reaffirmed its case-law over several decades that all interception regimes must have an established legal basis, pursue a legitimate aim, and be necessary in a democratic society. In particular, the European Court of Human Rights reiterated the importance of surveillance regimes abiding by the Webercriteria to minimise their risk of misuse. Whether these principles continue to sufficiently safeguard

The decision is available here.