European Court of Human Rights holds that mass surveillance is not fundamentally incompatible with human rights law
Big Brother Watch and others v the United Kingdom (Applications nos. 58170/13, 62322/14 and 24960/15)
Summary
On 25 May 2021, the Grand Chamber of the European Court of Human Rights (Grand Chamber) ruled that the United Kingdom's bulk surveillance regime was incompatible with Article 8 (which provides protections for the right to respect for private and family life) and Article 10 (which provides for the protection of freedom of thought, conscience and religion) of the European Convention on Human Rights (ECHR).
Factual background
The case was built upon sensitive disclosures made by Edward Snowden in 2013 concerning the electronic surveillance programmes operated by the intelligence services of the United Kingdom (UK) and the United States (US).
The applicants, which included campaign groups such as Big Brother Watch as well as various NGOs like Amnesty International, relied upon the Snowden disclosures to challenge the legality of three distinct surveillance regimes operated by the UK government:
1 Bulk interception: Bulk interception of communications, which allowed intelligence services to tap into and store large volumes of data drawn from fibre optic cables. Bulk interception was permitted under the Regulation of Investigatory Powers Act 2000 (RIPA). Section 8(4) allowed the Secretary of State to issue warrants for the 'interception of external communications'.
2 Intelligence sharing: Receipt of intelligence from foreign intelligence services. Chapter 12 of the Interception of Communications Code of Practice (IC Code) set out the circumstances in which the UK intelligence services could request intelligence from foreign intelligence services, and the procedures which had to be followed.
3 CSP regime: Acquisition of communications data from communication service providers (CSPs). The framework for acquiring such data is set out in Chapter II of RIPA, which permits authorisation only on certain grounds, including in the interests of national security or economic well-being of the UK.
Procedural background
On 13 September 2018, a Chamber of the First Section (First Chamber) declared there had been a violation of Articles 8 and 10 of the ECHR in respect of both the bulk interception regime and the CSP regime. Whilst the First Chamber was satisfied that the UK was not abusing its bulk interception powers, it held that the regime did not meet the quality of law requirement and was incapable of keeping interference to what was necessary in a democratic society, as required by Articles 8 and 10.
However, the First Chamber held that there had been no violation of Article 8 in respect of the intelligence sharing regime. The Chamber considered that the domestic law, together with the IC Code, indicated with sufficient clarity the procedure for requesting material from foreign intelligence services. Further, the Chamber found no evidence of any significant shortcomings in the application and operation of the regime.
In December 2018, a number of the applicants requested the referral of the case to the Grand Chamber. The applicants contended that the Chamber should have gone further in declaring the mass surveillance practices unlawful per se.
Decision
Bulk Interception of Communications
The Grand Chamber determined that Article 8 does not prohibit the use of bulk interception to protect national security and other essential national interests against serious external threats and States 'enjoy a wide margin of appreciation' in deciding what type of interception regime is necessary.[1] However, the Grand Chamber also recognised eight fundamental 'end-to-end' safeguards with which domestic laws must comply.[2]
In this case, the UK regime did not contain sufficient safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse. In particular, there was an absence of independent authorisation, a failure to include the categories of selectors (specific identifiers, for example, names or an email addresses) in the application for a warrant, and a failure to subject selectors linked to an individual to prior internal authorisation. On this basis, the majority concluded there had been a violation of Article 8.
The Grand Chamber also considered the regime's compatibility with Article 10 insofar as it related to intercepted communications and data that had been created by journalists. The majority considered that any selectors or search terms used to access confidential journalistic material must have been authorised by a judge or other independent body to determine whether it was 'justified by an overriding requirement in the public interest'.[3] In this instance, there was no requirement for such authorisation and there were also insufficient safeguards for the storage and examination of intercepted information. The Grand Chamber therefore concluded that the regime violated Article 10.
Receipt of Intelligence from Foreign Intelligence Services
In relation to intelligence sharing, the Grand Chamber considered that the regime for requesting and receiving intercepted material from other foreign intelligence services was compatible with Article 8. It found that there are detailed rules outlining the circumstances in which the UK authorities are empowered to make a request for intercepted information, and that these rules include effective guarantees against the circumvention of the domestic regime. The Grand Chamber also found that these rules provide adequate safeguards in relation to use of the intercepted material and provide for independent oversight. Finally, the rules provide for the possibility of ex post facto review.
The Grand Chamber did not consider Article 10 in detail as domestic remedies had not been exhausted by the applicants in respect of this alleged violation.
Acquisition of Communications Data from CSPs
In relation to the CSP regime, the Grand Chamber considered that there had been a violation of Article 8. The majority agreed with the applicants' argument that access to data retained by CSPs should be limited to the purpose of combatting 'serious crime' and be subject to prior review by an independent body.[4]
The Grand Chamber also considered that there was a violation of Article 10. Whilst Chapter II of the RIPA affords protections in certain circumstances, the provisions do not apply in every case where there is a request for journalistic material. Further, the provisions fail to restrict access to the purpose of preventing serious crime.
Commentary
This case is the first to consider mass surveillance following the Snowden disclosures and will inform how other surveillance programs are assessed. Most significantly, the case confirms that mass surveillance is not fundamentally incompatible with human rights law. Instead, governments 'enjoy a wide margin of appreciation in deciding what type of interception regime is necessary' provided that such practices are subject to robust 'end-to-end safeguards'.[1] Interestingly, only one judge dissented from the majority view, noting that the judgment has 'opened the gates for an electronic "Big Brother" in Europe'.[2]
The Grand Chamber did however update the six minimum safeguards previously held to be applicable to surveillance programs, such that domestic laws are now required to define (a) the way in which compliance with the safeguards will be supervised by an independent body; and (b) the way in which compliance with the safeguards will be independently reviewed after the exercise of surveillance powers.
Given that the intersection between privacy and national security is a continually evolving space, this is unlikely to be the last case to explore these complex issues.
Alex Neerhut is a Lawyer at Allens.
Lloyd Hutson is a Law Graduate at Allens
[1] Big Brother Watch and others v the United Kingdom (Applications nos. 58170/13, 62322/14 and 24960/15), 314-315, 387.
[2] Ibid, 500-516.
[3] Ibid, 250.
[4] Ibid, 518-519
[5] Ibid, 350.
[6] Ibid, Partly Concurring and Partly Dissenting Opinion of Judge Pinto De Albuquerque, 59.