UK mass surveillance breaches the ECHR

In the wake of the 2013 Edward Snowden affair, in which a former contractor for the National Security Agency (NSA) revealed that mass surveillance programmes were being operated by the UK and US intelligence services, a collection of journalists and human rights organisations brought a case against the UK government, challenging the bulk interception of communication by GCHQ. The European Court of Human Rights delivered its long-awaited judgment on 25 May 2021.

What was the case about?

Three separate applications were initially lodged, which were later joined together. The applicants were concerned that, as a result of their journalistic and/or human rights activities, it was likely that their electronic communications had either been directly intercepted by GCHQ, or that third parties such as the NSA or internet service providers (ISPs) had passed on their data to the UK intelligence services.

At the time of the application, the Regulation of Investigatory Powers Act (RIPA) 2000 governed the interception of mass data. This legislation was subsequently replaced with the Investigatory Powers Act (IPA) 2016.

What was the outcome of the case?

The legal challenge culminated in a judgment by the Grand Chamber of the European Court of Human Rights, in the case of Big Brother Watch and Others v the United Kingdom, which made a number of rulings pertaining to articles 8 (right to respect for private and family life/communications) and 10 (freedom of expression) of the European Convention on Human Rights (ECHR):

unanimously, that there had been a violation of Article 8 in respect of the bulk intercept regime;
unanimously that there had been a violation of Article 8 in respect of the regime for obtaining communications data from communication service providers;
by 12 votes to 5, that there had been no violation of Article 8 in respect of the UK’s regime for requesting intercepted material from foreign Governments and intelligence agencies;
unanimously, that there had been a violation of Article 10, concerning both the bulk interception regime and the regime for obtaining communications data from communication service providers; and
by 12 votes to 5, that there had been no violation of Article 10 in respect of the regime for requesting intercepted material from foreign governments and intelligence agencies.

The court did not consider that the mere operation of a bulk interception regime violated any of the principles of the ECHR. However, it ruled that any regime of bulk interception should be subject to:

“end-to-end safeguards” involving an assessment being made at each stage of the process regarding the necessity and proportionality of the measures;
independent authorisation at the outset, when the object and scope of the operation are being defined; and
supervision and independent ex post facto review.

The court identified three deficiencies in the bulk interception regime operated by GCHQ:

bulk interception had been authorised by the Secretary of State, and not by a body independent of the executive;
categories of search terms defining the kinds of communications that would become liable for examination had not been included in the application for a warrant; and
search terms linked to an individual (eg an email address) had not been subject to prior internal authorisation.

The court found that the bulk interception regime had breached article 10 of the ECHR, since there were insufficient protections for confidential journalistic material. Furthermore, the regime for obtaining communications data from communication service providers such as ISPs violated articles 8 and 10. But the regime for receiving intelligence material from foreign states or bodies such as the NSA was compatible with the ECHR.

What does the ruling mean?

This judgment essentially confirms that the bulk interception regime operated by the UK government at the time of the Snowden revelations in 2013 was unlawful.

Since these findings relate to the bulk interception regime under RIPA 2000, it is unclear whether they would also apply to the regime governed by IPA 2016. But the principles will essentially remain the same and will be relevant for bulk interception in general. For a discussion on the specific implications of this ruling on the IPA 2016, see Graham Smith’s excellent blog post on this topic.

Despite Brexit, the UK is still a member of the ECHR. So it is important that the government assesses whether any of the failings identified by the court still apply to the current regime of bulk interception under the IPA 2016.

A separate legal action by Liberty, one of the human rights organisations which was an applicant in this case, challenging the IPA 2016, will now proceed to the Court of Appeal, on the back of this judgment from the European Court of Human Rights.

Commenting, Megan Goulding, the lawyer representing Liberty, said:

“We all want to have control over our personal information, and to have a Government that respects our right to privacy and our freedom of expression. That’s what makes today’s victory, and the Court’s recognition of the dangers posed by these mass surveillance powers, so important … Today’s decision takes us another step closer to scrapping these dangerous, oppressive surveillance powers, and ensuring our rights are protected.”

Internet for Lawyers Newsletter

Edited by Nick Holmes

What was the case about?

What was the outcome of the case?

What does the ruling mean?

Further reading