RIPA surveillance regime held a breach of human rights

The United Kingdom has been found in breach of the European Convention on Human Rights due to the methods for bulk interception of online communications operated by the intelligence agency GCHQ under the Regulation of Investigatory Powers Act 2000.

In a unanimous ruling in the case brought by Big Brother Watch and other human rights organisations and journalists, the Grand Chamber (17 judges) of the European Court of Human Rights held that there had been a violation of both article 8 (right to respect for private and family life, and communications) and article 10 (freedom of expression) of the Convention in respect of the bulk intercept regime, and the regime for obtaining communications data from communication service providers.

However the court also decided, by 12 votes to five, that there had been no violation of either article 8 in respect of the regime for requesting intercepted material from foreign Governments and intelligence agencies.

The judgment is the final ruling in a legal challenge begun in 2013. The legal powers in question have since been replaced by the Investigatory Powers Act 2016.

Applications were lodged with the court after former US National Security Agency (NSA) contractor Edward Snowden revealed the existence of surveillance and intelligence sharing programmes operated by the intelligence services of the USA and the UK. The applicants believed that the nature of their activities meant that their electronic communications and/or communications data were likely to have been intercepted by the UK intelligence services or obtained by them from either communications service providers or foreign intelligence agencies such as the NSA.

The court ruled that, owing to the multitude of threats states face in modern society, operating a bulk interception regime did not in itself violate the Convention. However, adapting its ordinary approach towards targeted surveillance regimes to reflect the inherent risk of abuse and a legitimate need for secrecy with a bulk interception regime, such a regime had to be subject to "end-to-end safeguards".

This meant that, at the domestic level, an assessment should be made at each stage of the process of the necessity and proportionality of the measures being taken; that bulk interception should be subject to independent authorisation at the outset, when the object and scope of the operation were being defined; and that the operation should be subject to supervision and to independent review afterwards.

In relation to article 8 it identified these deficiencies in the UK regime:

• bulk interception had been authorised by the Secretary of State, and not by a body independent of the executive;
• categories of search terms defining the kinds of communications that would become liable for examination had not been included in the application for a warrant;
• and search terms linked to an individual (specific identifiers such as an email address) had not been subject to prior internal authorisation.

Although valuable oversight and a robust judicial remedy were provided by the (then) Interception of Communications Commissioner and the Investigatory Powers Tribunal, these safeguards were not enough to offset the shortcomings in the regime or to keep the "interference" with citizens' rights to private life to what had been "necessary in a democratic society". 

Breach of article 10 arose because the interception regime did not contain sufficient protections for confidential journalistic material. There was no requirement that the use of selectors or search terms known to be connected to a journalist be authorised by a judge or other independent and impartial decision-making body. Nor, when it became apparent that a communication contained confidential journalistic material, were there safeguards to ensure that it could only continue to be stored and examined by an analyst if authorised by a judge or another independent decision-making body.

As regards the regime for obtaining communications data from communication service providers, the Government did not contest an earlier chamber ruling that this had not been "in accordance with the law". However, the regime by which the UK could request intelligence from foreign governments and/or intelligence agencies had had sufficient safeguards in place to protect against abuse and to ensure that UK authorities had not used such requests as a means of circumventing their duties under domestic law and the Convention.

The judges who dissented in part considered that the ruling did not go far enough, for example in considering whether there was an adequate definition of the "interests of national security", and what constituted "effective guarantees" in relation to requesting data from foreign states as a means of circumventing domestic law or obligations under the Convention.

The applicants did not seek damages, but were awarded €91,000 as expenses of the proceedings.

Megan Goulding, who acted for Liberty, one of the applicants, commented: "Bulk surveillance powers allow the state to collect data that can reveal a huge amount about any one of us – from our political views to our sexual orientation. These mass surveillance powers do not make us safer.

"Our right to privacy protects all of us. Today’s decision takes us another step closer to scrapping these dangerous, oppressive surveillance powers, and ensuring our rights are protected."

Liberty now intends to proceed with a challenge in the UK courts to the 2016 Act, which was stayed pending the Strasbourg court's decision.

Click here to view the judgments.