Case Summary and Outcome

In the case of Big Brother Watch and Others v. The United Kingdom (No. 2), the Grand Chamber of the European Court of Human Rights (ECtHR) concluded that section 8(4) and Chapter II of the UK’s Regulation of Investigatory Powers Act (“RIPA”) had violated the rights to privacy and freedom of expression of the European Convention on Human Rights (Convention). The applicants argued about the compatibility of three electronic surveillance programs operated by the UK’s Government Communications Headquarters (GCHQ) with the Convention. These programs were the following: (i) Bulk interception under the TEMPORA program, which stored and managed large volumes of data drawn from bearers; (ii) the intelligence-sharing regime with foreign countries, particularly the United States of America through the medium of the PRISM and Upstream programs; and, (iii) the procurement of communications data from communications service providers (CSPs). The three complaints were submitted after Edward Snowden’s disclosures revealing surveillance programs managed by both the intelligence services of the United States of America and the United Kingdom. The Grand Chamber found that the UK’s regimes on bulk interception and obtaining data from communications service providers had violated the Convention as the following deficiencies were detected: (i) the absence of independent authorization and oversight (the so-called “end-to-end safeguards”); (ii) no categories of selectors were included in the applications for a warrant; (iii) there was no prior internal approval of the selectors linked to an identifiable individual; and, (iv) the State did not examine other less intrusive measures before activating and implementing electronic surveillance programs, among other safeguards.

---

Facts

The case concerned three complaints lodged after former US national computer intelligence consultant Edward Snowden’s revelations relating to the electronic surveillance programs managed by the intelligence services of the United Kingdom and the United States of America. These applications were as follow: (i) Application No. 58170/13 submitted by Big Brother Watch, English PEN, Open Rights Group, and Dr. Constanze Kurz; (ii) Application No.62322/14 filed by the Bureau of Investigative Journalism and Alice Ross; and, (iii) Application No. 24960/15 submitted by Amnesty International Limited, Bytes For All, The National Council for Civil Liberties (“Liberty”), The American Civil Liberties Union, The Irish Council For Civil Liberties Limited, The Canadian Civil Liberties Association, The Egyptian Initiative For Personal Rights, The Hungarian Civil Liberties Union, Privacy International, The American Civil Liberties Union, and The Legal Resources Centre (The ten human rights organizations), all of them against the United Kingdom.

Big Brother Watch and others v. the United Kingdom (Application No. 58170/13)

On 3 July 2013, the applicants in the first of the joined cases presented a letter before the Government highlighting their legal complaints and asking for declarations that section 8 of RIPA, sections 1 and 3 of the Intelligence Services Act of 1994, and section 1 of the Security Services Act of 1989 had violated their Convention rights. Nonetheless, on 26 July 2013, the Government indicated that according to section 65(2) of RIPA, human rights allegations against intelligence services fell outside the purview of the High Court, but that the applicants could submit their legal complaints before the Investigatory Powers Tribunal (IPT), a specialized tribunal established under RIPA with exclusive jurisdiction over allegations of infringement under the aforementioned legal instrument. However, following the Government’s reply of 26 July 2013, no further action was undertaken by these applicants.

Eventually, the applicants lodged a complaint with the ECtHR arguing, inter alia, that the bulk interception regime was incompatible with Article 8 of the Convention. To this end, the applicants contended, among other things, that the bulk interception of communications fell outside the State’s margin of appreciation as it was neither proportionate nor necessary in light of the wording of article 8 of the Convention.

The Bureau of Investigative Journalism and Alice Ross v. the United Kingdom (Application No.62322/14)

In the second of the joined cases, the applicants did not exhaust any domestic legal remedies as they did not believe that they were effective in protecting their Convention rights. Instead, the applicants submitted a complaint to the ECtHR arguing that the bulk interception regime was incompatible with their right to privacy (Article 8 of the Convention). In addition, the applicants stated that the section 8(4) regime violated the protection afforded by Article 10 of the Convention to privileged communications.

The ten human rights organizations v. the United Kingdom (Application No. 24960/15)

The applicants in the third of the joined cases each submitted a complaint to the IPT between June and December of 2013, arguing that the UK’s intelligence services violated Articles 8, 10, and 14 of the Convention by (i) accessing and receiving intercepted material and communications data from the United States Government under the PRISM and Upstream programs; and (ii) intercepting, examining, and storing communications and data under the TEMPORA program. To this end, the IPT rendered three judgments on 5 December 2014, 6 February 2015, and 22 June 2015, concluding the following:

a) Concerning the PRISM issue

PRISM was a program managed by the United States’ Government to target and access confidential and personal information from Internet Service Providers (ISPs). In its judgment, the IPT ruled that albeit the norms governing electronic surveillance programs must be precise and clearly stated in national norms to comply with Article 8 of the Convention, in the field of national security less was demanded to fulfill this legal obligation, namely that “appropriate rules or arrangements exist and are publicly known and confirmed to exist, with their content sufficiently signposted, such as to give an adequate indication of it” and are “subject to proper oversight”. Consequently, the IPT rejected this submission. [para.41]

Concerning the case introduced by Amnesty International, the IPT found that personal emails were lawfully intercepted and examined under section 8(4) of RIPA. However, the IPT revealed that the confidential material was retained for longer than permitted pursuant to internal policies of GCHQ, therefore amounting to an infringement of Article 8 of the Convention. Nevertheless, the IPT confirmed that the intercepted material was neither accessed nor examined after the applicable time limit expiry. Thus, the IPT ordered the GCHQ to destroy the communications retained for longer than legally permitted and provide a closed report within fourteen days confirming the destruction of these documents. No award of compensation was made in this case.

Finally, with regards to the Legal Resources Centre, the IPT found that communications from an email address associated with the Centre had been intercepted and examined under a section 8(4) warrant. The IPT also found that some internal procedures for selection were violated, thus amounting to an infringement of Article 8 of the Convention. However, since the information obtained by the Government was not used by the CGHQ in any sense, the IPT ruled that the applicant in this case did not prove any material damage. Therefore no compensation was awarded to the applicant.

b) Concerning the section 8(4) issue

In this regard, the IPT considered that the safeguards and procedures provided in the section 8(4) of RIPA were justified under the Convention.

Since the IPT partly rejected the applicants’ complaints, the third applicants also filed an application with the ECtHR complaining about the compatibility of the UK’s three surveillance and intelligence regimes (the bulk interception regime, the intelligence-sharing regime operated in collaboration with foreign governments; and the regime for the acquisition of communications data from CSPs) with Articles 8 and 10 of the Convention. In respect of Article 8, the applicants argued that bulk interception was neither necessary nor proportionate pursuant to Article 8 of the Convention and, as such, fell outside the State’s margin of appreciation. In this sense, the applicants also argued that NGOs’ privileged communications were protected under Article 10 of Convention.

---

Decision Overview

In primis, the Grand Chamber highlighted two concerns before embarking on an analysis of the merits: (i) that it must limit its examination to the law in force on the date the Court examined the admissibility of the complaints; that is, it must study the law without any of the amendments introduced after November 2017; and (ii) that neither the applicants, nor the government, challenged the Chamber’s decision to consider the IPT an effective remedy (after not being considered as such in previous case law) which meant that in the circumstances of the present case, the applicants exhausted domestic remedies as per Article 35 § 1 of the Convention.

Article 8 of the Convention

Section 8(4) regime on the bulk interception of communications

With regards to Article 8 of the Convention, the applicants in all three of the joined cases complained that the bulk interception regime was incompatible with the petitioners’ right to privacy. To determine whether the bulk interception of communications is compatible with Article 8 of the Convention, the Grand Chamber identified “six minimum safeguards” which must be followed in order to guarantee the fulfillment and enjoyment of the right to privacy when implementing electronic surveillance programs: “(i) the nature of offenses which may give rise to an interception order, (ii) a definition of the categories of people liable to have their communications intercepted, (iii) a limit on the duration of interception, (iv) the procedure to be followed for examining, using and storing the data obtained, (v) the precautions to be taken when communicating the data to other parties, and (vi) the circumstances in which intercepted data may or must be erased or destroyed” [para. 274]. These safeguards “had been applied routinely by the Court in its case-law on the interception of communications and in two cases specifically concerning the bulk interception of communications” [para. 274]. Those two cases were Weber and Saravia v. Germany and Liberty and Others v. The United Kingdom. However, in the present case, the Grand Chamber adapted these safeguards to the sub examine circumstances to determine whether the bulk interception regime falls within states’ margin of appreciation. According to the adaptation of the “six Weber safeguards” performed by the Grand Chamber, judges must determine whether the domestic legal framework on bulk surveillance clearly defines: “(1) the grounds on which bulk interception may be authorized; (2) the circumstances in which an individual’s communications may be intercepted; (3) the procedure to be followed for granting authorization; (4) the procedures to be followed for selecting, examining and using intercept material; (5) the precautions to be taken when communicating the material to other parties; (6) the limits on the duration of interception, the storage of intercept material and the circumstances in which such material must be erased and destroyed; (7) the procedures and modalities for supervision by an independent authority of compliance with the above safeguards and its powers to address non-compliance; (8) the procedures for independent ex post facto review of such compliance and the powers vested in the competent body in addressing instances of non-compliance“ [para. 361].

In view of the preceding, the Chamber noted that, in principle, States’ ability to implement a bulk interception regime fell within their margin of appreciation pursuant to the Convention and jurisprudence on the matter. In that sense, the Grand Chamber analyzed how the bulk interception regime interferes with Article 8 of the Convention, particularly while exhausting each stage of the bulk interception process. This analysis helped the Grand Chamber understand that interference with Article 8 of the Convention increases as each of the 4 stages is exhausted. These 4 stages are as follow: “(a)the interception and initial retention of communications and related communications data (that is, the traffic data belonging to the intercepted communications); (b) the application of specific selectors to the retained communications/related communications data; (c) the examination of selected communications/related communications data by analysts; and (d) the subsequent retention of data and use of the ‘final product’, including the sharing of data with third parties” [para. 325].

While the Grand Chamber accepted that “bulk interception is of vital importance to Contracting States in identifying threats to their national security,” it nevertheless identified three areas of concern relating to the implementation of section 8(4) of RIPA: first, the absence of independent authorization and oversight of the process, particularly “the failure to subject selectors linked to an individual to prior internal authorization”; second, the fact that the categories of selectors used in the searches were not included in the applications for a warrant nor were they approved before being used; and third, the lack of any adequate safeguards applicable to the searching and examination of related communications data [paras. 424-425]. The Grand Chamber also acknowledged the difficulty in assessing bulk collection schemes for “surveillance which is not targeted directly at individuals therefore has the capacity to have a very wide reach indeed, both inside and outside the territory of the surveilling State. Safeguards are therefore pivotal and yet elusive” [para. 322].

In this respect, the Grand Chamber ruled that the weaknesses mentioned ut supra made it impossible for the UK to fulfill its obligations pursuant to Article 8 of the Convention, particularly the legalization of the “six minimum safeguards” referred to above. Hence, despite the explanations offered by the Interception of Communications Commissioner and the judicial remedies provided by the IPT to anyone who suspected a violation of their human rights under the section 8(4) regime, the measures implemented by the UK, in this case, were found to be insufficient to counterbalance the above deficiencies. Consequently, the bulk interception of communications regime under section 8(4) of the Regulation of Investigatory Powers Act or RIPA was “incapable of keeping the ‘interference’ to what was ‘necessary in a democratic society,’” resulting in a violation of Article 8 of the Convention [para. 276].

The regime governing the receipt of intercept material from foreign intelligence services

In the first of the joined cases, the applicants highlighted the receipt of intercepted and confidential material from foreign intelligence services by the United Kingdom authorities. In the meantime, the applicants in the third of the joined cases complained more specifically that the reception of confidential material intercepted by the NSA under the PRISM and Upstream programs compromised the UK’s international responsibility pursuant to Article 8 of the Convention. Before embarking on an analysis of the merits, however, the Chamber indicated that its examination of the merits would be limited to the complaints on receiving “solicited intercept material” from the NSA, which excludes any consideration of material provided motu proprio (on their own accord) by foreign governments.

To determine whether the UK committed a violation of Article 8 by sharing and receiving intelligence intercepted by foreign intelligence services, the Chamber applied a modified or adapted version of the six minimum safeguards implemented when examining section 8(4) regime.  In this regard, the Chamber first evaluated whether the circumstances in which the UK could ask for intercepted intelligence were duly limited and expressly established by law to prevent the authorities from avoiding their international and domestic responsibilities. The Chamber then applied the final four “minimum safeguards” to treat intercept material once obtained by the United Kingdom intelligence services.

Given the preceding, the Chamber noted that the domestic law, along with the improvements added with the amendment of the IC Code, was sufficiently clear in establishing the procedure governing any request of confidential information from foreign intelligence services. Likewise, the Chamber found no evidence of significant faults in the implementation of this regime. Hence, the Chamber held that there was no violation of Article 8 of the Convention under the regime on receiving intercepted information or material from foreign governments.

The Chapter II regime on the acquisition of communications data from CSPs

In the second of the joined cases, the applicants argued that obtaining communications data from the CSPs was incompatible with their rights under Article 8 of the Convention. To further analyze this matter, the Chamber considered that any regime permitting the authorities to access data obtained by CSPs should be limited to a prior authorization issued by an independent judicial body in cases where a “serious crime” is being prevented.

Having due regard to the decision of the Court of Justice of the European Union establishing that the provisions of RIPA governing the retention of communications data from CSPs were incompatible with EU law, the Grand Chamber concluded that the regime allowing national authorities to have access to data retained by CSPs implied a violation of the right to privacy. In the instant case, the Grand Chamber held that access to confidential material was not subject to prior authorization by a judicial body, nor was it meant exclusively to combat serious crimes which resulted in a violation of Article 8.

Article 10 of the Convention

Section 8(4) regime on the bulk interception of communications

In the second and third joined cases (Application Nos. 62322/14 and 24960/15), the petitioners claimed that section 8(4) was in breach of Article 10 of the Convention as it restricted the freedom of expression of both journalists and NGOs. Nonetheless, since the Chamber declared the third complaint inadmissible for not exhausting domestic judicial remedies, the alleged violation of Article 10 was only examined under the complaint filed by the Bureau of Investigative Journalism and Alice Ross concerning the journalists’ right to freedom of expression and opinion.

The Grand Chamber held mass surveillance programs under section 8(4) of RIPA were neither aimed at accessing journalistic sources nor monitoring journalists’ investigations, which meant that, in principle, such behavior could not interfere with the fulfillment of the right to freedom of expression. For instance, confidential journalistic material could have been accessed by the intelligence services intentionally by using keywords redirecting to journalists or news organizations under the bulk interception regime. In these cases, access to personal information should only be granted after exhausting the corresponding legal safeguards established by the Court and justified by an overriding public interest. Otherwise, without any precaution or arrangement limiting the State Party’s ability to access confidential journalistic material, a breach of Article 10 of the Convention is sure to be confirmed.

According to section 8(4) of RIPA, confidential journalistic material could also be accessed unintentionally by national authorities due to a bulk interception operation in which information is indiscriminately gathered. In this case, access to journalistic material cannot be predicted at the outset; thus, the participation of an independent court at an early stage is not feasible. However, if confidential journalistic information is intercepted, it is the analyst’s responsibility to ask for judicial authorization before storing or examining such material. This approval may only be given if the public interest is at risk.

Therefore, since the UK could access and examine confidential journalistic material by only justifying an “overriding requirement in the public interest,” without first establishing (i) limitations on when such communications could be accessed and examined by national authorities or (ii) adequate measures to ensure the protection of confidential journalistic information, the Chamber held that a violation of Article 10 of the Convention was committed by virtue of Section 8(4) of RIPA.

The regime governing the receipt of intercept material from foreign intelligence services

In this respect, the Chamber recalled that the third application was declared inadmissible for not exhausting the corresponding domestic remedies. Consequently, the Chamber did not examine this particular complaint.

On the other hand, the applicants in the third of the joined cases contested the compatibility of the intelligence-sharing regime with Article 10 of the Convention. However, albeit having raised this argument in due time before the IPT, the Chamber held that this complaint was not different from that introduced by the applicant under Article 8 of the Convention, which was already examined above. Thus, the Chamber found no violation of Article 10 in this regard.

The Chapter II regime on the acquisition of communications data from CSPs

In the second of the joined cases, the applicants also submitted a complaint concerning the compatibility of the regime for the acquisition of communications data from CSPs with Article 10 of the Convention.

Before delivering its judgment, the Chamber acknowledged that the Chapter II regime afforded enhanced protection where data were sought to identify a journalist’s source. Nevertheless, this protection only became effective when the purpose of an application was to determine a journalist’s source, in which case a request for approval had to be submitted before a national Court, justified by an overriding requirement in the public interest, as per the Police and Criminal Evidence Act of 1984. However, the preceding meant that any confidential journalistic information, other than a journalist’s source, was not duly protected by domestic law. Furthermore, national laws lacked special provisions restricting access when combating “serious crime”. Consequently, the Chamber held that the Chapter II regime was in breach of Article 10 of the Convention since it only afforded sufficient legal protection to data containing a journalist’s source.

Joint partly concurring opinion of Judges Lemmens, Vehabović and Bošnjak

In the instant case, Judges Lemmens, Vehabović, and Bošnja agreed with the majority’s opinions on most counts. However, they voted against the majority’s decision finding no violation of Articles 8 and 10 of the Convention when the intelligence-sharing regime was being assessed. Also, Judges Lemmens, Vehabović, and Bošnja considered this case a tremendous opportunity for the Court to highlight the importance of private life in matters related to the implementation of electronic mass surveillance programs.

Regarding the dissenting part of their opinion, Judges Lemmens, Vehabović, and Bošnja concluded that mass surveillance programs interfered with individuals’ right to privacy which at the same time restricted the fulfillment of other human rights prerogatives such as freedom of association and freedom of speech. For example, Judges Lemmens, Vehabović, and Bošnja argued that if individuals knew that the authorities continually monitored them, they would think twice before voicing their political opinions whilst becoming more cautious when exercising their human rights.

For example, among their arguments, Judges Lemmens, Vehabović, and Bošnja highlighted the Government’s lack of transparency when explaining their criteria on deciding what communications are kept and discarded. According to Judges Lemmens, Vehabović, and Bošnja, the Government’s great discretionary powers to design the selection process to examine intercepted material must be a matter of concern for the international community.  In addition, Judges Lemmens, Vehabović, and Bošnja observed some weaknesses in the “six minimum safeguards” provided by the Grand Chamber to reduce States’ chances to commit abuses of power, such as (i) the ability to fix any lack of compliance in the process of global assessment; (ii) the absence of clear substantive protection of individuals against disproportionate interference; and (iii) the fact that a definition of these safeguards must be enshrined in domestic law, but no minimum standards or limitations are provided in this regard. Likewise, Judges Lemmens, Vehabović, and Bošnjas noted that the definition of “national security” provided by the IC Commissioner was too broad; therefore, it did not pass the foreseeability test [para. 14].

Partly concurring and partly dissenting opinion of Judge Pinto de Albuquerque

Judge Pinto de Albuquerque was unable to agree with the majority’s finding of no violation of Articles 8 and 10 regarding the intelligence-sharing regime, namely the interception of bulk material by the National Security Agency (NSA) through the medium of the PRISM and Upstream programs. Judge Pinto de Albuquerque based his opinion, inter alia, on how ineffective mass surveillance programs have proven to be in preventing terrorist acts. He argued that mass surveillance programs pose an unnecessary burden on individuals and disproportionate restrictions on the rights to privacy and freedom of expression. Therefore, in his view, Contracting States are better off investing their resources in other means of protecting national security.

Likewise, Judge Pinto de Albuquerque argued that the Court did not possess all the necessary evidence and information to address the case at hand adequately. For instance, the Government did not explain to the Court the scope and extension of the selectors and keywords used in the searches of confidential information. In addition, Judge Pinto de Albuquerque considered that the Court missed a great opportunity to clearly define the circumstances in which private communications may be intercepted. However, by not addressing this issue, the Court allowed this task to be assigned upon Contracting Parties. Therefore, in his opinion, the Court cannot expect the Government to include extensive legal safeguards and a clear definition of the grounds upon which bulk interception may be authorized since the Court could not do it itself.

In his partly concurring and partly dissenting opinion, Judge Pinto de Albuquerque also noted that ordinary courts should be competent to oversee private communications interception in all bulk operations. In his words, “Judicial warranting should extend to the authorization of surveillance of communications or related communications data, including privileged and confidential data, with the sole exception of urgent cases, when the competent judge is not immediately available, where authorization may be given by a public prosecutor, subject to the competent judge’s subsequent endorsement” [para. 24].

Also, Judge Pinto suggested implementing specific guidelines and protection for confidential information owned by certain professionals such as politics, doctors, lawyers, and journalists. At last, Judge Pinto supported his colleagues’ dissenting opinions concerning the Court’s decision to facilitate the sharing of confidential information with foreign governments since cases in which information was provided motu proprio by foreign governments were not evaluated by the Court.

Joint partly dissenting opinion of Judges Lemmens, Vehabović, Ranzoni and Bošnjak.

Judges Lemmens, Vehabović, Ranzoni, and Bošnjak were also unable to share the majority’s view that there has been no violation of Articles 8 and 10 of the Convention by virtue of the intelligence-sharing regime implemented by the respondent State’s authorities.  In Judges Lemmens, Vehabović, Ranzoni, and Bošnjak’s opinion, the same safeguards that apply to the bulk interception regime should also limit the implementation of the intelligence-sharing regime.  Also, in their view, there should not be a distinction in the treatment received by intercepted data, whether it was requested or merely accepted by the national authorities.

The concept of “effective guarantees,” in their view, implies not only the establishment of explicit domestic legal provisions but also the designation of an independent administrative body or Court capable of ensuring adequate implementation of such legal provisions pursuant to fundamental maxims of law.

Lastly, Judges Lemmens, Vehabović, Ranzoni, and Bošnjak noted that the majority agreed on the requests for sharing information being based on warrants authorized by the Secretary of State; however, they considered that the Secretary of State is not an “independent body”; thus, the warrants utilized for these purposes were approved by an “interested party” in the operation, resulting in a violation of the Contracting Party’s international obligations.

---