Case Summary and Outcome

The European Court of Human Rights (Court) found some aspects of the UK’s mass surveillance regime to be in violation of the right to privacy and the right to freedom of expression under the European Convention on Human Rights (Convention). The case sought to challenge three different systems of mass surveillance adopted by the UK intelligence services: (1) the bulk interception of communications; (2) intelligence sharing with foreign governments; and (3) the obtaining of communications data from communications service providers. The Court found that a regime of bulk interception was not, in itself, incompatible with the European Convention on Human Rights. Nonetheless, it found the bulk interception regime in the UK to be in violation of the right to privacy and the right to freedom of expression due to, among other things, the lack of independent oversight over the entire process for selecting bearers for interception, identifying the selectors and search terms to be used to filter intercepted communications, and the selection of material to be examined by analysts. The Court also found the regime for obtaining communications data from communications service providers to be incompatible with the Convention because its use was not limited to combatting “serious crime”, it was not subject to prior review by a national authority, and it did not sufficiently protect journalists’ confidential communications. The Court upheld the compatibility of the UK’s intelligence sharing regime with the Convention.

Facts

The case concerned three applications that were filed in Big Brother Watch and Others v. the United Kingdom (no. 58170/13); Bureau of Investigative Journalism and Alice Ross v. the United Kingdom (no. 62322/14); and 10 Human Rights Organisations and Others v. the United Kingdom (no. 24960/15).

The applications were filed by a mix of NGOs, non-profits, academics and journalists and were submitted after Edward Snowden (a former US National Security Agency contractor) exposed the exploitation of surveillance and intelligence sharing programs by the US and UK national intelligence services. With regard to the UK, these revelations indicated that the UK Government Communications Headquarters (GCHQ) was running an operation, codenamed TEMPORA, that allowed it to tap into and store huge volumes of data drawn from underwater cables (or “bearers”). This is referred to as the bulk interception of communications, which allowed GCHQ to store bulk data that it could then filter through the use of selection criteria and then examine.

The applicants believed that the UK intelligence services had likely intercepted or obtained their electronic communications. In particular, they alleged that their data had likely been obtained through a number of surveillance techniques: (1) the bulk interception of communications under section 8(4) of the Regulation of Investigatory Powers Act 2000 (RIPA)/TEMPORA; (2) intelligence sharing with foreign governments; and (3) the obtaining of communications data from communications service providers (Chapter II of RIPA).

In all three cases the applicants contended that these measures violated their right to respect for private life under Article 8 of the European Convention on Human Rights (Convention). However, the applicants only alleged a further violation of the right to freedom of expression under Article 10 of the Convention in the second and third cases.

Big Brother Watch and Others v. the United Kingdom (App. no. 58170/13)

The applicants were three NGOs (Big Brother Watch, Open Rights Group, and English PEN) and an academic (Dr. Constanze Kurz) working in the fields of privacy and freedom of expression. They sent a pre-action protocol letter to the Government in 2013 complaining about the incompatibility of national law with the Convention. However, the applicants did not bring legal proceedings before the Investigatory Powers Tribunal (IPT) which was indicated by the Government in its letter as a remedy for the applicants.

The applicants complained that they were likely subject to surveillance by the GCHQ intercepting and/or obtaining their electronic communications. As a result, they claimed a violation of Article 8 of the Convention since the surveillance activities were not “in accordance with the law”. The applicants argued that there was no legal basis for the receipt of information from foreign intelligence agencies and that the activities constituted a disproportionate interference with their right to privacy. In doing so, the applicants complained about the lack of control and safeguards in relation to the circumstances in which the UK intelligence services could process their intercepted data.

Bureau of Investigative Journalism and Alice Ross v. the United Kingdom (App. no. 62322/14)

In this case, the two applicants were the Bureau of Investigative Journalism (BIJ), an independent and non-profit organization producing public interest journalism and collaborating with local and global media organizations, and Alice Ross, a reporter with the BIJ, who was an expert in national security, conflict, counter-terrorism and foreign policy. During one of her investigations regarding the use of drones in Pakistan, the reporter identified some individuals whose British citizenship was revoked due to terrorism grounds and communicated with other individuals connected to these persons based in Pakistan, Afghanistan and Turkey. The reporter believed that UK’s intelligence services were monitoring a number of these individuals and, as a result, she states that she believed their communications were intercepted pursuant to the RIPA.

In this case, the applicants did not bring any domestic proceedings as they did not believe that they had an effective remedy for their Convention complaints. Instead, the applicants lodged an application to the European Court of Human Rights complaining that the statutory regime concerning the interception of external communications and metadata was incompatible with Articles 8 and 10 of the Convention. The applicants complained that such measures were not “in accordance with the law” or “prescribed by law”. They also argued that the fear that their communications might be intercepted inhibited their ability to carry out their investigative journalism activities. They further argued that blanket interception of communications, as well as storage and exploitation of communications, disproportionately interfered with journalists’ rights to freedom of expression more generally.

10 Human Rights Organisations and Others v. the United Kingdom (App. no. 24960/15)

The applicants were human rights organizations that frequently communicated with a range of groups and individuals, both nationally and internationally, as part of their human rights activities. In doing so, they used a variety of communication channels. Since their information usually included sensitive and confidential information, the applicants suspected that they had been subject to surveillance by the UK intelligence services through the bulk interception of communications under section 8(4) of RIPA, as well as through the TEMPORA regime and the NSA PRISM or UPSTREAM programs. PRISM was a program through which the United States’ Government obtained specific and targeted access to intelligence material (such as communications) from Internet Service Providers. The United States’ administration had stated that the program was regulated under the Foreign Intelligence Service Act, and applications for access to material through PRISM had to be approved by the FISA Court. GCHQ had admitted that it received information that had been collected through the PRISM program. The UPSTREAM program allowed for the collection of content and communications data from fibre-optic cables and infrastructure owned by United States’ content service providers. This program had broad access to global data, in particular that of non-US citizens, which could then be collected, stored and searched using keywords.

Between June and December 2013, each of the ten applicants lodged a complaint before the IPT. On February 14, 2014, the IPT ordered that the ten cases be joined. The applicants complained that (i) the access to and collection of communications and communications data from the US Government under the PRISM and UPSTREAM programs; and (ii) the interception, inspection and retention of their communications under the TEMPORA program (Section 8(4) of the RIPA) violated Articles 8, 10, and 14 of the Convention.

After three decisions of the IPT partly dismissed the applicants’ cases, the applicants filed an application to the European Court of Human Rights arguing that the legal framework governing the interception and collection of communications content and data was incompatible with Articles 8 (right to respect for private life) and 10 (freedom of expression) of the Convention.

Decision Overview

The European Court of Human Rights (Court) considered the complaints under Article 8 (right to respect for private life) and 10 (freedom of expression) of the European Convention on Human Rights (Convention) separately. First, however, the Court considered whether all the applicants exhausted domestic remedies. In this context, the Court accepted that the Investigatory Powers Tribunal (IPT) had not been deemed an effective remedy in previous case law, but it was now willing to hold that it was an effective remedy. In light of its previous case law, the Court determined there were special circumstances absolving the applicants in the first and second cases from the requirement that they first bring their complaints to the IPT.

Article 8 of the Convention

The Court addressed the complaints alleging interferences with Article 8 of the Convention through three regimes: (i) the bulk interception of communications pursuant to Article 8(4) of RIPA; (ii) the intelligence sharing system; and (iii) the regime for the acquisition of communications data under Chapter II of RIPA.

Section 8(4) regime

In its assessment, the Court expressly recognized that national authorities enjoyed a broad margin of appreciation in defining how to achieve the legitimate aim of protecting national security. The Court then went on to state that a bulk interception regime was not automatically outside the national margin of appreciation. The Court then went on to look at whether the interference was “in accordance with the law” and in pursuit of a legitimate aim. It observed that it was not disputed by the parties that the Section 8(4) regime had a basis in domestic law and that it pursued the legitimate aim of protecting the interests of national security, territorial integrity and public safety, and preventing disorder and crime.

The Court applied a set of factors that were relevant to determining whether the regime had sufficient safeguards to protect individuals against abuses of power: accessibility; the scope of application of secret surveillance measures; the exemption of related communications data from the safeguards applicable to the searching and examining of content; duration of the secret surveillance measure; procedure to be followed for storing, accessing, examining and using the intercepted data; procedure to be followed for communicating the intercepted data to other parties; the circumstances in which intercepted material must be erased or destroyed; supervision, notification and remedies; proportionality.

The Court dismissed the applicants’ argument that three more factors should be added to this list requiring (i) objective evidence of reasonable suspicion in relation to the persons for whom data was being sought, (ii) prior independent judicial authorization of interception warrants, and (iii) the subsequent notifications of the surveillance subject. The Court reasoned that bulk interception was not, in itself, a violation of Article 8 of the Convention. If there was a requirement for “reasonable suspicion” before data was sought, then this would render bulk interception impossible (since then the inception would be targeted). Similarly, the requirement of “subsequent notification” assumed the existence of clearly defined surveillance targets, which was simply not the case in a bulk interception regime. The Court conceded that prior judicial authorization was the best practice but would not be sufficient in and of itself. Therefore, the Court would, instead, have regard to the actual operation of the system of interception, including the checks and balances on the exercise of power and the existence or absence of any evidence of actual abuse.

Applying the factors above, the Court concluded that section 8(4) of RIPA was sufficiently clear, giving citizens an adequate indication of the circumstances in which and the conditions on which a warrant might be issued. The Court also noted that the authorization procedure was subject to independent oversight and the IPT had extensive jurisdiction to examine any complaint of unlawful interception. The Court accepted that the provisions on the duration and renewal of interception warrants, the provisions relating to the storing, accessing, examining and using intercepted data, the provisions on the procedure to be followed for communicating the intercepted data to other parties and the provisions on the erasure and destruction of intercept material were sufficiently clear as to provide adequate safeguards against abuse.

With regard to the selection of communications for examination, once communications had been intercepted and filtered, those not discarded in near real-time were further searched; in the first instance by the automatic application, by computer, of simple selectors (such as email addresses or telephone numbers) and initial search criteria, and subsequently by the use of complex searches. Selectors and search criteria did not need to be made public; nor did they necessarily need to be listed in the warrant ordering interception. Nevertheless, the search criteria and selectors used to filter intercepted communications should be subject to independent oversight; a safeguard which appeared to be absent in the section 8(4) regime. In practice the only independent oversight of the process of filtering and selecting intercept data for examination was the post factum audit by the Interception of Communications Commissioner and, should an application be made to it, the IPT. In a bulk interception regime, where the discretion to intercept was not significantly curtailed by the terms of the warrant, the safeguards applicable at the filtering and selecting for examination stage had to necessarily be more robust.

The Court did, however, identify two main concerns with the system of bulk surveillance. First, the Court observed that there was a lack of independent oversight over the process for selecting communications for examination (e.g. the selection of bearers for interception, the selectors and search criteria for filtering intercepted communications, and the selection of material for examination by an analyst). Under the section 8(4) regime, once communications had been intercepted and filtered, those not discarded in near real-time were further searched; in the first instance by the automatic application, by computer, of simple selectors (such as email addresses or telephone numbers) and initial search criteria, and subsequently by the use of complex searches. The Court held that the search criteria and selectors used to filter intercepted communications should be subject to independent oversight, but this was not provided under section 8(4) of RIPA. The Court reasoned that bulk interception regimes that gave discretion to intercept that was not significantly curtailed by the terms of a warrant, required more robust safeguards at the filtering and selecting for examination stage. The second concern was the absence of any real safeguards applicable to the selection of related communications data for examination. In the light of these considerations, the Court found a violation of Article 8 of the Convention since the Section 8(4) regime did not meet the “quality of law” requirement and the regime could not be found to be “necessary in a democratic society”.

The intelligence sharing regime

The Court first observed that this was the first time that it was considering the compliance of an intelligence sharing regime with the Convention. The Court further clarified that, in this case, the alleged interference consisted of the receipt, storage, examination and use of intercepted materials by the UK authorities (rather than the UK authorities being responsible for the interception itself). The Court considered the following factors when examining the regime to ensure it had sufficient safeguards against abuses of power: accessibility; the circumstances in which intercept material can be requested; the procedure to be followed for storing, accessing, examining and using the material obtained; procedure to be followed for communicating the material obtained to other parties; the circumstances in which the material obtained must be erased or destroyed; supervision and remedies; proportionality. The Court warned that such a regime must be circumscribed sufficiently to prevent – insofar as possible – states from using the power to request intercepted material from/interception by foreign intelligence agencies in order to circumvent either domestic law or their Convention obligations.

The Court considered that the domestic law was clear since it indicated precisely the procedure according to which national authorities could ask foreign intelligence agencies to intercept or convey intercepted material. Since there was no evidence of any significant shortcomings in the regime, the Court found no violation of Article 8 of the Convention.

Chapter II regime

Only the applicants in the second of the joined cases complained that the regime for the acquisition of communications data under Chapter II of RIPA was incompatible with their rights under Article 8 of the Convention. In this case, the Court verified whether the Chapter II regime was in accordance with the law; in pursuit of a legitimate aim; and necessary in a democratic society. The Court took looked, in particular, at whether the regime provided adequate safeguards against arbitrariness.

The Court observed that the Chapter II regime was based on domestic law. However, the Chapter II regime allowed for access to retained data for the purpose of combating crime (not only serious crime) and was not subject to prior review by a national authority (except where access was sought for the purpose of determining a journalist’s source). As a result, this approach was not “in accordance with law”. The Court, therefore, found a violation of Article 8 of the Convention.

Article 10 of the Convention

The applicants in the third of the joined cases complained that the Section 8(4) regime and the intelligence sharing regime violated Article 10 of the Convention. In particular, the NGO applicants argued that the protection afforded by Article 10 of the Convention was crucial since they were involved in matters of public interest and exercised a similar “public watchdog” role as the press. The other applicants, as journalists and news organizations, supported the same point. The complaint concerning the intelligence sharing regime was held inadmissible because an argument that this regime violated Article 10 of the Convention was not raised before the IPT.

The Court began by stressing that the protection of journalistic sources was one of the cornerstones of freedom of the press. Without such protection, sources may be deterred from assisting the press in informing the public about matters of public interest. As a result, the vital “public watchdog” role of the press may be undermined, and the ability of the press to provide accurate and reliable information may be adversely affected.

Section 8(4) regime

Relying on its reasoning regarding Article 8, the Court considered that the Section 8(4) regime was in accordance with the law except for the above-mentioned concerns that were examined under the Article 8 complaint. Furthermore, this regime pursued the legitimate aims of protecting the interests of national security, territorial integrity and public safety, and preventing disorder and crime.

Moving to the requirement of “necessity in a democratic society”, the Court clarified that the aim of the surveillance measures in question was not the monitoring of journalists or the uncovering journalistic sources. As a result, the bulk interception, in itself, could not be considered a serious interference with the right to freedom of expression. However, the interference was more serious when intercepted communications were selected for examination. In such cases, selection would only be “justified by an overriding requirement in the public interest” if accompanied by sufficient safeguards relating both to the circumstances in which they might be selected intentionally for examination, and to the protection of confidentiality where they had been selected, either intentionally or otherwise, for examination. The Court was particularly concerned that there were no requirements either circumscribing the intelligence services’ power to search for confidential journalistic or other material (for example, by using a journalist’s email address as a selector), or requiring analysts, in selecting material for examination, to give any particular consideration to whether such material was or might be involved. Domestic law only provided that consideration should be given to the interception of communications involving confidential journalistic material when a warrant is being considered for the interception but not in the case of bulk surveillance. The court found that the regime violated Article 10 of the Convention.

The Chapter II regime

As already recognized in the assessment under Article 10 of the Convention, the Court concluded that the Chapter II regime was not in accordance with the law. The Court acknowledged that the Chapter II regime afforded enhanced protection where the data was sought for the purpose of identifying a journalist’s source. However, the Court noted that these provisions did not provide enhanced protection to intrusions on other forms of journalistic communications. Furthermore, in cases concerning access to a journalist’s communications data, the Court noted there were no special provisions restricting access for the purpose of combating “serious crime”. The Court found the regime to be in violation of Article 10 of the Convention.

Partly concurring, partly dissenting opinion of Judge Koskelo, joined by Judge Turković

In her concurring and dissenting opinion, Judge Koskelo agreed with the conclusion of the majority on most points. However, she disagreed with the conclusion of the majority regarding the intelligence sharing regime, finding a violation of Article 8 of the Convention.

According to Judge Koskelo, it was necessary to take into consideration the new environment where digital technologies constituted a “sea change” for society and also for surveillance systems. In particular, Judge Koskelo questioned the approach according to which prior independent control by a judicial authority should not be a necessary requirement in the system of safeguards.

Joint partly dissenting and partly concurring opinion of judges Pardalos and Eicke

Judges Pardalos and Eicke disagreed with the conclusion of the Court according to which the Section 8(4) regime failed to meet the “quality of law” requirement and was not “necessary in a democratic society”. They reasoned that the regime provided adequate and sufficient guarantees against arbitrariness and the risk of abuse. As a result, Judges Pardalos and Eicke did not recognize a violation of Article 8 of the Convention in this regard.