Case Summary and Outcome

The UK’s Investigatory Powers Tribunal (IPT) declared that regulations governing access by the U.K. intelligence agency (GCHQ) to emails and phone records intercepted by the U.S. National Security Agency breached Articles 8 and 10 of the European Convention. The decision refines an earlier ruling from December 2014, when the IPT found that the legal framework governing data collection through the internet by intelligence agencies did not violate human rights. The IPT did not find the British GCHQ bulk interception programmes unlawful. However, it ruled that the secret intelligence-sharing arrangements between Britain and the U.S. (PRISM and Upstream) did not comply with human rights standards for seven years, as the internal rules and safeguards intended to ensure privacy had themselves been kept secret. Only the public disclosure of those rules in December 2014 brought the intelligence-sharing regime into compliance with human rights law and Article 8 of the European Convention. Before this disclosure, the programs in question contravened human rights. Nonetheless, the IPT also concluded that the updated arrangements currently comply with human rights laws

Facts

The Investigatory Powers Tribunal (IPT) is a unique court in the United Kingdom, established in 2000 to adjudicate issues related to surveillance conducted by public bodies. This court was granted jurisdiction pursuant to the Regulation of Investigatory Powers Act 2000 (RIPA), replacing three separate courts that previously handled similar matters.

In 2013, numerous human rights and privacy interest groups filed a suit against the United Kingdom’s Government Communications Headquarters (GCHQ). Since the claims involved common questions of fact and law, the IPT consolidated the cases brought by plaintiffs, which included the ACLU, Amnesty International, and the named plaintiff, the National Council of Civil Liberties (Liberty).

The suit involved two surveillance programs: Prism, an information-collection and monitoring scheme run by the U.S. National Security Agency (NSA), and Upstream, also referred to as Tempora. Prism was described as a system that “collects foreign intelligence” from “internet communications,” and Upstream is substantially similar. The litigation followed Edward Snowden’s public leak regarding surveillance activities conducted by national security agencies.

After numerous filings, as well as both public and private hearings before the IPT, the tribunal issued a detailed Approved Judgment on December 5, 2014. The IPT concluded unequivocally that “there is no contravention” of international human rights law regarding the collection and retention of electronic communications by security agencies. However, the decision was limited to collection and retention conducted after the programs had been disclosed. The Judgment left open the question of whether breaches had occurred “prior thereto.” The IPT then invited further submissions to determine “whether there has, in fact, been any unlawful interception or treatment of the Claimants’ communications.”

The parties further briefed this issue, and the IPT subsequently issued a second Judgment on February 6, 2015.

Decision Overview

The Approved Judgment dated February 6, 2015, essentially “picked up” where the December 2014 judgment left off. In the earlier judgment, the IPT somewhat confusingly stated that as long as the security agencies implemented “a procedure” for handling requests by the U.S. government to intercept foreign communications, then the systems themselves and their data-gathering methods would be lawful. The one “exception” to this lawful information gathering would be if surveillance occurred without proper procedures and safeguards in place. The supplemental February 2015 Judgment thus analyzed two issues: First, whether Prism and Upstream, before public disclosure, violated the European Convention on Human Rights (ECHR) due to non-disclosure alone, and second, whether the actual administration of the programs violated the ECHR.

Addressing the first issue, the IPT ruled that the failure to disclose these programs to the public did, in fact, violate the ECHR. Specifically, “without the disclosures made, there would not have been adequate signposting, as [the IPT] ha[s] found was required.” Thus, although soliciting, receiving, storing, and transmitting information from the GCHQ to U.S. agencies would have violated international human rights, now that adequate procedures were in place, the illegal surveillance was effectively moot.

The second issue was implicitly resolved in the IPT’s discussion of the first issue. However, the tribunal clarified that while adequate procedures for considering foreign information requests made by the U.S. government existed after the December 2014 Judgment, such procedures were not in place prior to that time. Although no such statutory request had ever been made, and thus no technical violation of law occurred in this regard, the matter was, again, moot, because if such a request were ever made, the law would now provide satisfactory guidelines for handling it. The IPT additionally dismissed the Claimants’ concerns on this issue, as they could not prove that any alleged human rights privacy violation had ever actually been applied to them.

On June 22, 2015, the Tribunal issued a decision addressing two remaining issues following the Judgments of December 2014 and February 2015. The first issue was whether there had been any soliciting, receiving, storing, or transmitting of private information obtained by the U.S. government by the U.K. government in violation of Articles in the European Convention on Human Rights. The second issue was whether communications had been intercepted in violation of Articles 8 and 10 of the ECHR. After referencing several case decisions, the Tribunal found no rulings in favor of Liberty, Privacy International, organizations affiliated with Liberty, the American Civil Liberties Union, the Hungarian Civil Liberties Union, the Irish Council for Civil Liberties, Amnesty International Ltd, or Bytes for All.

However, the Tribunal did find in favor of the Egyptian Initiative for Personal Rights and the Legal Resources Centre. It found that email communications of these organizations were intercepted and examined in violation of the ECHR. As the Tribunal is directed not to disclose information that may be prejudicial to national security, the final decision stated only the essential elements of the Tribunal’s reasoning. The Tribunal did note that it would prepare a closed report for the Prime Minister and would take steps to ensure these breaches did not occur again.