On 25 May 2021, the Grand Chamber of the European Court of Human Rights (ECtHR) handed down its judgment in the case Big Brother Watch v United Kingdom (BBW), holding that the UK had breached the European Convention on Human Rights (the Convention) in relation to the regime established for bulk interception of communications data and obtaining this data from communications service providers.
Although the ECtHR clarified that bulk interception as such does not violate the Convention (referring to the variety of complex threats existing in modern society), it held that such interception must be subject to “end-to-end safeguards”. These safeguards should include a necessity and proportionality assessment of interception measures at each stage of the process; an independent authorisation (by a body informed of the purpose of interception, the communication routes to be intercepted and the types or categories of “selectors” to be used on the intercepted data) at the time when object and scope of the operation are being defined; continuous supervision of the process and subsequent independent review.
The ECtHR considered that enhanced safeguards should be in place when “strong selectors” (ie those linked to identifiable individuals) are used by the intelligence services, with use of such selectors to be justified with regard to the principles of necessity and proportionality, recorded and subject to a process of “prior internal authorisation providing for separate and objective verification of whether the justification conforms to” those principles.
In the BBW case, the ECtHR found that aspects of the procedures and practices established under the UK’s former bulk interception regime under the Regulation of Investigatory Powers 2000 (RIPA), since replaced by the Investigatory Powers Act 2016 (IPA), violated the right to respect for private life and family and communications (Article 8 Convention) and right to freedom of expression (Article 10 Convention).
The ECtHR held that the bulk interception regime in place under the RIPA failed to meet certain (though not all) minimum safeguard requirements based on, but broadened beyond, those laid down in previous case law (referring, amongst others, to Weber and Saravia v Germany). It “did not contain sufficient ‘end-to-end’ safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse”. In particular, there was violation of Article 8 of the Convention as there was no prior authorisation of bulk interception by a person independent of the executive; RIPA did not include a requirement to specify categories of selectors in a warrant and there was no “prior internal authorisation” for the use of strong selectors linked to identifiable individuals. Further, Article 10 of the Convention was violated as there was no requirement for authorisation by an independent body for the use of selectors or search terms known to be connected to a journalist (with the body having power to determine if use was “justified by an overriding requirement in the public interest” and whether a less intrusive measure might be sufficient). There were also insufficient safeguards to ensure that confidential journalistic material inadvertently obtained could only be stored and examined if authorised by such an independent body. The ECtHR also held that Articles 8 and 10 of the Convention were violated in respect of acquiring data from communications service providers, as the regime was not “in accordance with the law”.
However, the ECtHR held that the provisions of UK law applying to the regime permitting intelligence agencies to receive covertly intercepted data from foreign governments or their agencies provided a sufficiently stringent and transparent framework such that this regime did not breach either Article 8 or Article 10 rights.
This judgment may have implications for the UK’s current bulk surveillance regime under the IPA, due for the potential for read-across from the findings in relation to RIPA to IPA. Liberty, one of the NGOs that initiated a challenge to the UK’s surveillance regime, is reported as stating that this decision will enable its challenge to the IPA, stayed during the ECtHR case, to proceed in the English courts.
The press release is available here and the judgment is available here.
