UK’s Bulk interception of communications violated Articles 8 and 10
4 June 2021
In its judgment of 25 May 2021 the Grand Chamber of the European Court of Human Rights found that certain aspects of the UK’s regime governing bulk interception of communications were contrary to Articles 8 and 10 of the Convention.
The case concerned three different interception regimes: bulk interception of communications; the receipt of intercepted material from foreign governments and intelligence agencies; and the obtaining of communications data from communication service providers (“CSPs”). The three applications were introduced by individuals, journalists and human rights organisations following Edward Snowden’s revelations about surveillance programmes operated by the intelligence services of the USA and the UK.
Domestic Legal Framework
At the relevant time, the regime for bulk interception and obtaining communications data from CSPs was based in the Regulation of Investigatory Powers Act 2000 (“RIPA”). The findings of the Grand Chamber relate to that regime, which has since been replaced by the Investigatory Powers Act 2016.
The domestic legal framework is complex and is set out in detail at §§ 61 – 121. For present purposes, it suffices to note that section 8(4) of RIPA allowed the Secretary of State to issue warrants for the “interception of external communications” (§ 72), subject to specific safeguards in sections 15 – 17 (§§ 77-92). These provisions were accompanied by the Interception of Communications Code of Practice (“the IC Code”). Chapter II of RIPA and the accompanying Acquisition of Communications Data Code of Practice governed the process by which certain public authorities could request communications data from CSPs (§§ 117-121). The role of the Investigatory Powers Tribunal (“IPT”) is set out at §§ 122 – 134.
Judgment
Bulk Interception of Communications: Violation of Articles 8 and 10
The Grand Chamber considered bulk interception a “gradual process” in which the degree of interference with individuals’ Article 8 rights increases as it progresses (§ 325). It noted that this process would usually comprise:
(a) the interception and initial retention of communications and related communications data (traffic data belonging to the intercepted communications);
(b) the application of specific selectors to the retained communications/related communications data;
(c) the examination of selected communications/related communications data by analysts; and
(d) the subsequent retention of data and use of the “final product”, including the sharing of data with third parties.
The Court held that while States enjoy a wide margin of appreciation in deciding what type of interception regime is necessary to protect national security, in operating a bulk interception system the margin of appreciation afforded to them will be narrower and a number of safeguards will have to be present (§ 347).
The Grand Chamber held that the safeguards which had previously been identified by the Court in the area of targeted interception regimes had to be adapted to reflect the specific features of a bulk interception regime (§ 348). Bulk interception is generally directed at international communications and used primarily for foreign intelligence gathering (§ 344-345), and it achieves targeting of individuals by the application of strong selectors (such as their email addresses) to communications intercepted in bulk, rather than monitoring their devices (§ 346). The Court therefore held that their previously articulated requirement to clearly define in domestic law the categories of people liable to have their communications intercepted and the nature of offences which might give rise to such an order was not “readily applicable”; nor was the requirement of “reasonable suspicion” (§ 348). The implications this aspect of the judgment are explored further in the Joint Partly Concurring Opinion of Judges Lemmens, Vehabović and Bošnjak (see §§ 17 – 25), and in the Partly Concurring and Partly Dissenting Opinion of Judge Pinto de Albuquerque (see §§ 13 – 23).
Notwithstanding, the Grand Chamber emphasised that domestic law should contain detailed rules on when the authorities may resort to bulk interception measures, the grounds upon which it might be authorised and the circumstances in which an individual’s communications might be intercepted (§ 348). The Court found that the importance of supervision and review was amplified in this context because of the inherent risk of abuse, and because the legitimate need for secrecy meant that States would often not be at liberty to disclose information concerning the operation of a regime (§ 349).
Therefore, the process must be subject to “end-to-end safeguards”, meaning that: an assessment should be made domestically at each stage of the process of the necessity and proportionality of the measures being taken; that bulk interception should be subject to independent (though not necessarily judicial) authorisation at the outset, when the object and scope of the operation are being defined; and that the operation should be subject to supervision and independent ex post facto review. The Court stressed that these are:
fundamental safeguards which will be the cornerstone of any Article 8 compliant bulk interception regime (§ 350).
The use of selectors was held to be one of the most important stages, as the point at which the communications of a particular individual may be targeted by the intelligence services. The Grand Chamber accepted that the inclusion of all selectors in the authorisation may not be feasible in practice; however, it held that the authorisation should at the very least identify the types or categories of selectors to be used. Moreover, enhanced safeguards should be in place when strong selectors linked to identifiable individuals were employed (§§ 354-355).
In assessing the operation of the regime, addressing jointly “in accordance with the law” and “necessity”, the Court examined whether the domestic legal framework clearly defined the following (§§ 361; 368 – 415):
- the grounds on which bulk interception may be authorised;
- the circumstances in which an individual’s communications may be intercepted;
- the procedure to be followed for granting authorisation;
- the procedures to be followed for selecting, examining and using intercept material;
- the precautions to be taken when communicating the material to other parties;
- the limits on the duration of interception, the storage of intercept material and the circumstances in which such material must be erased and destroyed;
- the procedures and modalities for supervision by an independent authority of compliance with the above safeguards and its powers to address non-compliance; and
- the procedures for independent ex post facto review of such compliance and the powers vested in the competent body in addressing instances of non-compliance.
The Grand Chamber found that the absence of any oversight of the categories of selectors at the point of authorisation was a deficiency in the regime. The subsequent control of all individual selectors did not satisfy the requirement for enhanced safeguards for the use of strong selectors linked to identifiable individuals and the need to have in place a process of prior internal authorisation (§ 383).
Overall, there was considerable potential for bulk interception to be abused in a manner adversely affecting the rights of individuals to respect for private life (§ 425). The Section 8(4) regime did not contain sufficient end to end safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse. The IC Commissioner provided independent and effective oversight of the regime, and the IPT offered a robust judicial remedy to anyone suspecting that communications had been intercepted; however, these were not sufficient to counterbalance the shortcomings (§ 425). Accordingly, section 8(4) did not meet the “quality of law” requirement and was incapable of keeping the interference to what was necessary in a democratic society (§ 426).
Further, the additional safeguards in the IC Code, concerning the storage, onward transmission and destruction of confidential journalistic material did not address the weaknesses identified by the Court in its analysis of the regime under Article 8, and Article 10 was also violated (§ 456).
Receipt of intelligence from foreign intelligence services: No violation of Articles 8 or 10
The Court examined the complaint about the receipt of solicited intercept material from the US National Security Agency (“NSA”), but was satisfied that regime for requests had a sufficiently clear and accessible basis in domestic law and there were adequate safeguards in place (§§ 507 – 510). The regime had adequate independent supervision and independent ex post facto review (§§ 511 – 513).
Acquisition of communications data from communications service providers: Violations of Articles 8 and 10
The Court held, unanimously, that there had been a violation of Articles 8 and 10 as the operation of the regime under Chapter II of RIPA had not been “in accordance with the law” (§§ 517 – 528).
Comment
The Grand Chamber was faced with the exceptionally difficult task of striking a balance between legitimate interests pursued by the Contracting States to the Convention and fundamental rights and freedoms protected by Articles 8 and 10, in the context of modern threats against which bulk interception is seen as a very valuable source of protection. The Grand Chamber emphasised that the current, increasingly digital, surveillance has the capacity to have a very wide reach and so safeguards are “pivotal and yet elusive”. Also, when operating in this realm, it held that Contracting States have a “legitimate need for secrecy which means that little if any information about the operation of the scheme will be in the public domain, and such information as is available may be couched in terminology which is obscure and which may vary significantly from one State to the next” (§ 322).
Despite this difficulty, the judgment is rich in its detail and nuanced in its reasoning. Perhaps unsurprisingly, it is also accompanied by strongly argued separate opinions.
The headline may signal a victory for the many privacy NGOs involved; however, the judgment also reaffirms the previous view of the Chamber (see the judgment of 13 December 2018), that bulk interception programmes are not in and of themselves unlawful, nor is prior judicial authorisation required. Further, the Grand Chamber’s manner of adapting its previous case law to the bulk interception context will be a source of on-going debate. The judgment will have important implications for the compatibility of the current surveillance regimes of the UK, and other Contracting States to the Convention, with human rights standards.
Read Further
This blog is run by 
