The Investigatory Powers Tribunal and the rule of law – Natasha Simonsen

16 February 2015 by

gchqLiberty & Ors v GCHQ [2015] UKIPTrib 13_77-H (6 February 2015) – read judgment

Despite being hailed as an ‘historic victory in the age-old battle for the right to privacy and free expression’, closer examination of a recent ruling by the Investigatory Powers Tribunal (‘IPT’)  reveals it to have been a hollow victory.

The case arose from the Snowden leaks, which unveiled a vast communications interception program led by the US National Security Agency (‘NSA’). Intercepted communications can include the content of emails as well as ‘metadata’, and can extend to purely internal communications as well as communications with a US connection. For example, an email exchange between Leeds and London may be liable to interception by the NSA simply because it happens to be routed through a US server at some stage along the line. The Regulation of Investigatory Powers Act 2000 (‘RIPA’) establishes a framework for interception of communications by UK authorities, but of course those provisions don’t apply to interceptions by foreign state authorities in their own territory. Once intercepted by the NSA, mutual intelligence sharing arrangements can lead the same Leeds-London email to be handed over to the UK authorities, notwithstanding that the UK authorities would have needed a RIPA warrant had they wished to conduct the interception themselves.

A range of NGOs led by Liberty claimed violations of Articles 8 and 10 of the European Convention on Human Rights by the intelligence services in the reception, use, storage and transmission of such material. Importantly, the Articles 8 and 10 rights to privacy and free expression are not unqualified: they may be limited ‘in accordance with the law’ or as ‘prescribed by law’, and [as] necessary in a democratic society’ pursuant to (inter alia) ‘the interests of national security’. The claimants alleged that the absence of a legal framework for regulating intercepted material of this kind violated the ‘in accordance with law’ requirement in Article 8 and the ‘prescribed by law’ requirement in Article 10.

The ‘prescribed by/in accordance with law’ requirement has been the subject of detailed guidance from the Strasbourg Court in cases such as Malone v UK, Khan v UK, Liberty v UK and Kennedy v UK. The upshot of those cases is that to be considered ‘in accordance with law’ the measures must satisfy three requirements. They are (1) ‘the impugned measure must have some basis in domestic law’; (2) the relevant domestic law must be ‘compatible with the rule of law and accessible to the person concerned’; and (3) ‘the person affected must be able to foresee the consequences of the domestic law for him’: see Kennedy, at [151].

The IPT’s judgment last week in Liberty & Ors v GCHQ substantially watered down those requirements. In place of the first Kennedy requirement, the IPT held it was sufficient that ‘appropriate rules or arrangements exist and are publicly known and confirmed to exist’ [41]. This reference to ‘arrangements’ (emphasis in the original judgment) is significantly vaguer than the requirement in Kennedy for a clear basis in domestic law, and in light of the Tribunal’s finding, it seems it will be satisfied by the mere existence of internal guidelines or policies. In place of the second Kennedy requirement, the IPT held that the content of the rules need only be ‘sufficiently signposted, such as to give an adequate indication’ of their content: [41] (original emphasis). The deletion of the reference to the rule of law in the Kennedy criterion is significant: as is well known, the rule of law is generally taken to require (at least, and inter alia) that laws be clear, prospective, open and stable. How else can laws purport to guide conduct? Finally, in place of the third Kennedy requirement of foreseeability, the IPT held that the ‘arrangements’ need only be ‘subject to proper oversight’: [41]. The existence of an Interception of Communications Commissioner, and of the IPT itself, was of considerable importance in that regard. The rule of law requirements of clarity and openness have been dispensed with, in favour of mere ‘arrangements’ that are ‘publicly known and confirmed to exist’, however ambiguous are the ‘signposts’ as to their content, and however toothless the mechanisms for oversight.

As this comparison with Kennedy shows, the IPT adopted a substantially lower threshold than the Strasbourg Court for what constitutes a measure that is ‘prescribed by law’. And yet, stunningly, even on this low standard, the IPT found a breach. This was the first time since its establishment that the Tribunal has found against the government. However, the breach was historic rather than continuing. This was because in the course of the hearings in December 2014, the intelligence agencies agreed to disclose two paragraphs, presumably from an internal policy document. The two disclosed paragraphs gave ‘an adequate indication’ of the nature and content of the ‘arrangements in place’. Prior to this disclosure, the IPT held that there was insufficient information in the public domain to satisfy the ‘in accordance with/prescribed by law’ requirement in Articles 8 and 10 ECHR.

What, then, did those two decisive paragraphs say? Not as much as one might think, given that the simple fact of this disclosure was, in the Tribunal’s estimation, sufficient to convert an unlawful interception regime into a lawful one. Quoted in full at [47] in the judgment, in essence they provide that requests for ‘unanalysed intercepted communications (and associated communications data)’ are only made by the UK intelligence services in two circumstances. They are:

  1. when a RIPA warrant has been issued but assistance from the foreign government is necessary ‘because [the communications] cannot be obtained under the relevant RIPA interception warrant’; and
  2. when there has been no RIPA warrant, but making a request for the communications to be intercepted by the foreign state would ‘not amount to a deliberate circumvention of RIPA’. In both cases it must be ‘necessary and proportionate for the Intelligence Services to obtain those communications’.

Thus, in the IPT’s view, the ‘prescribed by law’ requirement in Articles 8 and 10 of the European Convention can be satisfied by GCHQ’s disclosure of two paragraphs from an internal policy document; little more than a promise that the agencies will not, and do not, ‘deliberately circumvent RIPA’. This is an extraordinary result, particularly given the recent revelations in the Belhaj case still pending before the IPT to the effect that MI5 and MI6 deliberately intercepted privileged communications between lawyers and clients, in at least one case passing on intercepted communications to the legal team defending the intelligence agencies against Mr Belhaj’s claim. Despite this evidence of past infractions, the IPT was prepared to accept the evidence of the chief of the Office for Security and Counter-Terrorism in Liberty v GCHQ that the duties undertaken by the intelligence services were ‘underpinned…. by a culture of compliance’ [42].

There is no domestic appeal from judgments of the IPT, but the decision will no doubt be appealed to Strasbourg. At a time when the Strasbourg Court is under considerable pressure from a restive UK, it will be interesting to see whether it holds the line it drew in Kennedy, or whether, like the IPT, it will compromise its commitment to the rule of law.

Natasha Simonsen is Lecturer in Law, New College and St Peter’s College, Oxford

Sign up to free human rights updates by email, Facebook, Twitter or RSS

Related posts:




Welcome to the UKHRB

This blog is run by 1 Crown Office Row barristers' chambers. Subscribe for free updates here. The blog's editorial team is:
Commissioning Editor: Jonathan Metzer
Editorial Team: Rosalind English
Angus McCullough QC David Hart QC
Martin Downs
Jim Duffy

Free email updates

Enter your email address to subscribe to this blog for free and receive weekly notifications of new posts by email.




Aarhus Abortion Abu Qatada Abuse Access to justice adoption AI air pollution air travel ALBA Allergy Al Qaeda Amnesty International animal rights Animals Anne Sacoolas anonymity Article 1 Protocol 1 Article 2 article 3 Article 4 article 5 Article 6 Article 8 Article 9 article 10 Article 11 article 13 Article 14 article 263 TFEU Artificial Intelligence Asbestos Assange assisted suicide asylum asylum seekers Australia autism badgers benefits Bill of Rights biotechnology blogging Bloody Sunday brexit Bribery British Waterways Board care homes Catholic Church Catholicism Chagos Islanders Charter of Fundamental Rights child protection Children children's rights China christianity citizenship civil liberties campaigners civil partnerships climate change clinical negligence closed material procedure Coercion Commission on a Bill of Rights common law communications competition confidentiality consent conservation constitution contact order contact tracing contempt of court Control orders Copyright coronavirus coronavirus act 2020 costs costs budgets Court of Protection covid crime criminal law Cybersecurity Damages data protection death penalty defamation DEFRA deportation deprivation of liberty derogations Detention Dignitas diplomacy diplomatic relations disability disclosure Discrimination disease divorce DNA domestic violence duty of care ECHR ECtHR Education election Employment Environment Equality Act Equality Act 2010 Ethiopia EU EU Charter of Fundamental Rights EU costs EU law European Convention on Human Rights European Court of Human Rights European Court of Justice evidence extradition extraordinary rendition Facebook Facial Recognition Family Fatal Accidents Fertility FGM Finance foreign criminals foreign office foreign policy France freedom of assembly Freedom of Expression freedom of information freedom of speech Gay marriage gay rights Gaza Gender genetics Germany Google Grenfell Gun Control hague convention Harry Dunn Health HIV home office Housing HRLA human rights Human Rights Act human rights news Human Rights Watch Huntington's Disease immigration India Indonesia injunction Inquests insurance international law internet inuit Iran Iraq Ireland islam Israel Italy IVF ivory ban Japan joint enterprise judaism judicial review Judicial Review reform Julian Assange jury trial JUSTICE Justice and Security Bill Law Pod UK legal aid legal aid cuts Leveson Inquiry lgbtq liability Libel Liberty Libya lisbon treaty Lithuania local authorities marriage Media and Censorship mental capacity Mental Capacity Act Mental Health military Ministry of Justice modern slavery morocco murder music Muslim nationality national security naturism neuroscience NHS Northern Ireland nuclear challenges nuisance Obituary ouster clauses parental rights parliamentary expenses scandal patents Pensions Personal Injury physician assisted death Piracy Plagiarism planning planning system Poland Police Politics Pope press prison Prisoners prisoner votes Prisons privacy procurement Professional Discipline Property proportionality prosecutions prostituton Protection of Freedoms Bill Protest Public/Private public access public authorities public inquiries quarantine Radicalisation refugee rehabilitation Reith Lectures Religion RightsInfo right to die right to family life Right to Privacy right to swim riots Roma Romania round-up Round Up Royals Russia saudi arabia Scotland secrecy secret justice Secret trials sexual offence shamima begum Sikhism Smoking social media social workers South Africa Spain special advocates Sports Standing starvation statelessness stem cells stop and search Strasbourg super injunctions Supreme Court Supreme Court of Canada surrogacy surveillance sweatshops Syria Tax technology Terrorism The Round Up tort Torture travel treason treaty accession trial by jury TTIP Turkey Twitter UK Ukraine universal credit universal jurisdiction unlawful detention USA US Supreme Court vicarious liability Wales War Crimes Wars Weekly Round-up Welfare Western Sahara Whistleblowing Wikileaks wildlife wind farms WomenInLaw Worboys wrongful birth YearInReview Zimbabwe


This blog is maintained for information purposes only. It is not intended to be a source of legal advice and must not be relied upon as such. Blog posts reflect the views and opinions of their individual authors, not of chambers as a whole.

Our privacy policy can be found on our ‘subscribe’ page or by clicking here.

%d bloggers like this: