On 25 May the Grand Chamber of the European Court of Human Rights, (ECtHR) ruled that the UK’s surveillance regime of bulk interception of online communications violated the European Convention on Human Rights (Convention) in the case of Big Brother Watch v United Kingdom. According to the ECtHR this regime breached the rights to privacy and freedom of expression enshrined within Article 8 and 10 of the Convention, a ruling that will have significant implications for state surveillance across Europe.
The privacy campaign group “Big Brother Watch”, along with other advocacy groups first initiated the case against the UK in 2013 following Edward Snowden’s whistleblowing revelations. The core complaint in the claim focused on the interception regime previously operated by the British spy agency Government Communications Headquarters (GCHQ) and facilitated by the Regulation of Investigatory Powers Act 2000 (RIPA). The Investigatory Powers Act 2016 has since replaced this regime.
In 2018, the lower court of the ECtHR had given judgment on the surveillance regime, stating that the regime for obtaining data did breach provisions of the Convention. However, that court had also ruled that the regime for obtaining foreign material from other governments did comply with the Convention. Following this, the applicants requested that the case be referred to the Grand Chamber.
The present case concerned complaints by journalists and human rights organisations with regard to three different surveillance regimes: (1) the bulk interception of communications; (2) the receipt of intercept material from foreign governments and intelligence agencies; and (3) the obtaining of communications data from communication service providers.
The Grand Chamber found that bulk interception under the RIPA regime violated the rights contained in Article 8 and Article 10, and endangered individual’s privacy and journalistic confidentiality. The Grand Chamber prefaced the judgment by stating that owing to the multitude of threats States face in modern society, operating a bulk interception regime did not in and of itself violate the Convention. However, such interception had to be subject to “end-to-end safeguards”, which would include, among other things, a necessity and proportionality assessment of the measure, independent authorisation and continuous supervision. These safeguards would be even more crucial where “strong selectors” were present, i.e. categories of a search term which could be linked to an identifiable individual.
Applying this, the ECtHR found that the bulk interception regime did not meet some of the required safeguards. Concerning the right of privacy under Article 8 of the Convention, there had been no independent authorisation for a bulk warrant, no internal authorisation for linking search terms to an individual and a failure to include categories of search terms in a warrant.
The ECtHR also held that elements of regime had violated Article 10, freedom of expression, as it had not contained sufficient protections for confidential journalistic material. There had been no requirement for authorisation by an independent body for the use of selectors or search terms connected to a journalist and insufficient safeguards to ensure that confidential journalistic material inadvertently obtained could only be stored and examined if authorised by a judge or an independent body.
The ECtHR agreed with the previous judgment with regards to obtaining communications data from service providers that there had been a violation of Article 8 on account of the fact that the operation of the regime had not been “in accordance with the law”.
The Grand Chamber found that the system for sharing intelligence with foreign governments under RIPA did have sufficient safeguards in place. This regime had clear detailed rules in place to ensure that the UK did not circumvent their duties under international and Convention law and had a system of ex post facto reviews.
This decision may now pave the way for a challenge of the replacement regime under the Investigatory Powers Act 2016 in the UK courts by the UK NGO “Liberty” – which had been stayed pending this decision.
However, broader ramifications may lie in the approach adopted by the ECtHR. The focus on particular oversight mechanisms such as independent authorisation may potentially change how governments approach surveillance and could foster a greater focus on implementing safeguards to curb any possible breaches in interception regimes. However, the view of the ECtHR that bulk interception regimes are more necessary due to changes in technology and that certain safeguards can appropriately mitigate these regimes may indicate a more deferential approach and an acceptance of such mass surveillance generally as a tool of modern government.