The European Court of Human Rights has ruled in the case of Big Brother Watch and Others v. the United Kingdom (application nos. 58170/13, 62322/14 and 24969/15). The case arose in the context of disclosures made by Edward Snowden.
The Court held unanimously, that there had been a violation of Article 8 of the European Convention on Human Rights (right to respect for private and family life/communications) in respect of the bulk intercept regime. It also held unanimously that there had been a violation of Article 8 in respect of the regime for obtaining communications data from communication service providers.
It also held by 12 votes to five, that there had been no violation of Article 8 in respect of the UK’s regime for requesting intercepted material from foreign governments and intelligence agencies. However, it held unanimously, that there had been a violation of Article 10 (freedom of expression), concerning both the bulk interception regime and the regime for obtaining communications data from communication service providers.
In addition, it held by 12 votes to five, that there had been no violation of Article 10 in respect of the regime for requesting intercepted material from foreign governments and intelligence agencies.
The case concerned complaints by journalists and human-rights organisations regarding three different surveillance regimes:
- the bulk interception of communications;
- the receipt of intercept material from foreign governments and intelligence agencies; and
- the obtaining of communications data from communication service providers.
At the relevant time, the regime for bulk interception and obtaining communications data from communication service providers was provided for by the Regulation of Investigatory Powers Act 2000. This has since been replaced by the Investigatory Powers Act 2016. The judgment relates solely to the provisions of the 2000 Act, which had been the legal framework in force at the time the events complained of had taken place.
The Court considered that, owing to the multitude of threats states face in modern society, operating a bulk interception regime did not in and of itself violate the Convention. However, such a regime had to be subject to “end-to-end safeguards”. This means at the domestic level:
- that an assessment should be made at each stage of the process of the necessity and proportionality of the measures being taken;
- that bulk interception should be subject to independent authorisation at the outset, when the object and scope of the operation were being defined; and
- that the operation should be subject to supervision and independent ex post facto review.
With regard to the bulk interception regime operated in the UK, the Court identified the following deficiencies:
- bulk interception had been authorised by the Secretary of State, and not by a body independent of the executive;
- categories of search terms defining the kinds of communications that would become liable for examination had not been included in the application for a warrant; and
- search terms linked to an individual (specific identifiers such as an email address) had not been subject to prior internal authorisation.
The Court also found that the bulk interception regime had breached Article 10, as it had not contained enough protection for confidential journalistic material. The regime for obtaining communications data from communication service providers was also found to have violated Articles 8 and 10 as it had not been in accordance with the law.
However, the Court held that the regime by which the UK could request intelligence from foreign governments and/or intelligence agencies had had sufficient safeguards in place to protect against abuse and to ensure that UK authorities had not used such requests as a means of circumventing their duties under domestic law and the Convention.
