By Rabiath Juliette Berphine Emmanuel , Consultant for the Culture sector of UNESCO in Congo Brazzaville, University of Kent LLM honors graduate in International Criminal Law and Human Rights Law

 Table of abbreviations

IPT                                 Investigatory Powers Tribunal

ECHR                            European Convention on Human Rights

ECtHR                           European Court of Human Rights

HRA 1998                      Human Rights Act 1998

NS                                  National security

MaS                                Mass surveillance

HR                                  Human rights

RIPA                               Regulation of Investigatory Powers Act 2000

Since the revelations made by former NSA and CIA contractor Edward Snowden in 2013^[1], citizens across the globe have become more aware of the widespread and MaS practices of national authorities and western intelligence agencies, which in the eyes of some represents the end of our privacy and the move towards a society of surveillance^[2]. With recent progresses in information and communication technology, most people nowadays interact through the web and electronic devices^[3], where we access, send and receive information, which can sometimes give very precise clues about our personal lives and identity^[4]. The fact that such information can now be easily accessed by law enforcement agencies^[5] makes it all the more alarming. From a security perspective, while it is true that surveillance practices may serve a legitimate objective, namely with regards to crime control and prevention, they nonetheless pose a serious threat to some of our most fundamental rights, as well as to our ability to exercise them fully.^[6] In light of those challenges, and drawing from recent case law of the IPT, namely the Liberty v GCHQ^[7] case, this article will evaluate whether this court has been successful in its attempt to strike a balance between privacy rights and security interests.

PART I: BETWEEN PRIVACY AND SECURITY: THE HRA 1998 AND ARTICLE 8(2) ECHR

Privacy rights within the UK are mainly protected under the HRA 1998. Following the implementation of the ECHR into its domestic law through this act, Article 8 ECHR became the guiding provision on the protection of the right to private life. Conscious of the emergent need for more security in light of an increase of criminality, the drafters of the HRA 1998 have provided a number of conditions under which privacy rights may be derogated for legitimate purposes, such as national security. As provided by article 8(2) ECHR, in order for an interference with the right to respect of private life to be permitted, such interference must be:

1. “ in accordance with the law”,
2. “necessary in a democratic society” and
3. “in the interests of national security[…]for the prevention of disorder or crime,[…]or for the protection of the rights and freedoms of others.”^[8]

With regards to the first principle, due to the particularly invasive nature of MaS practices, three conditions must be met. First, the interference must not only find its basis in national law, but must also be clear, accessible and foreseeable.^[9] In the case of Kruslin v France, the ECtHR has argued that the inference wasn’t in accordance with the law, given that the conditions governing the interception of phone conversations weren’t sufficiently precise^[10]. In fact, there was no information about the categories of people liable to be placed under judicial surveillance, limits regarding the duration of the surveillance measures in place, nor any indication of the procedures to be taken for the destruction of the data collected ^[11]. With regards to the second and third principles under Article 8(2), a proportionality test must be applied by the court, assessing whether the MaS measures employed are proportionate to the legitimate aim pursued, which here is NS.

A careful analysis of the derogations to the right to private life under the HRA 1998 reveals a real attempt to find a balance between privacy rights on one side, and the security interests of the UK on the other. However, one limit of this document is that while it recognizes NS as a legitimate aim, it fails to provide a clear and precise definition of this concept, thus leaving a wide margin of discretion to the UK in determining the interests that may fall under ‘national security’. This is particularly dangerous as it could indirectly allow the use of this concept for wider purposes, and affect the decisions of courts when assessing the proportionality of MaS measures.

PART II- BETWEEN NS AND HR: THE PROPORTIONALITY TEST AS APPLIED BY THE UK’S IPT THROUGH THE LIBERTY V GCHQ CASE

Procedures for the collection and retention of personal data in the UK are defined under the RIPA 2000.^[12] In addition to Article 8 ECHR, which also encompasses protection to personal data, the RIPA 2000 includes certain provisions on the test of proportionality that must be applied by UK courts in the context of MaS. For instance, s 22(1), (2) and (5) require that “necessity” and “proportionality” be applied to data retention, and s 15(2) contains provisions regarding the safeguards that must be put in place by the Secretary of State when authorizing the interception of communications data. This includes details on persons who can have access to such data, or the extent to which the data collected can be disclosed.^[13] The following lines will analyze how the IPT^[14] has applied the proportionality test under its domestic law, looking more precisely at the case of Liberty v GCHQ,

In the case of Liberty v GCHQ, the IPT was asked to rule on complaints regarding the sharing of data between US and UK intelligence agencies (MI5, MI6 and the GCHQ) through the Prism and Upstream programmes.^[15] This case was brought on by several NGOs^[16], including Liberty and Privacy International who claimed that their private conversations may have been intercepted as a result of these programmes.^[17] In fact, following the Snowden revelations in 2013, it was revealed that the NSA had been clandestinely collecting private communications of british nationals, residing both inside and outside the UK, through its Prism and Upstream intelligence programmes, which both operated under US courts’ supervision^[18] . Through Prism in particular the NSA was able to gather intelligence from electronic communication providers and through TEMPORA, it was able to obtain internet communications as “they transit[ed]” through the web.^[19]

According to the plaintiffs, the activities of UK intelligence agencies in receiving data intercepted by the NSA^[20] weren’t in “accordance with the law”, nor “prescribed by law” as required by Articles 8 and 10 ECHR^[21]. In particular, they argued that there wasn’t enough indication as to how the communications data intercepted by the NSA was accessed, retained nor destroyed by the British intelligence services concerned, and thus no indication that the privacy of the persons whose data was being intercepted was sufficiently protected, as required by Article 8(2) ECHR.

The approach of the IPT in assessing the legality of the transfer of information between US and British authorities has been rather unsatisfactory, as, despite recognising the importance of the ECtHR’s requirement that practices likely to interfere with HR must be “in accordance with the law” ^[22], and thus be sufficiently accessible, foreseeable and subject to proper oversight^[23], its application of the latter in the case of Liberty was quite contradictory.

With regards to the requirement that surveillances practices be sourced in law, the IPT concluded that “appropriate rules or arrangements exist and are publicly known and confirmed to exist’^[24]. The term “arrangement” was particularly vague and less precise than what is required under the Kennedy ruling for surveillance practices to find their basis under domestic law. Additionally, it held that such rules did not not need to be based under statutory laws.

With regards to the requirements of accessibility and foreseeability, which require that laws be sufficiently clear in order to indicate under which conditions national authorities may resort to measures that interfere with privacy rights, the IPT simply held that the rules governing the sharing of data between GCHQ and the NSA needed only to be “sufficiently signposted, such as to give an adequate indication’ of their content”^[25].

With regards to oversight, the tribunal was satisfied that this requirement was met, simply because the intelligence services concerned stated that their surveillance operations were significantly controlled by the Parliament’s Intelligence Security Committee and the Interception of Communications Commissioner.^[26] In this respect, the tribunal argued that the interference with privacy rights under Article 8 was “in accordance with the law” given the presence of oversight, and transparency in terms of the ways in which such oversight was achieved. It stated that there was “adequate indication” of such oversight and the way in which it operated^[27] and held that the IPT itself provided additional oversight due to its powers of investigation under Section 68(6) RIPA^[28]. Therefore, the IPT concluded in its judgment of February 2015 that due to the presence of arrangements and the possibility for oversight, the discretion of the GCHQ had been effectively limited to prevent arbitrary interference from the intelligence agencie.

However, with regards to the requirements of foreseeability and accessibility in particular, it is worth noting that the tribunal argued that prior to the disclosure of the procedures used by the GCHQ and other British intelligence agencies in obtaining data^[29],  this test was not met and the MaS were consequently not “in accordance with the law” as required by Article 8(2) ECHR. While it is evident that this judgment led to more transparency^[30] and prevented the GCHQ to continue acting unlawfully with regards to its collection of private communications, the fact that such disclosures were enough to render “legal” an unlawful interception regime is quite problematic, especially at a time when several British intelligence agencies are under scrutiny for serious interferences on HR protected under the Convention^[31].  This ruling of the IPT thus failed to ensure the accountability of the GCHQ and challenge the very question of the necessity of the its practices, necessary to prevent excessive surveillance measures. The danger that this poses in particular is that rather than challenging the use of MaS, it indirectly gives a green light to surveillance agencies to pursue unrestricted surveillance practices and violate the rights protected under Article 8(1) ECHR, as long as such measures meet the requirements of Article 8(2) ECHR, however low they may be applied. It seems thus that, rather than applying a strict proportionality test with regards to the surveillance practices of the GCHQ, the IPT has subjected the latter to a much watered down test of legality at the detriment of the HR at stake.

As we have seen throughout this essay, in the context of increased criminality, the HRA 1998 has provided a number of conditions under which privacy rights may be derogated for legitimate purposes and surveillance measures justified. However, due to the intrusive nature of MaS practices on privacy rights, such measures have to be proportional to the aims sought and to HR, limited to strict necessity and provide strong safeguards in order to prevent abuse and arbitrary behavior. In its attempt to strike a satisfactory balance between NS and HR through the Liberty v GCHQ case, the IPT has been unsuccessful at doing so. In fact, although this case reveals the commitment of the Tribunal to ensure more transparency in the context of MaS, the standard of probability applied in this case has been rather low, and the court has failed to hold accountable UK’s intelligence agencies and pronounce itself on their use of covert mass intelligence measures.

REFERENCES

UK STATUTE LAW

Human Rights Act 1998

Regulation of Investigatory Powers Act 2000

UK case law

Belhadj & Others v the Security Service [2014] IPT/13/132-9/H

Liberty & Ors v GCHQ [2015] UK IPT 13_77-H

Liberty & Ors v GCHQ [2014] UK IPT 13_77-H

EU case law

KENNEDY v. THE UNITED KINGDOM [2010] European Court of Human Rights

 Kruslin v France [1990] European Court of Human Rights

EU LAW

Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights, as amended)

BIBLIOGRAPHY

UK PUBLICATIONS

‘House Of Lords – Constitution Committee – Minutes Of Evidence’ (Publications.parliament.uk) <https://publications.parliament.uk/pa/ld200809/ldselect/ldconst/18/8020603.htm> accessed 9 July 2020

Websites

Ball J, ‘Edward Snowden NSA Files: Secret Surveillance And Our Revelations So Far’ (the Guardian) <https://www.theguardian.com/world/2013/aug/21/edward-snowden-nsa-files-revelations>

BBC News ‘London Bridge Attack’ (BBC News) <https://www.bbc.co.uk/news/uk-40150689>

1. Kuner, “The Data Retention Judgment, the Irish Facebook Case, and the Future of EU Data Transfer Regulation” (June 19, 2014), http://www.concurringopinions.com/archives/2014/06/the-data-retention-judgment-the-irish-facebook -case-and-the-future-of-eu-data-transfer-regulation.html

CNN, ‘September 11 Terror Attacks Fast Facts’ (CNN, 2020) <https://edition.cnn.com/2013/07/27/us/september-11-anniversary-fast-facts/index.html>

Dans E, ‘Are We Sliding Inevitably Into A Surveillance Society?’ (Medium, 2018) <https://medium.com/enrique-dans/are-we-sliding-inevitably-into-a-surveillance-society-5c847f22fe39>0

Journals

Preuss-Laussinotte S, ‘Bases De Données Personnelles Et Politiques De Sécurité : Une Protection Illusoire ?’ [2006] Cultures & conflits <: http://journals.openedition.org/conflits/2133>

^[1]James Ball, ‘Edward Snowden NSA Files: Secret Surveillance And Our Revelations So Far’ (the Guardian) <https://www.theguardian.com/world/2013/aug/21/edward-snowden-nsa-files-revelations> accessed 2 August 2020.

^[2] Enrique Dans, ‘Are We Sliding Inevitably Into A Surveillance Society?’ (Medium, 2018) <https://medium.com/enrique-dans/are-we-sliding-inevitably-into-a-surveillance-society-5c847f22fe39> accessed 23 August 2020.

^[3] Michael H Ryan, ‘Persona Non Data: How The Courts In The EU, UK And Canada Are Addressing The Issue Of Communications Data Surveillance Vs. Privacy Rights’, Telecommunications Policy Research Conference (2016).

^[4] Ibid

^[5] Ibid

^[6] UNGA Res 68/167. Resolution adopted by the General Assembly on 18 December 2013. The right to privacy in the digital age (A/RES/68/167) 2/3

^[7]Liberty & Ors v GCHQ [2015] UK IPT 13_77-H (6 February 2015)

^[8] ECHR, art 8(2)

^[9] Ibid

^[10] Kruslin v France [1990] ECTHR,para 35

^[11] Ibid

^[12]Regulation of Investigatory Powers Act 2000, s 22.

^[13] Ibid, s 15(2)

^[14] Ibid, s 65. The IPT is a statutory court which hears issues related to human rights violations by intelligence services

^[15] Liberty & Ors v GCHQ [2014] UK IPT 13_77-H  (5 December 2014)

^[16] Including Liberty and Amnesty International

^[17] Liberty & Ors v GCHQ [2014] UK IPT 13_77-H  (5 December 2014) ; Liberty & Ors v GCHQ [2015] UK IPT 13_77-H (6 February 2015)

^[18] Ibid (n15) para 14

^[19] Ibid

^[20] It is also important to note that Under UK law, the interception of communications data necessitates a warrant under RIPA s 8(1) and 8(4).

^[21] ECHR, Art 8 and Art 10

^[22]Ibid (n15) para 37

^[23] KENNEDY v. THE UNITED KINGDOM [2010] ECTHR, para 151.

^[24] Ibid (n15)  para 41

^[25] Ibid, Para 41

^[26] Ibid, paras 42-44

^[27] Ibid paras 37-38,

^[28] Ibid, para 47

^[29] Rendered public in October 2015, Ibid (n 15)

^[30] Which can here be illustrated by the disclosures of the GCHQ, which prior to the proceedings did not provide sufficient signposts indicating the requests for information to foreign intelligence services

^[31] Belhadj & Others v the Security Service [2014] IPT/13/132-9/H