The UK intelligence agency GCHQ (Government Communications Headquarters) violated the freedom to privacy through its mass interception of online communications, ruled the grand chamber of the European Court of Human Rights (ECHR). The court also ruled that the regime for data collection was unlawful.
A legal challenge to GCHQ’s mass interception of online communications was launched in 2013, following NSA whistleblower Edward Snowden’s revelations that the spy agency was intercepting, storing, and processing the data from millions of people’s private communications. One of the applicants, a human rights group called Liberty, described Tuesday’s ruling as a “landmark victory.”
The ruling said the data collection was unlawful, a violation of the freedom to privacy, and freedom of expression, and did not contain the protections for journalistic confidentiality. However, the court also ruled that the agency’s decision to operate a mass interception regime did not break the European conventions on human rights. Additionally, the agency’s decision to share the intelligence from the data collection regime was not unlawful.
The ruling stated: “In order to minimize the risk of the bulk interception power being abused, the court considers that the process must be subject to ‘end-to-end safeguards’, meaning that, at the domestic level, an assessment should be made at each stage of the process of the necessity and proportionality of the measures being taken; that bulk interception should be subject to independent authorization at the outset, when the object and scope of the operation are being defined; and that the operation should be subject to supervision and independent ex post facto (retrospective) review.”
The ruling was somewhat similar to a previous one on the same case by a lower court back in 2018. In the previous ruling the judges said that the data collection regime had “fundamental deficiencies.” For instance, it was authorized by a secretary of state, not a body independent of the executive. Also, search terms for an individual, like an email address, had not gone through an internal authorization.
“Bulk surveillance powers allow the state to collect data that can reveal a huge amount about any one of us – from our political views to our sexual orientation. These mass surveillance powers do not make us safer,” said Liberty’s lawyer Megan Goulding.
“Our right to privacy protects all of us. Today’s decision takes us another step closer to scrapping these dangerous, oppressive surveillance powers, and ensuring our rights are protected.”
In 2016, the GCHQ’s mass online interception regime was replaced by the Investigatory Powers Act (IPA), dubbed “snooper’s charter” by critics. Legal challenges to the “snooper’s charter” were stayed pending a ruling by the grand chamber. Liberty is excited its challenge to IPA can now proceed in courts in the UK.
Other applicants applauded the grand chambers ruling, but warned there is still a lot to be done to protect privacy. Even some of the 17 judges in the grand chamber thought the ruling was not enough.
Privacy International’s legal director Ilia Siatista said the ruling was “an important win for privacy and freedom for everyone in the UK and beyond,” but added that, “it is not the end.”
“The court has set out clear criteria for assessing future bulk interception regimes, but we believe these will need to be developed into harder red lines in future judgments, if bulk interception is not to be abused,” said the executive director of Open Rights Group Jim Killock.
On its part, the government used the ruling to boast of its transparency and commitment to the protection of privacy and data.
A government spokesperson said: “The UK has one of the most robust and transparent oversight regimes for the protection of personal data and privacy anywhere in the world. This unprecedented transparency sets a new international benchmark for how the law can protect both privacy and security whilst continuing to respond dynamically to an evolving threat picture.
“The 2016 Investigatory Powers Act has already replaced large parts of the 2000 Regulation of Investigatory Powers Act (RIPA) that was the subject of this challenge. We note today’s judgment.”
