"In the case of Big Brother Watch and Others v. the United Kingdom, the Court found that the British surveillance system entailed a violation of the Convention."
STRASBOURG
13 September 2018
issued by the Registrar of the Court
ECHR 299 (2018)
13.09.2018
Some aspects of UK surveillance regimes violate Convention
The case of Big Brother Watch and Others v. the United Kingdom (applications nos. 58170/13,
62322/14 and 24960/15) concerned complaints by journalists and rights organisations about three
different surveillance regimes: (1) the bulk interception of communications; (2) intelligence sharing
with foreign governments; and (3) the obtaining of communications data from communications
service providers.
Both the bulk interception regime and the regime for obtaining communications data from
communications service providers have a statutory basis in the Regulation of Investigatory Powers
Act 2000. The Investigatory Powers Act 2016, when it comes fully into force, will make significant
changes to both regimes. In considering the applicants’ complaints, the Court had regard to the law
in force at the date of its examination. As the provisions of the IPA which will amend the regimes for
the bulk interception of communications and the obtaining of communications data from
communications service providers were not in force at that time, the Court did not consider them in
its assessment.
In today’s Chamber judgment1
the European Court of Human Rights held, by five votes to two, that:
the bulk interception regime violated Article 8 of the European Convention on Human Rights (right
to respect for private and family life/communications) as there was insufficient oversight both of
the selection of Internet bearers for interception and the filtering, search and selection of
intercepted communications for examination, and the safeguards governing the selection of “related
communications data” for examination were inadequate.
In reaching this conclusion, the Court found that the operation of a bulk interception regime did not
in and of itself violate the Convention, but noted that such a regime had to respect criteria set down
in its case-law.
The Court also held, by six votes to one, that:
the regime for obtaining communications data from communications service providers violated
Article 8 as it was not in accordance with the law; and
that both the bulk interception regime and the regime for obtaining communications data from
communications service providers violated Article 10 of the Convention as there were insufficient
safeguards in respect of confidential journalistic material.
It further found that the regime for sharing intelligence with foreign governments did not violate
either Article 8 or Article 10.
The Court unanimously rejected complaints made by the third set of applicants under Article 6
(right to a fair trial), about the domestic procedure for challenging secret surveillance measures, and
under Article 14 (prohibition of discrimination).
For an FAQ on the judgment please click here.
1. Under Articles 43 and 44 of the Convention, this Chamber judgment is not final. During the three-month period following its delivery,
any party may request that the case be referred to the Grand Chamber of the Court. If such a request is made, a panel of five judges
considers whether the case deserves further examination. In that event, the Grand Chamber will hear the case and deliver a final
judgment. If the referral request is refused, the Chamber judgment will become final on that day.
Once a judgment becomes final, it is transmitted to the Committee of Ministers of the Council of Europe for supervision of its execution.
Further information about the execution process can be found here: www.coe.int/t/dghl/monitoring/execution.
2
Principal facts
The three joined applications are Big Brother Watch and Others v. the United Kingdom (no.
58170/13); Bureau of Investigative Journalism and Alice Ross v. the United Kingdom (no. 62322/14);
and 10 Human Rights Organisations and Others v. the United Kingdom (no. 24960/15). The 16
applicants are organisations and individuals who are either journalists or are active in campaigning
on civil liberties issues.
The applications were lodged after Edward Snowden, a former US National Security Agency (NSA)
contractor, revealed the existence of surveillance and intelligence sharing programmes operated by
the intelligence services of the United States and the United Kingdom.
The applicants believed that the nature of their activities meant that their electronic
communications and/or communications data were likely to have been intercepted or obtained by
the UK intelligence services.
Complaints, procedure and composition of the Court
Relying on Article 8 (right to respect for private and family life and correspondence), the applicants
complained about the regimes for the bulk interception of communications, intelligence sharing and
for the acquisition of data from communications service providers.
The second and third applications also raised complaints under Article 10 (freedom of expression)
related to their work, respectively, as journalists and non-governmental organisations.
The third application relied in addition on Article 6 (right to a fair trial), in relation to the domestic
procedure for challenging surveillance measures, and on Article 14 (prohibition of discrimination),
combined with Articles 8 and 10, alleging the regime for the bulk interception of communications
discriminated against people outside the United Kingdom, whose communications were more likely
to be intercepted and, if intercepted, selected for examination.
The applications were lodged on 4 September 2013, 11 September 2014 and 20 May 2015
respectively. They were communicated to the Government on 9 January 2014, 5 January 2015 and
24 November 2015, together with questions from the Court. Various third parties were allowed to
intervene in the proceedings and a public hearing was held in November 2017.
Judgment was given by a Chamber of seven judges, composed as follows:
Linos-Alexandre Sicilianos (Greece), President,
Kristina Pardalos (San Marino),
Aleš Pejchal (the Czech Republic),
Ksenija Turković (Croatia),
Armen Harutyunyan (Armenia),
Pauliine Koskelo (Finland),
Tim Eicke (the United Kingdom),
and also Abel Campos, Section Registrar.
Decision of the Court
Admissibility
The Court first considered whether the first and second set of applicants had exhausted domestic
remedies, part of the process of admissibility, as they had not raised their complaints with the
Investigatory Powers Tribunal, a special body charged with examining allegations of wrongful
interference with communications by the security services.
3
It found that while the IPT has shown itself to be an effective remedy which applicants had to use, at
the time these two sets of applicants lodged their applications with this Court there existed special
circumstances absolving them from that requirement and they could not be faulted for relying on
the Court’s 2010 judgment in Kennedy v. the United Kingdom as authority for the proposition that
the IPT was not an effective remedy for a complaint about the general Convention compliance of a
surveillance regime.
Article 8
Interception process under section 8(4) of RIPA
The Court noted that the bulk interception of communications was regulated by section 8(4) of the
Regulation of Investigatory Powers Act (RIPA) 2000.
Operating a bulk interception scheme was not per se in violation of the Convention and
Governments had wide discretion (“a wide margin of appreciation”) in deciding what kind of
surveillance scheme was necessary to protect national security. However, the operation of such
systems had to meet six basic requirements, as set out in Weber and Saravia v. Germany. The Court
rejected a request by the applicants to update the Weber requirements, which they had said was
necessary owing to advances in technology.
The Court then noted that there were four stages of an operation under section 8(4): the
interception of communications being transmitted across selected Internet bearers; the using of
selectors to filter and discard – in near real time – those intercepted communications that had little
or no intelligence value; the application of searches to the remaining intercepted communications;
and the examination of some or all of the retained material by an analyst.
While the Court was satisfied that the intelligence services of the United Kingdom take their
Convention obligations seriously and are not abusing their powers, it found that there was
inadequate independent oversight of the selection and search processes involved in the operation,
in particular when it came to selecting the Internet bearers for interception and choosing the
selectors and search criteria used to filter and select intercepted communications for examination.
Furthermore, there were no real safeguards applicable to the selection of related communications
data for examination, even though this data could reveal a great deal about a person’s habits and
contacts.
Such failings meant section 8(4) did not meet the “quality of law” requirement of the Convention
and could not keep any interference to that which was “necessary in a democratic society”. There
had therefore been a violation of Article 8 of the Convention.
Acquisition of data from communications service providers under Chapter II of RIPA
The Court noted that the second set of applicants had complained that Chapter II of RIPA allowed a
wide range of public bodies to request access to communications data from communications
companies in various ill-defined circumstances.
It first rejected a Government argument that the applicants’ application was inadmissible, finding
that as investigative journalists their communications could have been targeted by the procedures in
question. It then went on to focus on the Convention concept that any interference with rights had
to be “in accordance with the law”.
It noted that European Union law required that any regime allowing access to data held by
communications service providers had to be limited to the purpose of combating “serious crime”,
and that access be subject to prior review by a court or independent administrative body. As the EU
legal order is integrated into that of the UK and has primacy where there is a conflict with domestic
law, the Government had conceded in a recent domestic case that a very similar scheme introduced
by the Investigatory Powers Act 2016 was incompatible with fundamental rights in EU law because it
4
did not include these safeguards. Following this concession, the High Court ordered the Government
to amend the relevant provisions of the Act. The Court therefore found that as the Chapter II regime
also lacked these safeguards, it was not in accordance with domestic law as interpreted by the
domestic authorities in light of EU law. As such, there had been a violation of Article 8.
Intelligence sharing procedures
The Court found that the procedure for requesting either the interception or the conveyance of
intercept material from foreign intelligence agencies was set out with sufficient clarity in the
domestic law and relevant code of practice. In particular, material from foreign agencies could only
be searched if all the requirements for searching material obtained by the UK security services were
fulfilled. The Court further observed that there was no evidence of any significant shortcomings in
the application and operation of the regime, or indeed evidence of any abuse.
The intelligence sharing regime therefore did not violate Article 8.
Article 10
The Court declared complaints by the third set of applicants under this provision to be inadmissible
but found a violation of the rights of the second set of applicants, who had complained that the bulk
surveillance regimes under section 8(4) and Chapter II of RIPA did not provide sufficient protection
for journalistic sources or confidential journalistic material.
In respect of the bulk interception regime, the Court expressed particular concern about the absence
of any published safeguards relating both to the circumstances in which confidential journalistic
material could be selected intentionally for examination, and to the protection of confidentiality
where it had been selected, either intentionally or otherwise, for examination. In view of the
potential chilling effect that any perceived interference with the confidentiality of journalists’
communications and, in particular, their sources might have on the freedom of the press, the Court
found that the bulk interception regime was also in violation of Article 10.
When it came to requests for data from communications service providers under Chapter II, the
Court noted that the relevant safeguards only applied when the purpose of such a request was to
uncover the identity of a journalist’s source. They did not apply in every case where there was a
request for a journalist’s communications data, or where collateral intrusion was likely. In addition,
there were no special provisions restricting access to the purpose of combating “serious crime”. As a
consequence, the Court also found a violation of Article 10 in respect of the Chapter II regime.
Article 6
The third set of applicants complained that the IPT lacked independence and impartiality. However,
the Court noted that the IPT had extensive power to consider complaints concerning wrongful
interference with communications, and those extensive powers had been employed in the
applicants’ case to ensure the fairness of the proceedings. Most notably, the IPT had access to open
and closed material and it had appointed Counsel to the Tribunal to make submissions on behalf of
the applicants in the closed proceedings. Furthermore, the Court accepted that in order to ensure
the efficacy of the secret surveillance regime, which was an important tool in the fight against
terrorism and serious crime, the restrictions on the applicants’ procedural rights had been both
necessary and proportionate and had not impaired the essence of their Article 6 rights.
Overall, the applicants’ complaint was manifestly ill-founded and had to be rejected.
Other Articles
The third set of applicants complained under Article 14, in conjunction with Articles 8 and 10, that
those outside the United Kingdom were disproportionately likely to have their communications
intercepted as the law only provided additional safeguards to people known to be in Britain.
5
The Court rejected this complaint as manifestly ill-founded. The applicants had not substantiated
their argument that people outside the UK were more likely to have their communications
intercepted. In addition, any possible difference in treatment was not due to nationality but to
geographic location, and was justified.
Just satisfaction (Article 41)
The applicants did not claim any award in respect of pecuniary or non-pecuniary damage and the
Court saw no reason to make one. However, it made partial awards in respect of the costs and
expenses claimed by the applicants in the first and second of the joined cases. The applicants in the
third joined case made no claim for costs and expenses.
Separate opinions
Judges Pardalos and Eicke expressed a joint partly dissenting and partly concurring opinion, and
Judge Koskelo, joined by Judge Turković, expressed a partly concurring, partly dissenting opinion.
These opinions are annexed to the judgment.
The judgment is available only in English.
This press release is a document produced by the Registry. It does not bind the Court. Decisions,
judgments and further information about the Court can be found on www.echr.coe.int. To receive
the Court’s press releases, please subscribe here: www.echr.coe.int/RSS/en or follow us on Twitter
@ECHRpress.
Press contacts
echrpress@echr.coe.int | tel.: +33 3 90 21 42 08
Patrick Lannin (tel: + 33 3 90 21 44 18)
Tracey Turner-Tretz (tel: + 33 3 88 41 35 30)
Denis Lambert (tel: + 33 3 90 21 41 09)
Inci Ertekin (tel: + 33 3 90 21 55 30)
Somi Nikol (tel: + 33 3 90 21 64 25)
The European Court of Human Rights was set up in Strasbourg by the Council of Europe Member
States in 1959 to deal with alleged violations of the 1950 European Convention on Human Rights.
This judgment will become final in the circumstances set out in Article 44 § 2 of the Convention. It may be subject to editorial revision.
TABLE OF CONTENTS
I. THE CIRCUMSTANCES OF THE CASE
B. The secret surveillance schemes
1. Government Communications Headquarters (“GCHQ”)
2. The United States’ National Security Agency (“NSA”)
C. Domestic proceedings in the first and second of the joined cases
D. Domestic proceedings in the third of the joined cases
2. The IPT’s first judgment of 5 December 2014
3. The IPT’s second judgment of 6 February 2015
4. The IPT’s third judgment of 22 June 2015 as amended by its 1 July 2015 letter
II. RELEVANT DOMESTIC LAW AND PRACTICE
A. The interception of communications
3. Specific safeguards under RIPA
4. The Interception of Communications Code of Practice
1. British-US Communication Intelligence Agreement
2. Relevant statutory framework for the operation of the intelligence services
(d) Counter-Terrorism Act 2008
(e) The Data Protection Act 1998 (“DPA”)
(f) The Official Secrets Act 1989 (“OSA”)
(g) The Human Rights Act 1998 (“HRA”)
3. The Interception of Communications Code of Practice
C. Acquisition of communications data
2. The Acquisition and Disclosure of Communications Data: Code of Practice
4. The Police and Criminal Evidence Act 1984
2. The Investigatory Powers Tribunal Rules 2000 (“the Rules”)
3. IPT ruling on preliminary issues of law
F. Reviews of interception operations by the intelligence service
2. Privacy and security: a modern and transparent legal framework
4. A Democratic Licence to Operate: Report of the Independent Surveillance Review (“ISR”)
5. Report of the Bulk Powers Review
7. Annual Report of the Interception of Communications Commissioner for 2016
(b) Acquisition of communications data under Chapter II of RIPA
G. The Investigatory Powers Act 2016
(a) Resolution no. 68/167 on The Right to Privacy in the Digital Age
(b) The Constitution of the International Telecommunication Union 1992
(c) The 2006 Annual Report of the International Law Commission
(d) The 2001 (Budapest) Convention on Cybercrime
1. Charter of Fundamental Rights of the European Union
Article 7 – Respect for private and family life
Article 8 – Protection of personal data
Article 11 – Freedom of expression and information
2. EU directives and regulations relating to protection and processing of personal data
3. Relevant case-law of the Court of Justice of the European Union (“CJEU”)
I. EXHAUSTION OF DOMESTIC REMEDIES
B. The submissions of the third party
2. Application of those principles to the case at hand
II. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION
(b) The submissions of the third parties
(iv) The Helsinki Foundation for Human Rights (“HFHR”)
(v) The International Commission of Jurists (“ICJ”)
(vi) Open Society Justice Initiative (“OSJI”)
(viii) The Law Society of England and Wales
(ii) Existing case-law on the bulk interception of communications
(iii) The test to be applied in the present case
B. The intelligence sharing regime
(b) The submissions of the third parties
(i) The Electronic Privacy Information Center (“EPIC”)
(iv) Center for Democracy and Technology (“CDT”) and Pen American Center (“PEN America”)
(v) The International Commission of Jurists (“ICJ”)
(vi) Open Society Justice Initiative (“OSJI”)
(vii) The Law Society of England and Wales
(viii) Human Rights Watch (“HRW”)
(i) The scope of the applicants’ complaints
(ii) The nature of the interference
(iv) Application of the test to material falling into the second category
(v) Application of the test to material falling into the third category
(i) Existing case-law on the acquisition of communications data
(ii) The approach to be taken in the present case
(iii) Examination of the Chapter II regime
III. ALLEGED VIOLATION OF ARTICLE 10 OF THE CONVENTION
1. The applicants in the third of the joined cases
2. The applicants in the second of the joined cases
2. The submissions of the third parties
(a) The Helsinki Foundation for Human Rights
(c) The Media Lawyers’ Association (“MLA”)
(b) The application of the general principles to the present case
IV. ALLEGED VIOLATION OF ARTICLE 6 OF THE CONVENTION
VI. APPLICATION OF ARTICLE 41 OF THE CONVENTION
PARTLY CONCURRING, PARTLY DISSENTING OPINION OF JUDGE KOSKELO, JOINED BY JUDGE TURKOVIĆ
I. The RIPA section 8(4) regime
(i) The context of earlier case-law
(ii) The context of the present case
II. The intelligence-sharing regime
JOINT PARTLY DISSENTING AND PARTLY CONCURRING OPINION OF JUDGES PARDALOS AND EICKE
decisione
1. Declares, unanimously, the complaints made by the applicants in the third of the joined cases concerning Article 6, Article 10, insofar as the applicants rely on their status as NGOs, and Article 14 inadmissible;
2. Declares, unanimously, the remainder of the complaints made by the applicants in the third of the joined cases admissible;
3. Declares, by a majority, the complaints made by the applicants in the first and second of the joined cases admissible;
4. Holds, by five votes to two, that there has been a violation of Article 8 of the Convention in respect of the section 8(4) regime;
5. Holds, by six votes to one, that there has been a violation of Article 8 of the Convention in respect of the Chapter II regime,
6. Holds, by five votes to two, that there has been no violation of Article 8 of the Convention in respect of the intelligence sharing regime;
7. Holds, by six votes to one, that, insofar as it was raised by the applicants in the second of the joined cases, there has been a violation of Article 10 of the Convention in respect of the section 8(4) regime and the Chapter II regime;
8. Holds, unanimously, that there is no need to examine the remaining complaints made by the applicants in the third of the joined cases under Article 10 of the Convention;
9. Holds, by six votes to one,
(a) that the respondent State is to pay the applicants, within three months from the date on which the judgment becomes final in accordance with Article 44 § 2 of the Convention, the following amounts, to be converted into the currency of the respondent State at the rate applicable at the date of settlement:
(i) to the applicants in the first of the joined cases: EUR 150,000 (one hundred and fifty thousand euros), plus any tax that may be chargeable to the applicants, in respect of costs and expenses;
(ii) to the applicants in the second of the joined cases: EUR 35,000 (thirty-five thousand euros), plus any tax that may be chargeable to the applicants, in respect of costs and expenses;
(b) that from the expiry of the above-mentioned three months until settlement simple interest shall be payable on the above amounts at a rate equal to the marginal lending rate of the European Central Bank during the default period plus three percentage points; and
10. Dismisses, unanimously, the remainder of the applicants’ claim for just satisfaction.
Done in English, and notified in writing on 13 September 2018, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.
Abel CamposLinos-Alexandre Sicilianos
RegistrarPresident
In accordance with Article 45 § 2 of the Convention and Rule 74 § 2 of the Rules of Court, the following separate opinions are annexed to this judgment:
(a) partly concurring, partly dissenting opinion of Judge Koskelo, joined by Judge Turković; and
(b) joint partly dissenting and partly concurring opinion of Judges Pardalos and Eicke.
L.-A.S.
A.C.
List of Applicants
App. No. |
Applicants |
Big Brother Watch |
|
English PEN |
|
Open Rights Group |
|
Dr Constanze Kurz |
|
Bureau of Investigative Journalism |
|
Alice Ross |
|
Amnesty International Limited |
|
Bytes For All |
|
The National Council for Civil Liberties (“Liberty”) |
|
Privacy International |
|
The American Civil Liberties Union |
|
The Canadian Civil Liberties Association |
|
The Egyptian Initiative For Personal Rights |
|
The Hungarian Civil Liberties Union |
|
The Irish Council For Civil Liberties Limited |
|
The Legal Resources Centre |
PARTLY CONCURRING, PARTLY DISSENTING OPINION OF JUDGE KOSKELO, JOINED BY JUDGE TURKOVIĆ
1. I have voted, and agree, with the majority as regards points 1 to 3 of the operative provisions of the judgment, which concern the admissibility of the complaints. I have also joined the majority in finding a violation of Article 8 in respect of both the section 8(4) regime and the Chapter II regime. As regards the section 8(4) regime, however, I am not able in all respects to subscribe to the reasons given by the majority. As far as the intelligence sharing regime is concerned, unlike the majority, I have voted for finding a violation of Article 8.
I. The RIPA section 8(4) regime
2. The present case concerns legislation providing for secret surveillance, by means of bulk interception, of electronic communications which qualify as “external” (for an understanding of the concept of “external” communications see paragraphs 69-71 of the judgment). It is important to note that this type of secret surveillance of communications is not limited to certain already known or identified targets but is aimed at the discovery of threats and hitherto unknown or unidentified targets which might be responsible for threats (see paragraph 284 of the judgment). The relevant threats are broadly framed and comprise threats to national security or to the economic well-being of the country as well as threats arising from serious crime (see §§ 57-59).
3. It is obvious that such an activity – an untargeted surveillance of external communications with a view to discovering and exploring a wide range of threats – by its very nature takes on a potentially vast scope, and involves enormous risks of abuse. The safeguards against those risks, and the standards which under the Convention should apply in this regard, therefore raise questions of the highest importance. I am not convinced, in the light of present-day circumstances, that reliance on the Court’s existing case-law provides an adequate approach to the kind of surveillance regimes like the one we are dealing with here. A more thorough reconsideration would be called for. I acknowledge that this would be a task for the Court’s Grand Chamber. I will only raise some concerns which, in my view, require attention in this regard.
(i) The context of earlier case-law
4. Apart from the recent Chamber judgment in Centrum för Rättvisa v. Sweden (no. 35252/08, 19 June 2018), which is not yet final, the Court’s case-law has not dealt with the present kind of surveillance but with regimes which, as a matter of either law or fact, have been narrower in scope. Furthermore, in the light of current developments, I consider that reliance on the line of existing case-law is no longer an adequate basis for assessing the standards which under the Convention should govern this particular domain.
5. The Court’s case-law on secret surveillance of communications essentially dates back to Klass and Others v. Germany (cited in the judgment) which was decided by the Plenary Court four decades ago, and the admissibility decision in Weber and Saravia v. Germany (also cited in the judgment), which concerned an amended version of the same German legislation and was decided twelve years ago, in response to a complaint lodged in the year 2000.
6. As the Court noted in Klass and Others, the German legislation then at issue (the G 10) laid down a series of limitative conditions which had to be satisfied before a surveillance measure could be imposed. Thus, the permissible restrictive measures were confined to cases in which there were factual indications for suspecting a person of planning, committing or having committed certain serious criminal acts; measures could only be ordered if the establishment of the facts by another method was without any prospect of success or considerably more difficult; even then, the surveillance could cover only the specific suspect or his presumed “contact-persons”. Thus, the Court observed, “so-called exploratory or general surveillance [was] not permitted by the contested legislation” (see Klass and Others, § 51).
7. In this regard, the RIPA section 8(4) regime which is at issue in the present case is different from that in Klass and Others in that the section 8(4) regime does encompass what the Court then referred to as “exploratory” surveillance and which in fact constitutes an essential and critical feature of this particular regime. Consequently, the scope and purpose of the surveillance regime now at issue is wider than that addressed in Klass and Others.
8. In Weber and Saravia, the complaint concerned a revised version, adopted in 1994, of the German G 10, whereby the scope of permissible surveillance was extended to cover the monitoring of international wireless telecommunications (see Weber and Saravia, § 88) in order to allow a “strategic surveillance” of such communications by means of catchwords. According to the Government’s submissions in that case, at the relevant time merely some ten per cent of all telecommunications were conducted by wireless means, and thus potentially subject to monitoring. In practice, monitoring was restricted to a limited number of foreign countries. The telephone connections of the State’s own (i.e. German) nationals living abroad could not be monitored directly. The identity of persons telecommunicating could only be uncovered in rare cases in which a catchword had been used (ibid., § 110).
9. The surveillance regime at issue in Weber and Saravia covered international wireless communications traffic, i.e. traffic transmitted via microwave or satellite, the latter operating through a survey of the downlink to Germany. Line-bound international communications were not subject to monitoring except where the risk of a war of aggression was concerned.
10. It is noteworthy that at the time of the surveillance regime which gave rise to the complaint in Weber and Saravia, strategic monitoring was mainly carried out on telephone, telex and fax communications. In those days, surveillance did not extend to email communications (see the judgment of the Federal Constitutional Court of 14 July 1999, 1BvR 2226/94, 1 BvR 2420/95, 1 BvR 2437/95, Rn 230, according to which, at the time of the hearing of the case in 1999, an expansion of strategic monitoring to email communications was only being planned for the future). One significant feature of communications by email, apart from the fact that nowadays they are so common, is that the identity of both the sender and recipient is usually directly available. Furthermore, many currently used means of communication or access to information through the Internet were only at embryonic stages at the time of the domestic complaint in Weber and Saravia.
(ii) The context of the present case
11. My point with the remarks above is to draw attention to the factual environment against the background of which those earlier cases were adjudicated, and the dramatic changes that have occurred since. The applicants have indeed referred to the technological “sea change” which has taken place.
12. What is important to note in this regard is that the technological “sea change” has had a twofold impact. On the one hand, technological developments have advanced the means by which surveillance of communications can be carried out. On the other hand, new technologies have revolutionised the ways in which people communicate, access, use and share information. That change is deeper than just a matter of volume. The digital age has in some respects transformed people’s lifestyles.
13. As a result of these changes, the potential exposure nowadays of a vast range of communications and other online activities to secret surveillance is far greater than before. In the wake of such developments, the potential risks of abuse arising from such surveillance have increased as well. Thus, the factual context in which “exploratory” or “strategic” secret surveillance operates is dramatically different from the circumstances that still prevailed a couple of decades ago, when the Weber and Saraviaapplication was lodged, let alone four decades ago, when Klass and Others was decided. In the light of such changes, it is problematic and troubling to approach the question of the necessary safeguards against abuse simply by applying standards that were considered sufficient under significantly or even essentially different factual circumstances.
14. Furthermore, the “sea change” in terms of technologies and digitalised lifestyles is not the only development to be taken into consideration. The threats on account of which surveillance of communications is considered necessary have also changed. In this regard, too, the picture is twofold. One the one hand, for instance, there have been real and well-known aggravations in the risks of international terrorism. On the other, there is also increasing evidence of how various threats can be invoked, rightly or wrongly, in order to justify measures that entail restrictions on individual rights and freedoms. The notion of terrorism, for instance, may sometimes be used quite loosely and opportunistically in a desire to legitimise interferences with such rights and freedoms. Especially where secret surveillance is conducted in order to discover and explore broadly formulated threats such as those to national security or the nation’s economic well-being, the need for real safeguards through independent control and review is obvious.
15. There is yet another “sea change” calling for heightened attention in the assessment of the necessary standards in the context of secret surveillance of communications. It is the degradation of respect for democratic standards and the rule of law of which there is increasing evidence in a number of States. While I am not suggesting that the present respondent State is a case in point in this regard, the Convention standards must nevertheless be considered in the light of the fact that such developments testify to the actual or potential fragility of safeguards, institutional arrangements and the underlying assumptions that in ideal circumstances might appear adequate in order to minimise the risks of abuse. In fact, the same threats that are invoked to justify secret surveillance may also serve to reinforce tendencies toward a weakening of the checks and balances which underpin adherence to the rule of law and democratic governance.
16. In line with the majority, I agree that the Contracting States must enjoy a wide margin of appreciation in determining whether the protection of national security requires the kind of surveillance of communications which is at issue in the present case (paragraph 314 of the present judgment). However, given the high risks of abuse, which at worst may undermine not only individual rights and freedoms but democracy and the rule of law more generally, the margin must be narrow when it comes to the necessary safeguards against abuse.
17. Under the impugned legislation, one of the striking features is that all of the supervisory powers entrusted to authorities with independence from the executive are of an ex post nature. Another striking feature is that not only are the general protective aims of the legislation very broadly framed, but also the specific authorisations (warrants and certificates) issued by the Secretary of State appear to be formulated in very broad and general terms (see paragraphs 156 and 342). Furthermore, the concrete search and selection criteria which are applied to filter intercepted communications for reading of their content are determined by the analysts conducting the surveillance (see paragraphs 157, 340 and 345-46 of the present judgment). As indicated by the domestic findings, the latter are not even subject to any meaningful subsequent oversight by independent bodies (see paragraphs 157 and 340).
18. Ever since Klass and Others, the Court has indeed held that in view of the risk that a system of secret surveillance for the protection of national security may undermine or even destroy democracy under the cloak of defending it, the Court must be satisfied that there exist adequate and effective guarantees against abuse (see Klass and Others, §§ 49-50). This assessment depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law (ibid., § 50).
19. As discussed above, in the light of the changes in both the nature and scope of surveillance and in the prevailing factual realities, the circumstances have indeed evolved in such a way and to such an extent that I find it difficult to accept that the adequacy of safeguards should nevertheless be assessed simply by relying on the case-law that has arisen under different legal and factual framework conditions.
20. In particular, given the present overall context, I question the approach according to which prior independent control by a judicial authority should not be a necessary requirement in the system of safeguards.
21. Already in Klass and Others, when considering the initial stage of control, the Court stated that, in a field where abuse was potentially so easy in individual cases and could have such harmful consequences for democratic society as a whole, it was in principle desirable to entrust supervisory control to a judge (see Klass and Others, § 56). Under the G 10 legislation, judicial control was replaced by an initial control effected by an official qualified for judicial office and by the control provided by the Parliamentary Board and the G 10 Commission. In that case the Court concluded that, having regard to the nature of the supervisory and other safeguards provided for by the G 10, the exclusion of judicial control did not exceed the limits of what might be deemed necessary in a democratic society. The Court noted that the Parliamentary Board and the G 10 Commission were independent of the authorities carrying out the surveillance and vested with sufficient powers and competence to exercise an effective and continuous control. Furthermore, the democratic character was reflected in the balanced membership of the Parliamentary Board, on which the opposition was represented and was thus able to participate in the control of the measures ordered by the competent Minister, who was accountable to the Bundestag. The Court found that the two supervisory bodies could, in the circumstances of the case, be regarded as enjoying sufficient independence to give an objective ruling (ibid.).
22. As indicated above, in my view the legal and factual circumstances of that case, which go back four decades, cannot be considered comparable to the situation now under consideration. It is somewhat striking that in Weber, despite the important changes in the legislative and factual framework, the Court succinctly stated that it saw no reason to reconsider the conclusion in Klass and Others (see Weber and Saravia, § 117). In any event, in the light of the circumstances prevailing at the present time, such reconsideration seems to me to be indispensable.
23. Where, as in the present case, the interception (as a matter of technical necessity) encompasses vast volumes of communications traffic in an indiscriminate manner, without being linked to any kind of prior elements of suspicion related to the threats by reason of which the surveillance is conducted, everything in terms of the protection of individuals and their rights depends on whether and how the subsequent stages of the treatment of the intercepted communications provide effective and reliable safeguards for those rights, and against any abuse of the surveillance. Under such circumstances, given the potential intrusiveness of the surveillance and the abundant risks of abuse, I consider that it cannot be appropriate that all the ex ante safeguards remain in the hands of the executive. I think the applicants are right to argue that there is a need for an “updating” of the standards as regards prior independent judicial authorisation. It seems to me to be important that the authorities of the executive branch should be required to explain and justify before an independent judicial authority the grounds on which a particular surveillance should be authorised, and to account for the search criteria on the basis of which the intercepted communications will be filtered and selected for a review of their content.
24. In this respect, I am not convinced by the arguments advanced by the majority in support of the position that prior judicial control is unnecessary (paragraphs 318-20). The majority acknowledge that judicial authorisation is not inherently incompatible with the effective functioning of bulk interception (paragraph 318). Indeed, the recent case of Centrum för Rättvisa v. Sweden (cited above) offers an illustration, as it deals with Swedish legislation under which prior judicial authorisation is required.
25. The main argument against imposing such a requirement appears to be that it would not entail a sufficient safeguard, and that even in the absence of prior judicial authorisation the existence of independent oversight by the IPT and the Interception of Communications Commissioner provide adequate safeguards against abuse. In my view, it is obvious that prior judicial authorisation cannot in itself be sufficient and that further, robust safeguards such as those in place in the UK are indeed required. However, the fact that a given safeguard would not be sufficient is not enough to support a conclusion that it should not be considered necessary. In my opinion, it is quite essential to have in place an adequate system of safeguards, including controls exercised by independent bodies, both ex ante and ex post.
26. While the safeguards ex post that are provided for in the UK legislation and practice appear to set a good model in this domain, this does not in my view suffice to remedy the fact that the authorisation and implementation of the surveillance are wholly in the hands of the executive authorities, without any independent control ex ante. In this respect, the system of safeguards is even weaker than that considered by the Court in both Klass and Others and Weber and Saravia, in that under the German G 10 regime, although the surveillance was not subject to prior authorisation by a court, it had to be authorised by the G 10 Commission (see Weber and Saravia, cited above, § 115), which was not an executive branch body (ibid., § 25). Moreover, according to the judgment of the Federal Constitutional Court of 14 July 1999 (cited above, Rn 87), a list of search concepts was part of each restriction order, whereas in the present case it has transpired that the search and selection criteria are determined by the analysts operating the surveillance and are not subject to any prior supervision, nor any meaningful subsequent oversight (see paragraphs 157, 340 and 345-46 of the present judgment).
27. In sum, what we have before us now is a regime of secret surveillance, the reach of which under the prevailing factual circumstances is unprecedented, and under which a very wide operational latitude is left to the services operating the surveillance, without any independent ex ante control or constraint, and under which the search and selection criteria are not even ex post subject to any robust independent control. I find such a situation highly problematic. An independent ex ante control is all the more important because of the secret nature of the surveillance, which in practice reduces the possibility that individuals will have recourse to the safeguards available ex post.
28. I also consider that the remarks made by the majority in paragraph 319 of the judgment are not capable of supporting a conclusion according to which prior independent judicial authorisation should not be required. Rather, the argument that even judicial scrutiny may fail its function serves to underline the crucial importance which attaches to the requirement that such control must have effective guarantees of independence, in order to meet the proper standards of the necessary safeguards.
29. In short, while I agree with the conclusions set out in paragraph 387 of the judgment, I do not consider those shortcomings to be the only ones that justify a finding of a violation of Article 8 in the present case. In particular, taking into account the present legal and factual context, I do not believe that the necessary safeguards in the circumstances of surveillance based on the bulk interception of communications can be sufficient without including an independent ex ante judicial control. The position according to which prior judicial control of authorisations for secret surveillance of communications was a desirable but not a necessary safeguard stems from Klass and Others which, firstly, concerned a more limited surveillance regime than the one now at issue and did not permit “exploratory surveillance” at all, and which, secondly, was decided four decades ago against the backdrop of factual circumstances that in many relevant respects were different from those prevailing today. That position was later, inWeber and Saravia, carried over to a surveillance regime which did have more similarities with the RIPA section 8(4) regime but nevertheless operated in conditions very different from those prevailing in the modern digitalised societies. For the reasons outlined above, that position should, in my view, no longer be maintained by the Court.
II. The intelligence-sharing regime
30. It is easy to agree with the principle that any arrangement under which intelligence from intercepted communications is obtained via foreign intelligence services, whether on the basis of requests to carry out such interception or to convey its results, should not be allowed to entail a circumvention of the safeguards which must be in place for any surveillance by domestic authorities (see paragraphs 216, 423 and 447). Indeed, any other approach would be implausible.
31. On this basis I consider, in sum, that the shortcomings referred to above in the context of the section 8(4) regime also attach to the intelligence-sharing regime (see paragraphs 109 and 428-29). I therefore conclude that the safeguards have not been adequate and that there has been a violation of Article 8 in respect of this regime also.
JOINT PARTLY DISSENTING AND PARTLY CONCURRING OPINION OF JUDGES PARDALOS AND EICKE
1. For the reasons set out in more detail below, we are unfortunately, not able to agree with the majority in relation to two aspects of the judgment in this case; namely
(a) that the applicants in the first and second of the joined cases had shown “special circumstances absolving them from the requirement to exhaust” domestic remedies by first bringing proceedings before the IPT (§§ 266-268 and operative part § 3; “admissibility”); and
(b) that there has been a breach of Article 8 of the Convention in respect of the section 8(4) regime (§ 388 and operative part § 4; “the section 8(4) regime”).
2. In relation to the latter issue our position is reinforced by the contrast between the conclusions reached by the majority in this case and that reached in the judgment in Centrum För Rättvisa v. Sweden, no. 35252/08 (not yet final); a judgment adopted by the Third Section of this Court on 19 June 2018, a mere two weeks before the final deliberations in this case. In that case, the Court concluded, unanimously, that, despite having identified “some areas where there is scope for improvement” (§ 180) and “making an overall assessment and having regard to the margin of appreciation enjoyed by the national authorities in protecting national security” (§ 181), the Swedish system of signals intelligence provided adequate and sufficient guarantees against arbitrariness and the risk of abuse; as a consequence, it was held that the relevant legislation met the “quality of law” requirement, that the “interference” established could be considered as being “necessary in a democratic society” and that the structure and operation of the system were proportionate to the aim sought to be achieved.
3. That said, we agree both with:
(a) the underlying general principles identified by the Court both in this case and in Centrum För Rättvisa to be applied in relation to these aspects of the case; as well as
(b) the conclusion of the majority in this case that, for the reasons given in the judgment, there has been no breach of Article 8 of the Convention in relation to the intelligence sharing regime (§§ 447-448 and operative part § 6) and that there is no need to examine the remaining complaints made by the applicants in the third of the joined cases under Article 10 of the Convention.
4. In relation to the findings that there has been a breach of the Convention in relation to the Chapter II regime (§§ 468 and 500, operative part §§ 5 and 7) as well as the conclusions under Article 41 of the Convention (operative part § 9), one of us (Judge Pardalos) considered that her conclusion on the admissibility of the first and second of the joined cases invariably determined the related substantive issues against the applicants in those cases. By contrast, Judge Eicke considered that, the Court having decided that the first and second cases were, contrary to his view, admissible he was required, as a member of that Court, to go on and decide those cases on the merits by reference to the evidence and pleadings before the Court.
5. As indicated above, we agree with the majority that, for the reasons they give, the IPT is and has been an effective remedy “since Kennedy was decided in 2010” (§ 268); i.e. a remedy which is “available in theory and practice” and “capable of offering redress to applicants complaining of both specific incidences of surveillance and the general Convention compliance of surveillance regimes” (§ 265). Consequently, applicants before this Court will be expected to have exhausted this domestic remedy before the Court has jurisdiction to entertain their application under Article 35 § 1 of the Convention.
6. In addition to the purely legal point that, under Article 35 § 1, the Court “may only deal with the matter after all domestic remedies have been exhausted”, we would underline what the majority says in § 256 about the invaluable assistance derived by the Court, in examining a complaint before it, from the “elucidatory” role played by the domestic courts (in this case the IPT) both generally as well as in the specific context of considering the compliance of a secret surveillance regime with the Convention.
7. For the reasons set out below, however, we disagree with the conclusion reached by the majority (§ 268) that there existed, in this case, “special circumstances” absolving the applicants in the first and second of the joined cases from satisfying this requirement.
8. Firstly, as the majority implicitly accepts (§ 267), the case of Kennedy is clearly distinguishable on its facts from the present case. After all, the applicant in that case had already brought a specific complaint about the section 8(1) regime before the IPT before applying to this Court. Consequently, unlike the applicants in the first and second of these joined cases, Mr Kennedy was not inviting the Court to consider his general complaint entirely in abstracto. Furthermore, in its judgment in that case, the Court considered it “important” that his challenge was (consequently) exclusively a challenge to primary legislation. By contrast, in the present cases the scope of each of the regimes complained of (bulk interception, intelligence sharing and the acquisition of communications data) is significantly broader than that of the section 8(1) regime, and the applicants’ complaints concern not only primary legislation, but the overall legal framework governing those regimes (including the alleged absence of any relevant arrangements or other safeguards). Consideration of the broader legal framework necessarily requires an examination of both RIPA and the relevant Codes of Practice, together with any “below the waterline” arrangements and/or safeguards. In view of the much broader scope of both their complaints and the impugned regimes, none of which had been the subject of any examination by the IPT, it should have been evident to the applicants in the first and second of the joined cases – who were, at all times, represented by experienced counsel – that, unlike Kennedy, this was a case in which the general operation of these regimes required further elucidation, and in which the IPT, on account if its “extensive powers ... to investigate complaints before it and to access confidential information” would have been capable of providing a remedy.
9. There is, therefore, also no basis for any suggestion that our approach seeks, in any way, to overturn or “disapply” the Court’s unanimous ruling in Kennedy. The simple fact is that, in our view, the two are clearly and obviously distinguishable.
10. Secondly, the first applicant, was clearly informed by the Government, in their response to the letter before action of 26 July 2013 (§ 19), that their complaints could be raised in the IPT, a court established specifically to hear allegations by citizens of wrongful interference with their communications as a result of conduct covered by that Act and a court endowed with exclusive jurisdiction to investigate any complaint that a person’s communications have been intercepted and, where interception has occurred, to examine the authority for such interception. This letter was, of course, sent at around the same time as the ten human rights organisations which are the applicants in the third of the joined cases, no doubt recognising the need to have exhausted existing effective domestic remedies before applying to this Court, lodged their complaints before the IPT (June to December 2013; § 21). It was also four years after the UK Supreme Court, in its judgment in R (on the application of A) v B [2009] UKSC 12, had confirmed the exclusive jurisdiction of the IPT and its ability, as demonstrated by its decisions in Kennedy (IPT/01/62 & 77) and The British-Irish Rights Watch and others v Security Service, GCHQ and the SIS (IPT/01/77), to adjust the procedures before it as necessary so as to ensure that disputes before it can be determined justly.
11. Thirdly and in any event, even if, contrary to our view, the applicants in the first and second of the joined cases would have been entitled to rely on Kennedy at the time they lodged their applications with the Court they nevertheless accepted before this Court (§ 241), by reference to the judgment in Campbell and Fell v. the United Kingdom, 28 June 1984, §§ 62-63, Series A no. 80, that in light of any finding by the Court to the effect that the IPT is an effective remedy, they would now be required to go back and exhaust unless it would be unjust to require them to do so. As these applicants’ complaints concern the general operation of the impugned regimes, rather than specific complaints about an interference with their rights under the Convention, they would still be entitled to raise them before the IPT now.
12. Many of the complaints advanced in the first and second of the joined applications (including, in particular, all of those relating to the Chapter II regime, the sharing of non-intercept material with foreign governments and the lack of protection for confidential journalistic material and journalistic sources under the section 8(4) regime) were not addressed in the Liberty proceedings and have not yet been determined by the IPT. Consequently, there is no reason to doubt that if the applicants were now to raise those complaints before the IPT, they would have “a reasonable prospect of success”. In fact, in respect of the Chapter II complaint it may be thought that they would have a more than reasonable prospect of success. After all, as the majority records in § 463 of the judgment, the Government, in response to a challenge brought by Liberty, recently conceded that Part 4 of the IPA (which included a power to issue “retention notices” to telecommunications operators requiring the retention of data) was incompatible with fundamental rights in EU law: R (The National Council for Civil Liberties (Liberty)) v Secretary of State for the Home Department & Anor [2018] EWHC 975 (Admin). As Chapter II of RIPA, like Part 4 of the IPA, permits access to data for the purpose of combating crime (as opposed to “serious crime”), this concession lead the majority to find a violation of Article 8 of the Convention in relation to the Chapter II regime (§ 467) which would suggest that the applicants had a strong basis for challenging, at the domestic level, the compliance of the Chapter II regime with EU law and, indeed, the Convention.
13. The same could not necessarily be said about those complaints raised by the first and/or second of the joined cases which were determined by the IPT in the Liberty proceedings; however, those issues were, of course, also raised by the applicants in the third of the joined cases and would therefore (and in fact have been) considered and determined by the Court on its merits.
14. As a result, and in clear contrast with the ultimate conclusion in Campbell and Fell, there is here therefore no evidence to suggest that “it would be unjust now to find these complaints inadmissible for failure to exhaust domestic remedies” (ibid. at § 63). Consequently, in our view, both the requirements of Article 35 § 5 of the Convention as well as the application of the principle of subsidiarity, in fact, required such a finding.
15. The point made in the judgment about the fundamental importance of the “elucidatory” role of the domestic courts is further underlined by the complaint made in relation to the Chapter II regime. After all, as the judgment records in § 451, in both their application to the Court and their initial observations, the applicants in the second of the joined cases had incorrectly referred to the Chapter II regime as a regime for the interception of communications data; rather than a regime which permits certain public authorities to acquire communications data from Communications Service Providers (“CSPs”). This “fundamental legal misunderstanding” led the Government to submit inter alia that the applicants had put forward no factual basis whatsoever for concluding that their communications were acquired in this way, and that they did not contend that they had been affected, either directly or indirectly, by the regime.
16. As noted above, the Court’s conclusion on the Chapter II regime was, of course, ultimately based on the concession by the Government in R (The National Council for Civil Liberties (Liberty)) v Secretary of State for the Home Department & Anor[2018] EWHC 975 (Admin) which enabled the majority to find that the equivalent language in the Chapter II regime was “not in accordance with the law” within the meaning of Article 8 of the Convention (§ 467). However, had that not been the case, this Court would have been confronted with the task of considering in detail whether the regime’s attendant safeguards were sufficient to satisfy the requirements of the Convention; and that (1) on the basis of a case initially advanced on the basis of a “fundamental legal misunderstanding” about the nature of the regime, (2) without any assistance or findings by the IPT in relation to what the attendant safeguards, both above and below the waterline, in fact were and/or (3) any reasoned conclusion by the IPT as to whether or not they satisfied the requirements of Article 8 (or could be made to satisfy the requirements of Article 8 by means of further disclosure akin to that ordered on 9 October 2014 in the proceedings brought by the applicants in the third of the joined applications). This would plainly have been a wholly undesirable state of affairs.
17. As indicated above, there is much in the judgment of the majority we agree with.
18. Firstly, we agree with the majority (as well as with the unanimous judgment in Centrum För Rättvisa) in relation to the relevant general principles as set out in the judgment. In particular we agree with the affirmation by the majority (as well as the judgment in Centrum För Rättvisa and the report by the Venice Commission) that while the Court has considered prior judicial authorisation to be an important safeguard, and perhaps even “best practice”, it has also repeatedly confirmed that, by itself, such prior judicial authorisation is neither necessary nor sufficient to ensure compliance with Article 8 of the Convention (§ 320).
19. Secondly, we also agree with the majority in identifying as potential shortcomings (or, to use the language in Centrum För Rättvisa “areas where there is scope for improvement”) in the operation of the section 8(4) regime “the lack of oversight of the entire selection process, including the selection of bearers for interception, the selectors and search criteria for filtering intercepted communications, and the selection of material for examination by an analyst; and secondly, the absence of any real safeguards applicable to the selection of related communications data for examination” (§ 387).
20. Finally, we agree with the majority as to the correct approach to be applied when considering whether the system under review satisfied the requirement of being “necessary in a democratic society” under Article 8 § 2 of the Convention, namely that:
“... regard must be had to the actual operation of the system of interception, including the checks and balances on the exercise of power, and the existence or absence of any evidence of actual abuse (see Association for European Integration and Human Rights and Ekimdzhiev, cited above, § 92) (§ 320)
... it must principally have regard to the actual operation of a system of interception as a whole, including the checks and balances on the exercise of power, and the existence (or absence) of any evidence of actual abuse (...), such as the authorising of secret surveillance measures haphazardly, irregularly or without due and proper consideration (see Roman Zakharov, cited above, § 267) (§ 377).”
21. Where we disagree is (again) in the application of that approach to the system under review.
22. Before setting out in little more detail the basis for our disagreement we note in passing that this Court’s underlying approach appears to be in clear contrast to the approach taken by the CJEU in Digital Rights Ireland v. Minister for Communications, Marine and Natural Resources and Others and Settinger and Others (Cases C-293/12 and C-594/12) and Secretary of State for the Home Department v. Watson and Others (C-698/15). In the former case, the CJEU was considering the validity of the Data Retention Directive, and in the latter, the validity of domestic legislation containing the same provisions as that directive. While its focus was on the retention of data by CSPs, it also considered the question of access to retained data by the national authorities. In doing so, it indicated that access should be limited to what was strictly necessary for the objective pursued and, where that objective was fighting crime, it should be restricted to fighting serious crime. It further suggested that access should be subject to prior review by a court or independent administrative authority, and that there should be a requirement that the data concerned be retained within the European Union. Therefore, while there is some similarity in the language used by the two courts, the CJEU appears to have adopted a more prescriptive approach as regards the safeguards it considers necessary. This may be due to the fact that in both cases it was considering the rights guaranteed by reference to Articles 7 (Respect for private and family life) and 8 (Protection of personal data) of the Charter of Fundamental Rights. However, while in Watson the CJEU declined to state whether the protection provided by Articles 7 and 8 of the Charter was wider than that afforded by Article 8 of the Convention, we can but note that, on the one hand, Article 52 § 3 of the Charter of Fundamental Rights, while recognising the ability of EU law providing more extensive protection, is clearly expressed by reference to “rights” guaranteed by the Convention (rather than “Articles”) corresponding to “rights” contained in the Charter and that, on the other hand, this Court has, at least since the 1978 judgment of the Plenary Court in Klass and Others v. Germany, Series A no. 28, consistently protected the right to the protection of personal data under Article 8 of the Convention. In any event, in Ben Faiza v. France, no. 31446/12, 8 February 2018, which was decided one year after Watson, and four years after Digital Rights Ireland, this Court did not follow the CJEU’s approach, preferring instead to follow its well-established approach and to review the impugned regime as a whole in order to evaluate the adequacy of the available safeguards.
23. In any event, applying this Court’s well-established approach, it is in our view, clear from the (in the context of secret surveillance cases unusually) extensive and detailed (publicly available) evidence in relation to the operation of the section 8(4) regime (summarised over some 35 pages in the judgment) that, despite the identified areas where there is scope for improvement, these are not, in themselves, sufficiently significant to justify the conclusion that “the section 8(4) regime does not meet the ‘quality of law’ requirement and is incapable of keeping the ‘interference’ to what is ‘necessary in a democratic society’” (§ 388). On the contrary, adopting the approach of this Court in Centrum För Rättvisa, § 181, it is clear in our view that, making an overall assessment and having regard to the margin of appreciation enjoyed by the national authorities in protecting national security, the section 8(4) regime does provide adequate and sufficient guarantees against arbitrariness and the risk of abuse. As a result, we concluded that the relevant legislation meets the “quality of law” requirement and the “interference” established can be considered as being “necessary in a democratic society” and that there was, therefore, no violation of Article 8 of the Convention.
24. In this context, the contrast to the judgment in Centrum För Rättvisa is instructive. After all, in that case the Court applied the same general principles to the Swedish bulk interception regime and concluded, unanimously, that there was no breach of Article 8 of the Convention. Conscious of the difficulty – at times – in making detailed meaningful comparisons between different interception regimes, it is nevertheless noteworthy that the regime under consideration in that case, while equipped with judicial prior authorisation:
(a) was completely shrouded in secrecy with the Court having little meaningful information at all either about the actual generic operation of the system (including the actual operation of the Foreign Intelligence Court (“FIC”) itself) or the impact of the system on and/or operation of safeguards in relation to any individual;
(b) provided that, in principle, the FIC should hold public hearings but found that there has never been a public hearing, all decisions are confidential and no information is disclosed to the public about the number of hearings, the number of permits granted or rejected, the reasoning of the court’s decisions or the amount or type of search terms being used. While the FIC is assisted by the “privacy protection representative” whose role it is to protect the “interests of the general public” he or she does not appear on behalf of or represent the interests of any affected individual. Furthermore, the privacy protection representative cannot appeal against a decision by the FIC or “report any perceived irregularities to the supervisory bodies”;
(c) was concerned with interception by the National Defence Radio Establishment (“FRA”) on behalf of, and which, therefore, required communication of the intercept material to, a much wider group “clients” (“the Government, the Government Offices, the Armed Forces and, as from January 2013, the Security Police and the National Operative Department of the Police Authority”);
(d) provided for authorisation of interception for a greater number (eight) of “purposes” (“1) external military threats to the country, 2) conditions for Swedish participation in international peacekeeping or humanitarian missions or threats to the safety of Swedish interests in the performance of such operations, 3) strategic circumstances concerning international terrorism or other serious cross-border crimes that may threaten essential national interests, 4) the development and proliferation of weapons of mass destruction, military equipment and other similar specified products, 5) serious external threats to society’s infrastructure, 6) foreign conflicts with consequences for international security, 7) foreign intelligence operations against Swedish interests, and 8) the actions or intentions of a foreign power that are of substantial importance for Swedish foreign, security or defence policy”);
(e) had similar difficulties to those identified in relation to the UK regime to separate out non-external communications between a sender and receiver within the respective State at the point of collection;
(f) allows for the communication of intercept product not only to other states but also to “international organisations” (not further defined) where that is “not prevented by secrecy and if necessary for the FRA to perform its activities within international defence and security cooperation” and “it is beneficial for the Swedish government or Sweden’s comprehensive defence strategy” and without any provision requiring the third country/international organisation recipient to protect the data with the same or similar safeguards as those applicable internally; and
(g) provided for an obligation to notify the subject of an intercept after the event; an obligation which, however, “had never been used by the FRA, due to secrecy.
25. Considering the accepted difficulty in making a meaningful comparison between two or more distinct interception regime together with the different conclusions reached by this Court at about the same time, in our view, further underlines the importance of the Court adopting an approach of asking whether, taking “an overall assessment and having regard to the margin of appreciation enjoyed by the national authorities in protecting national security” the system adopted provides adequate and sufficient guarantees against arbitrariness and the risk of abuse, even if there may be individual aspects of any system which might be capable of being altered or improved. Such an approach properly reflects the role of the Convention, which is to set down “minimum standards” that can be applied across all Member States. Provided that – following an overall assessment – the Court finds that a system for bulk interception provides adequate and sufficient guarantees against arbitrariness and abuse, in view of the very different regimes in operation in different States, it will not be appropriate for it to be too prescriptive about the way in which those regimes should operate (although it may, as it did both in Centrum För Rättvisa and in this case, identify those aspects of the regime which could be improved upon). Applying this approach to the Court’s supervisory jurisdiction in the present case (as it was in Centrum För Rättvisa), the Court should have given due weight to the fact that the domestic courts and authorities have subjected both the UK system as a whole as well as the individual complaints at issue to detailed and extensive scrutiny by express reference to the Convention standards and this Court’s case law and should have found that there was, here, no breach of Article 8 of the Convention.
26. Since the adoption of this judgment on 3 July 2018, the IPT has handed down yet another judgment in relation to another, unrelated, aspect of the UK’s surveillance regime: Privacy International v Secretary of State for Foreign and Commonwealth Affairs (Rev 1) [2018] UKIPTrib IPT_15_110_CH (23 July 2018). For obvious reasons this judgment was not available for consideration by the Court when it reached its conclusions on the question of exhaustion of domestic remedies (and we have heard no submissions on it). That said, it seems to us that this careful and detailed judgment provides yet further support (if any was necessary) that, in principle, the IPT is an effective remedy for the purposes of Article 35 § 1 of the Convention which applicants will be required to have exhausted before this Court has jurisdiction to entertain their application.
issued by the Registrar of the Court ECHR 299 (2018) 13.09.2018 Some aspects of UK surveillance regimes violate Convention The case of Big Brother Watch and Others v. the United Kingdom (applications nos. 58170/13, 62322/14 and 24960/15) concerned complaints by journalists and rights organisations about three different surveillance regimes: (1) the bulk interception of communications; (2) intelligence sharing with foreign governments; and (3) the obtaining of communications data from communications service providers. Both the bulk interception regime and the regime for obtaining communications data from communications service providers have a statutory basis in the Regulation of Investigatory Powers Act 2000. The Investigatory Powers Act 2016, when it comes fully into force, will make significant changes to both regimes. In considering the applicants’ complaints, the Court had regard to the law in force at the date of its examination. As the provisions of the IPA which will amend the regimes for the bulk interception of communications and the obtaining of communications data from communications service providers were not in force at that time, the Court did not consider them in its assessment. In today’s Chamber judgment1 the European Court of Human Rights held, by five votes to two, that: the bulk interception regime violated Article 8 of the European Convention on Human Rights (right to respect for private and family life/communications) as there was insufficient oversight both of the selection of Internet bearers for interception and the filtering, search and selection of intercepted communications for examination, and the safeguards governing the selection of “related communications data” for examination were inadequate. In reaching this conclusion, the Court found that the operation of a bulk interception regime did not in and of itself violate the Convention, but noted that such a regime had to respect criteria set down in its case-law. The Court also held, by six votes to one, that: the regime for obtaining communications data from communications service providers violated Article 8 as it was not in accordance with the law; and that both the bulk interception regime and the regime for obtaining communications data from communications service providers violated Article 10 of the Convention as there were insufficient safeguards in respect of confidential journalistic material. It further found that the regime for sharing intelligence with foreign governments did not violate either Article 8 or Article 10. The Court unanimously rejected complaints made by the third set of applicants under Article 6 (right to a fair trial), about the domestic procedure for challenging secret surveillance measures, and under Article 14 (prohibition of discrimination). For an FAQ on the judgment please click here. 1. Under Articles 43 and 44 of the Convention, this Chamber judgment is not final. During the three-month period following its delivery, any party may request that the case be referred to the Grand Chamber of the Court. If such a request is made, a panel of five judges considers whether the case deserves further examination. In that event, the Grand Chamber will hear the case and deliver a final judgment. If the referral request is refused, the Chamber judgment will become final on that day. Once a judgment becomes final, it is transmitted to the Committee of Ministers of the Council of Europe for supervision of its execution. Further information about the execution process can be found here: www.coe.int/t/dghl/monitoring/execution. 2 Principal facts The three joined applications are Big Brother Watch and Others v. the United Kingdom (no. 58170/13); Bureau of Investigative Journalism and Alice Ross v. the United Kingdom (no. 62322/14); and 10 Human Rights Organisations and Others v. the United Kingdom (no. 24960/15). The 16 applicants are organisations and individuals who are either journalists or are active in campaigning on civil liberties issues. The applications were lodged after Edward Snowden, a former US National Security Agency (NSA) contractor, revealed the existence of surveillance and intelligence sharing programmes operated by the intelligence services of the United States and the United Kingdom. The applicants believed that the nature of their activities meant that their electronic communications and/or communications data were likely to have been intercepted or obtained by the UK intelligence services. Complaints, procedure and composition of the Court Relying on Article 8 (right to respect for private and family life and correspondence), the applicants complained about the regimes for the bulk interception of communications, intelligence sharing and for the acquisition of data from communications service providers. The second and third applications also raised complaints under Article 10 (freedom of expression) related to their work, respectively, as journalists and non-governmental organisations. The third application relied in addition on Article 6 (right to a fair trial), in relation to the domestic procedure for challenging surveillance measures, and on Article 14 (prohibition of discrimination), combined with Articles 8 and 10, alleging the regime for the bulk interception of communications discriminated against people outside the United Kingdom, whose communications were more likely to be intercepted and, if intercepted, selected for examination. The applications were lodged on 4 September 2013, 11 September 2014 and 20 May 2015 respectively. They were communicated to the Government on 9 January 2014, 5 January 2015 and 24 November 2015, together with questions from the Court. Various third parties were allowed to intervene in the proceedings and a public hearing was held in November 2017. Judgment was given by a Chamber of seven judges, composed as follows: Linos-Alexandre Sicilianos (Greece), President, Kristina Pardalos (San Marino), Aleš Pejchal (the Czech Republic), Ksenija Turković (Croatia), Armen Harutyunyan (Armenia), Pauliine Koskelo (Finland), Tim Eicke (the United Kingdom), and also Abel Campos, Section Registrar. Decision of the Court Admissibility The Court first considered whether the first and second set of applicants had exhausted domestic remedies, part of the process of admissibility, as they had not raised their complaints with the Investigatory Powers Tribunal, a special body charged with examining allegations of wrongful interference with communications by the security services. 3 It found that while the IPT has shown itself to be an effective remedy which applicants had to use, at the time these two sets of applicants lodged their applications with this Court there existed special circumstances absolving them from that requirement and they could not be faulted for relying on the Court’s 2010 judgment in Kennedy v. the United Kingdom as authority for the proposition that the IPT was not an effective remedy for a complaint about the general Convention compliance of a surveillance regime. Article 8 Interception process under section 8(4) of RIPA The Court noted that the bulk interception of communications was regulated by section 8(4) of the Regulation of Investigatory Powers Act (RIPA) 2000. Operating a bulk interception scheme was not per se in violation of the Convention and Governments had wide discretion (“a wide margin of appreciation”) in deciding what kind of surveillance scheme was necessary to protect national security. However, the operation of such systems had to meet six basic requirements, as set out in Weber and Saravia v. Germany. The Court rejected a request by the applicants to update the Weber requirements, which they had said was necessary owing to advances in technology. The Court then noted that there were four stages of an operation under section 8(4): the interception of communications being transmitted across selected Internet bearers; the using of selectors to filter and discard – in near real time – those intercepted communications that had little or no intelligence value; the application of searches to the remaining intercepted communications; and the examination of some or all of the retained material by an analyst. While the Court was satisfied that the intelligence services of the United Kingdom take their Convention obligations seriously and are not abusing their powers, it found that there was inadequate independent oversight of the selection and search processes involved in the operation, in particular when it came to selecting the Internet bearers for interception and choosing the selectors and search criteria used to filter and select intercepted communications for examination. Furthermore, there were no real safeguards applicable to the selection of related communications data for examination, even though this data could reveal a great deal about a person’s habits and contacts. Such failings meant section 8(4) did not meet the “quality of law” requirement of the Convention and could not keep any interference to that which was “necessary in a democratic society”. There had therefore been a violation of Article 8 of the Convention. Acquisition of data from communications service providers under Chapter II of RIPA The Court noted that the second set of applicants had complained that Chapter II of RIPA allowed a wide range of public bodies to request access to communications data from communications companies in various ill-defined circumstances. It first rejected a Government argument that the applicants’ application was inadmissible, finding that as investigative journalists their communications could have been targeted by the procedures in question. It then went on to focus on the Convention concept that any interference with rights had to be “in accordance with the law”. It noted that European Union law required that any regime allowing access to data held by communications service providers had to be limited to the purpose of combating “serious crime”, and that access be subject to prior review by a court or independent administrative body. As the EU legal order is integrated into that of the UK and has primacy where there is a conflict with domestic law, the Government had conceded in a recent domestic case that a very similar scheme introduced by the Investigatory Powers Act 2016 was incompatible with fundamental rights in EU law because it 4 did not include these safeguards. Following this concession, the High Court ordered the Government to amend the relevant provisions of the Act. The Court therefore found that as the Chapter II regime also lacked these safeguards, it was not in accordance with domestic law as interpreted by the domestic authorities in light of EU law. As such, there had been a violation of Article 8. Intelligence sharing procedures The Court found that the procedure for requesting either the interception or the conveyance of intercept material from foreign intelligence agencies was set out with sufficient clarity in the domestic law and relevant code of practice. In particular, material from foreign agencies could only be searched if all the requirements for searching material obtained by the UK security services were fulfilled. The Court further observed that there was no evidence of any significant shortcomings in the application and operation of the regime, or indeed evidence of any abuse. The intelligence sharing regime therefore did not violate Article 8. Article 10 The Court declared complaints by the third set of applicants under this provision to be inadmissible but found a violation of the rights of the second set of applicants, who had complained that the bulk surveillance regimes under section 8(4) and Chapter II of RIPA did not provide sufficient protection for journalistic sources or confidential journalistic material. In respect of the bulk interception regime, the Court expressed particular concern about the absence of any published safeguards relating both to the circumstances in which confidential journalistic material could be selected intentionally for examination, and to the protection of confidentiality where it had been selected, either intentionally or otherwise, for examination. In view of the potential chilling effect that any perceived interference with the confidentiality of journalists’ communications and, in particular, their sources might have on the freedom of the press, the Court found that the bulk interception regime was also in violation of Article 10. When it came to requests for data from communications service providers under Chapter II, the Court noted that the relevant safeguards only applied when the purpose of such a request was to uncover the identity of a journalist’s source. They did not apply in every case where there was a request for a journalist’s communications data, or where collateral intrusion was likely. In addition, there were no special provisions restricting access to the purpose of combating “serious crime”. As a consequence, the Court also found a violation of Article 10 in respect of the Chapter II regime. Article 6 The third set of applicants complained that the IPT lacked independence and impartiality. However, the Court noted that the IPT had extensive power to consider complaints concerning wrongful interference with communications, and those extensive powers had been employed in the applicants’ case to ensure the fairness of the proceedings. Most notably, the IPT had access to open and closed material and it had appointed Counsel to the Tribunal to make submissions on behalf of the applicants in the closed proceedings. Furthermore, the Court accepted that in order to ensure the efficacy of the secret surveillance regime, which was an important tool in the fight against terrorism and serious crime, the restrictions on the applicants’ procedural rights had been both necessary and proportionate and had not impaired the essence of their Article 6 rights. Overall, the applicants’ complaint was manifestly ill-founded and had to be rejected. Other Articles The third set of applicants complained under Article 14, in conjunction with Articles 8 and 10, that those outside the United Kingdom were disproportionately likely to have their communications intercepted as the law only provided additional safeguards to people known to be in Britain. 5 The Court rejected this complaint as manifestly ill-founded. The applicants had not substantiated their argument that people outside the UK were more likely to have their communications intercepted. In addition, any possible difference in treatment was not due to nationality but to geographic location, and was justified. Just satisfaction (Article 41) The applicants did not claim any award in respect of pecuniary or non-pecuniary damage and the Court saw no reason to make one. However, it made partial awards in respect of the costs and expenses claimed by the applicants in the first and second of the joined cases. The applicants in the third joined case made no claim for costs and expenses. Separate opinions Judges Pardalos and Eicke expressed a joint partly dissenting and partly concurring opinion, and Judge Koskelo, joined by Judge Turković, expressed a partly concurring, partly dissenting opinion. These opinions are annexed to the judgment. The judgment is available only in English. This press release is a document produced by the Registry. It does not bind the Court. Decisions, judgments and further information about the Court can be found on www.echr.coe.int. To receive the Court’s press releases, please subscribe here: www.echr.coe.int/RSS/en or follow us on Twitter @ECHRpress. Press contacts echrpress@echr.coe.int | tel.: +33 3 90 21 42 08 Patrick Lannin (tel: + 33 3 90 21 44 18) Tracey Turner-Tretz (tel: + 33 3 88 41 35 30) Denis Lambert (tel: + 33 3 90 21 41 09) Inci Ertekin (tel: + 33 3 90 21 55 30) Somi Nikol (tel: + 33 3 90 21 64 25) The European Court of Human Rights was set up in Strasbourg by the Council of Europe Member States in 1959 to deal with alleged violations of the 1950 European Convention on Human Rights.