United Kingdom

European Court of Human Rights (Grand Chamber): Big Brother Watch and Others v. the United Kingdom

IRIS 2021-7:1/20

Dirk Voorhoof

Human Rights Centre, Ghent University and Legal Human Academy

On 25 May 2021 the Grand Chamber of the European Court of Human Rights (ECtHR) delivered its long awaited judgment on bulk interception of personal data and mass surveillance by security and intelligence services in the case of Big Brother Watch and others v. the United Kingdom. After its Chamber judgment of 13 September 2018 (IRIS 2018-10/1) the case was referred to the Grand Chamber of the ECtHR. The Grand Chamber judgment elaborates a general framework of principles regarding bulk interception and confirms that the UK regime of interception of communications not only violates the privacy rights under Article 8 of the European Convention on Human Rights (ECHR) but also the journalists’ right to protect their sources, as guaranteed under Article 10 ECHR. In the meantime the UK has updated its surveillance rules under new legislation, the Investigatory Powers Act 2016 (IPA 2016), which came into force in 2018. The ECtHR did not examine the new legislation in its judgment. The new legal regimes are currently subject to challenge before the domestic courts in the UK and it would not be open to the Grand Chamber to examine the new legislation before those courts have first had the opportunity to do so.

The judgment in the case of Big Brother Watch and Others v. the United Kingdom deals with a complex set of statutory laws, codes of conduct, procedures and monitoring instruments on the bulk interception of communications, intelligence sharing and requesting data from communications service providers (CSPs). The applications with the Strasbourg Court were lodged by organisations and individuals active in campaigning in civil liberties issues, by a newsgathering organisation and by a journalist, complaining about the scope and magnitude of the electronic surveillance programmes operated by the Government of the UK. The applications were lodged after Edward Snowden revealed the existence of surveillance and intelligence sharing programmes operated by the intelligence services of the United States and the UK. The applicants believed that the nature of their activities meant that their electronic communications and/or communications data were likely to have been intercepted or obtained by the UK intelligence services.

For the general approach elaborated in the Grand Chamber’s judgment, we refer to the contribution in this IRIS-issue about the case of Centrum för Rättvisa v. Sweden. Both judgments extensively focus on the fundamental safeguards which are the cornerstone of any Article 8 compliant bulk interception regime and they introduce and describe the eight requirements to secure adequate and effective guarantees in terms of the “foreseeability” and “necessity in a democratic society” of such a regime. After evaluating each of the eight requirements, the Grand Chamber reaches the conclusion that the legal framework on bulk interception in the UK viewed as a whole, did not contain sufficient “end-to-end” safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse. Accordingly it finds a violation of Article 8 ECHR. In particular it identifies several fundamental deficiencies in the regime, such as the absence of independent authorisation, the failure to include the categories of selectors in the application for a warrant, and the failure to subject selectors linked to an individual to prior internal authorisation. These weaknesses concern not only the interception of the contents of communications but also the interception of related communications data. Therefore the Grand Chamber finds that the legal basis of the bulk interception regime did not meet the “quality of law” requirement and was therefore incapable of keeping the “interference” to what was “necessary in a democratic society”.

With regard to the complaint of a journalist and a newsgathering organisation that the bulk interception regime in the UK also violated the right of journalists to protect their sources as guaranteed under Article 10 ECHR, the Grand Chamber confirms the finding of the Chamber judgment of 2018. The ECtHR reiterates that the protection of journalistic sources is one of the cornerstones of freedom of the press, and that interference cannot be compatible with Article 10 ECHR unless it is justified by an overriding requirement in the public interest. A crucial safeguard is the guarantee of ex ante review by a judge or other independent and impartial decision-making body with the power to determine whether a requirement in the public interest exists that overrides the principle of protection of journalistic sources prior to the handing over of such material. The decision to be taken should be governed by clear criteria, including whether a less intrusive measure can suffice to serve the overriding public interests established. Applying these principles in the bulk interception context the ECtHR finds that under the UK regime confidential journalistic material could have been accessed by the intelligence services either intentionally, through the deliberate use of selectors or search terms connected to a journalist or news organisation, or unintentionally, as a “bycatch” of the bulk interception operation. Where the intention of the intelligence services is to access confidential journalistic material, for example, through the deliberate use of a strong selector connected to a journalist, or where, as a result of the choice of such strong selectors, there is a high probability that such material will be selected for examination, the ECtHR considers that the interference will be commensurate with that occasioned by the search of a journalist’s home or workplace. Therefore the Grand Chamber requires that before the intelligence services use selectors or search terms known to be connected to a journalist, or which would make the selection of confidential journalistic material for examination highly probable, the selectors or search terms must have been authorised by a judge or other independent and impartial decision-making body invested with the power to determine whether they were “justified by an overriding requirement in the public interest” and, in particular, whether a less intrusive measure might have sufficed to serve the overriding public interest. The UK bulk interception regime did not guarantee such an ex ante review by a judge or other independent and impartial decision-making body. On the contrary, where the intention was to access confidential journalistic material, or that was highly probable in view of the use of selectors connected to a journalist, all that was required was that the reasons for doing so, and the necessity and proportionality of doing so, be documented clearly. The Grand Chamber also finds that there were insufficient safeguards in place to ensure that once it became apparent that a communication which had not been selected for examination through the deliberate use of a selector or search term known to be connected to a journalist nevertheless contained confidential journalistic material, it could only continue to be stored and examined by an analyst if authorised by a judge or other independent and impartial decision‑making body invested with the power to determine whether its continued storage and examination was “justified by an overriding requirement in the public interest”. Instead, all that was required was that “particular consideration” should be given to any interception which might have involved the interception of confidential journalistic material, including consideration of any possible mitigation steps. In view of these weaknesses, and those identified by the ECtHR in its considerations of the complaint under Article 8 of the Convention, it finds that there has been a breach of Article 10 ECHR, specifically with regard to the protection of journalistic sources.

Finally the Grand Chamber also finds a violation of Article 8 and 10 with regard to the regime permitting the acquisition of retained data from communication service providers, as the practices in this domain were in breach with EU Law. As the access to retained data from CSPs was not limited to the purpose of combating “serious crime” and as there was also a lack of prior review by a court or an independent administrative body, this part of the operation of the UK regime is found as not being in accordance with the law within the meaning of Article 8 and 10 ECHR. However, the legal framework and practices related to the receipt of intelligence from foreign intelligence services, including the receipt of material intercepted by the NSA under PRISM and Upstream, was found in accordance with Article 8 and 10 ECHR. The Grand Chamber finds that the United Kingdom had in place adequate safeguards for the examination, use and storage of the content and communications data received from intelligence partners, as well as for the onward transmission of this material and for its erasure and destruction.

The Grand Chamber judgment contains in annex some highly interesting (partly) concurring opinions and partly dissenting opinions, arguing that the Grand Chamber judgment should go considerably further in upholding the importance of the protection of private life and correspondence, in particular by introducing stricter minimum safeguards, but also by applying those safeguards more rigorously to the impugned bulk interception regime, including in the initial stage of mass surveillance practices and the receipt of intelligence from foreign intelligence services. One of the opinions expresses the hope that in future cases the ECtHR “will interpret and further develop the principles in a way which will properly uphold democratic society and the values it stands for”.