Lorna Woods, Professor of Internet Law, University of Essex
(These observations on the judgment follow part 1 of the analysis, which explained the Court’s reasoning).
The Big Brother Watch judgment can be interpreted in two ways: as confirmation that mass surveillance is permissible (para 314) or as an acknowledgment that the Regulation of Investigatory Powers Act (RIPA) framework was inadequate. This implies that the Investigatory Powers Act (IPA), which inherited some of RIPA’s shortcomings, is also lacking. These contrasting views highlight the judgment’s complexity and length, making a concise summary almost impossible. The judgment’s full implications in this rapidly evolving legal landscape may not be evident for some time, as its interpretation and application unfold. This analysis provides a preliminary examination of the significant issues and points within the judgment. It centers around several key themes:
To what degree is there a consistent, even if tiered, methodology across various forms of surveillance?
When should we consider case law from the pre-digital age inadequate for safeguarding digital privacy?
How will this ruling affect the IPA, particularly as the Court’s evaluation of the RIPA framework changes in response to the Snowden revelations to enhance accountability?
Admissibility
The initial concern, at least for two applicant groups, was the exhaustion of domestic remedies. The Court, referencing Sejdovic v Italy, acknowledged “special circumstances” (para 268) that permitted the case’s admissibility. However, the Court’s reasoning merits a closer look.
The applicants, citing Kennedy, argued that while the Investigatory Powers Tribunal (IPT) has examined cases challenging the legality of surveillance systems (rather than individual infringements), the domestic system offered them no clear benefit as it lacked a “binding obligation on the State to remedy the incompatibility” (Big Brother Watch para 251, Kennedy para 109). The Court, relying on Zakharov’s discussion of victim status and abstract challenges, suggested that Kennedy’s distinction between individual grievances and systemic complaints (where the IPT lacks remedial power) is no longer valid.
However, the Court did not address the potential absence of individual remedies for systemic complaints, even when the IPT agrees to hear them. Does this suggest that individuals should always pursue individual remedies to exhaust domestic avenues? This aligns with the concurring opinion in Zakharov, which favored concrete interference claims.
While emphasizing the IPT’s significance and evolution over 15 years – particularly its independence, expanded powers, and procedural adaptations for sensitive cases – the Court did not directly engage with the IPT’s infrequent rulings against the Government in security and intelligence cases, primarily occurring after the Snowden revelations. Although understanding procedures, even those “below the waterline,” is undoubtedly helpful (para 257), it offers little solace to victims without accessible remedies.
This approach suggests that the Court may dismiss future applications attempting to circumvent the IPT’s inherent delays and costs – a point to consider for campaigners.
Merits of the Case
Article 8 and the Section 8(4) Regime
The applicants argued that the s. 8(4) regime lacked legal certainty due to its complexity and obscured aspects operating “below the waterline.” They further claimed it violated the six safeguards established in Weber to prevent arbitrary discretion and potential abuse. The Court’s response, while thorough and measured, ultimately displays excessive deference towards institutions seemingly oblivious to the practices of security and intelligence agencies.
The Court’s argument begins by noting that previous judgments adopted different approaches for various surveillance types, leading to the conclusion that “no single set of general principles applies universally to all cases involving covert surveillance measures” (para 303). While Weber consolidated principles from earlier cases, it did not explicitly cite them. Later, the Court cited Uzun (concerning GPS tracking with less stringent safeguards due to public movement tracking) and RE (concerning covert surveillance of legal consultations in a police station) as instances where the Weber criteria were not applied (para 351). Nevertheless, consistent with established case law on targeted interception, the Court affirmed the six Weber principles as the baseline for assessing foreseeability. In doing so, the Court follows a well-established path, mirroring Centrum för Rättvisa, which also addressed bulk interception (para 99). The Court deemed the complexity argument a matter of foreseeability, addressing it within the Weber framework.
While a consistent core principle is desirable, the Court’s approach here suggests that relevant distinctions exist between surveillance types. However, it fails to provide a clear framework for determining these differences. Should the focus be on the distinction between bulk and targeted interception, content versus metadata collection, or even legitimate purposes? While all these factors may be relevant, a clear articulation of their impact is missing, leaving the judgment to raise more questions than it answers.
The Court emphasized the level of intrusion as a crucial factor, aligning with existing legal precedent. Notably, it argued:
“it would be wrong automatically to assume that bulk interception constitutes a greater intrusion into the private life of an individual than targeted interception, which by its nature is more likely to result in the acquisition and examination of a large volume of his or her communications” (para 316).
Does this imply weaker safeguards for bulk acquisition compared to targeted interception based on the perceived intrusion level? Or could it be argued that untargeted acquisition is more problematic due to its broader societal impact and potential lack of proportionality? The Court navigates this by distinguishing between interception and selection/examination. The level of intrusion regarding metadata also remains ambiguous, with its relative intrusiveness unclear.
However, in a potentially significant step, the Court acknowledged the importance of metadata, stating that it was “not persuaded that the acquisition of related communications data is necessarily less intrusive that the acquisition of content.” It further noted that bulk acquisition amplifies the problem compared to content interception (para 356). This discussion implies the applicability of the Weber criteria to bulk communications data acquisition (para 350). Additionally, while outside the present case, the Court referenced Ben Faiza to suggest that real-time tracking is more intrusive than historical data transfer, potentially contrasting with Uzun.
Regrettably, despite recognizing metadata’s significance, the Court did not delve into concerns raised in submissions regarding the scope of data collection and the impact of new technologies, particularly analytical techniques. This issue has received limited judicial attention thus far. Judge Koskelo, in a partially concurring and dissenting opinion, highlighted the transformative changes in data availability and surveillance methods, potentially exposing individuals to greater intrusion than ever before (paras 11-13).
Despite acknowledging this “sea change,” the Court rejected incorporating objective reasonable suspicion and subject notification requirements into the Weber criteria, claiming it “would be inconsistent with the Court’s acknowledgement that the operation of a bulk interception regime in principle falls within a State’s margin of appreciation” (para 317). This implies a potential limitation on European court review powers, preventing them from prohibiting specific instances of bulk surveillance. This stance seemingly deviates from the earlier position that bulk surveillance, while not inherently prohibited, must still satisfy the three-part test under Article 8(2) as defined at the Convention level. Regarding proportionality, the Court references the Anderson Review of Bulk Powers, accepting its findings supporting a case for bulk surveillance but seemingly equating it with a finding of proportionality (paras 384-6). However, the review itself explicitly excluded proportionality considerations, leaving it to Parliament.
Another crucial aspect is whether the proportionality analysis should vary based on the public interest objective. While the statement on bulk surveillance’s acceptability pertained to national security, both RIPA and the IPA permit bulk surveillance on broader grounds. Judge Koskelo questioned the appropriateness of assessing safeguards based on cases with vastly different factual contexts. It’s worth noting that much of the factual assessment in this case relied on pre-Snowden findings from Kennedy. This approach to generalized surveillance also potentially diverges from the ECJ’s stance, as highlighted in the Joint Partly Dissenting and Partly Concurring Opinion of Judges Pardalos and Eicke.
The Court proposed adapting the six Weber criteria for bulk surveillance, despite Weber itself concerning a bulk regime. This contrasts with the Grand Chamber’s application of the Weber criteria in Zakharov, where “additional relevant factors” were considered in assessing the “necessary in a democratic society” requirement (para 232) without modifying the core criteria. The rationale and necessity for this adaptation in the present case remain unclear. The Court also suggested considering the regime in light of the Zakharov factors (para 320). This consolidation, increasingly common, raises questions about its potential impact on the level of protection afforded.
Furthermore, the Court addressed the extent to which ex-post controls can compensate for inadequate ex-ante safeguards. While Judge Koskelo expressed general reservations about relying on ex-post control (paras 17, 20), the Court reiterated that prior judicial authorization is not mandatory. Despite emphasizing the importance of ex-post IPT oversight (para 318) – the IPA’s “double lock” system was not yet operational – the Court found the oversight insufficient regarding material selection (paras 345-346). This discrepancy might stem from the Court’s perceived intrusion levels, deeming material selection more intrusive than collection, although uncertainty remains regarding the test’s requirements.
Significantly, the Court recognized content interception as a potential violation in itself. This contradicts the notion that automated data collection (be it content, metadata, or other data like location) is not intrusive. It underscores that content interception and examination are not singular events but an ongoing process potentially involving multiple intrusions requiring individual assessment. This reasoning also applies to data sharing. While the IPA introduced stronger ex-ante controls, this weakness persists. One unexplored area is whether controls should govern the analytical techniques used on big data sets for predictive analytics.
Another noteworthy point regarding the IPA regime is the Court’s treatment of related data, functionally equivalent to RIPA despite terminology changes. The analysis suggests that selecting such data for examination beyond determining UK/Ireland presence requires stronger oversight than the current regime provides. The Court also avoided discussing the interception location (para 271), potentially because the Government did not raise it, leaving the issue unresolved.
Article 8 and Data Sharing
The Court’s acceptance of the data-sharing regime may disappoint some, potentially legitimizing such practices, especially given its emphasis on global terrorism and national security. However, the judgment’s significance lies in its omissions. It narrowly focused on receiving intelligence, excluding the sharing of intelligence gathered by British agencies with foreign entities. This assumes that individuals outside the UK whose data is shared with British authorities retain Convention rights during processing within the UK. The location of intrusion becomes more complex in other scenarios, such as equipment interference warrants.
Article 8 and Bulk Communications Data
The analysis of the bulk communications data regime is somewhat underwhelming, lacking direct engagement with its substance. Instead, the regime’s inadequacy stems from a lack of legal basis, despite existing statutory frameworks. The domestic courts’ recognition of the statute’s incompatibility with EU law led the Strasbourg Court to conclude that the regime “cannot be in accordance with the law within the meaning of Article 8” (para 467). Notably, this conclusion rests on interpreting domestic law rather than directly invoking EU law. It refrains from fully adopting the Court of Justice’s reasoning in data retention cases.
Article 10
Big Brother Watch introduces the relatively novel aspect of Article 10 freedom of expression arguments, not addressed by the Court since Weber. It’s worth noting that the Court’s reasoning under 8(2) regarding 10(2) assessment implies similar considerations, effectively introducing the Weber criteria and Zakharov factors into freedom of expression. This jurisprudence likely applies only to secret surveillance’s impact on the media. While journalistic communications aren’t granted absolute protection, certain points hold implications for the IPA. Concerns were raised about the lack of safeguards in selecting material for bulk interception (para 493), an area where the regime was already deemed weak. Moreover, while the IPA offers safeguards for applications targeting journalists’ communications, the Court noted that these protections “do not apply in every case where there is a request for the communications data of a journalist or where such collateral intrusion is likely” (para 499). This deficiency, coupled with the regime’s overall shortcomings, led the Court to conclude that it cannot be considered compliant with Article 10(2).
Barnard & Peers: chapter 9
JHA4: chapter II:7
Photo credit: MiniPress news