The Grand Chamber of the European Court of Human Rights has handed down judgment (over 200 pages of it) in relation to the UK’s bulk interception of communications regime as it stood under section 8(4) of the Regulation of Investigatory Powers Act 2000 in Big Brother Watch & others v UK (App. No.s 58170/13, 62322/14 and 24969/15), and made important findings that the regime was not in accordance with law and thus breached Article 8 ECHR.

Bulk interception permits the collection by the State’s intelligence services of very large amounts of communications data, by no means all of which will then be subjected to further analysis. States consider such regimes essential to identify unknown threats to national security and to life. The Court accepted in principle that such practices were a critical tool for the identification of new threats in the digital domain: at [323]. It accepted that States had a wide margin of appreciation in deciding what type of interception regime was necessary: at [340], [347].

The Court also accepted that the degree of interference, and the nature of the safeguards required by Article 8, would differ depending on the stage of the process under challenge. It distinguished between four stages: (i) initial interception and retention; (ii) the application of specific selectors (strong selectors or complex queries); (iii) the examination of selected communications or related communications data; and (iv) subsequent retention and use of the “final product”: at [325]. All engaged Article 8, but the initial stage was a relatively light level of interference, and that level increased at each stage: at [330]-[331].

The Court reviewed its case law and the safeguards previously identified as applicable to such regimes, but then confirmed that it now considered a new and wider set of safeguards needed to be applied to secure compliance with Article 8. It set these out at [361] as being:

“(1) The grounds on which bulk interception may be authorised;

(2) the circumstances in which an individual’s communications may be intercepted;

(3) the procedures to be followed for granting authorisation;

(4) the procedures to be followed for selecting, examining and using intercept material;

(5) the precautions to be taken when communicating the material to other parties;

(6) the limits on the duration of interception, the storage of intercept material and the circumstances in which such material must be erased and destroyed;

(7) the procedures and modalities for supervision by an independent authority of compliance with the above safeguards and its powers to address non-compliance.

(8) the procedures for independent ex post facto review of such compliance and the powers vested in the competent body in addressing instances of non-compliance.”

The RIPA regime under challenge satisfied most of those safeguards, but failed particularly safeguards (3) and (4), essentially for the same reasons. The Court’s concerns were that bulk interception was initially authorised by the Secretary of State and not a body independent of the executive; the selectors used needed to be included in the application for a warrant so that their necessity and proportionality could be independently assessed; and strong selectors linked to identifiable individuals needed particular separate and objective verification. The Court accepted the validity of the oversight provided by the Interception of Communications Commissioner and the Investigatory Powers Tribunal, but these were principally ex post facto safeguards and not ones built into the initial stages. Accordingly, section 8(4) was not in accordance with law and a breach of Article 8 ECHR.

However, and of some practical importance (given an apparent distinction from the CJEU case law), the Court did not find that it was necessary to notify persons whose communications had been intercepted or selected for examination under a bulk regime and did not consider that a system such as the IPT which did not depend on notification or knowledge was problematic: at [358].

Acquisition of communications data from communication service providers under Chapter II of RIPA breached Article 8 for the same reasons, although the Court also noted that it doubted there was a material difference in the level of intrusion as between communications data and content data, such that the same safeguards applied: at [364] in particular.

A related challenge was brought on Article 10 grounds on the basis that the regime failed to include sufficient protections for confidential journalistic material, and the Court agreed with that challenge principally because of the lack of independent assessment of the overriding public interest in searches which might gather such material. Where such material was accidentally gathered by selectors which would not have been expected to do so, independent authorisation was required to retain it: at [448]-[458].

A third limb of the challenge concerned when the intelligence agencies were authorised to request intercept material from foreign intelligence agencies, but it held by a majority that sufficient safeguards were in place in this respect and that this scheme did comply with Article 8.

The judgment marks a significant development in the approach of the Strasbourg Court to telecommunications surveillance, and one which brings it closer to – but by no means fully aligned with – that of the CJEU (as some of the dissents complained). There are important strands which provide real additional protection for Article 8 rights, but also significant aspects of the reasoning with which the Government will be content. Of course, the RIPA regime is now replaced by the Investigatory Powers Act 2016, and it remains to be seen to what extent the ECHR challenges to that scheme have new life breathed into them by this judgment.

Julian Milford QC acted for the UK Government.

Christopher Knight