British intelligence conducted illegal bulk data collection for over a decade

Intelligence agencies and government stretched the law justifying data collection to breaking point, Investigatory Powers Tribunal rules

British intelligence secretly and illegally collected bulk data on British citizens for over 10 years, the Investigatory Powers Tribunal (IPT) has ruled in a case brought by Privacy International and heard over the summer.

Privacy International described it as "one of the most significant indictments of the secret use of the government's mass surveillance powers since Edward Snowden first began exposing the extent of US and UK spying in 2013".

The IPT said it was clear that the actions of the UK government in collecting bulk communications data (Bulk Communications Data) and personal information datasets (Bulk Personal Datasets) between 1998 and November 2015 were not legal under Article 8 of the European Convention of Human Rights (ECHR).

"The BPD regime failed to comply with the ECHR principles which we have above set out throughout the period prior to its avowal in March 2015," it said.

"The BCD regime failed to comply with such principles in the period prior to its avowal in November 2015, and the institution of a more adequate system of supervision as at the same date."

The 'avowal' refers to moves by the government to acknowledge the existence of such data collection and analysis systems and codify them into law.

The IPT ruling also said it was clear that the government never informed Parliament that such data collection and analysis was taking place, meaning there was no chance for it to be properly scrutinised.

"It seems difficult to conclude that the use of BCD was foreseeable by the public, when it was not explained to Parliament; and several opportunities arose when legislation or codes of practice were being introduced or amended (and particularly in 2000 when s.80 of RIPA was passed), when the government of the day did not avow the use of section 94 [which governs communications intercepts]," said the IPT.

Furthermore, the IPT said there was little monitoring of how staff with access to these databases, which contained everything from medical records, tax records, electoral register information, used this information.

"We are not satisfied that, particularly given the fragmented nature of the responsibility apparently shared between the commissioners, there can be said to have been an adequate oversight of the BCD system, until after July 2015," it said.

The ruling by the IPT does not specify whether the data will be retained or should be deleted. It also claimed that the post-avowal regimes of BCD and BPD are now legal, although this is something Privacy International disagrees with.

"There is no requirement for judicial or independent authorisation. Supervision by a member of the executive (i.e. a government minister) does not provide the necessary guarantees that surveillance operations that could impact on millions of people are necessary and proportionate," the ruling said.

"There is no procedure for notifying victims of any use or misuse of bulk communication data so they can seek an appropriate remedy."

Millie Graham Wood, legal officer at Privacy International, said the judgment made it clear that the UK surveillance agencies had ridden "roughshod over our democracy" by spying on citizens on such a huge scale.

"It is unacceptable that it is only through litigation by a charity that we have learnt the extent of these powers and how they are used," she said.

"The public and Parliament deserve an explanation as to why everyone's data was collected for over a decade without oversight in place and confirmation that unlawfully obtained personal data will be destroyed."