Spy agencies' mass data collection breached human rights standards, tribunal finds
It follows an ECJ ruling from last year, which said the UK's Investigatory Powers Act cannot require telecom firms to retain users' location and traffic on an ongoing basis
The UK's Investigatory Powers Tribunal (IPT) has ruled that British intelligence services' mass collection of communications and private data violated EU law.
In a declaration last week [pdf], the IPT stated that the way in which the UK's security and intelligence agencies - namely, MI5, MI6 and GCHQ - obtained data through the use of Section 94 of the Telecommunications Act 1984 (since replaced by the Investigatory Powers Act 2016) had breached the EU's human rights standards.
The ruling comes after the European Court of Justice (ECJ) ruled in October 2020 that the mass data retention practices undertaken by the British government for national security purposes must be subjected to the same privacy safeguards as detailed by the EU privacy law.
It said laws, including the UK's Investigatory Powers Act 2016, cannot legally require telecommunication firms to retain users' location and traffic on an ongoing basis.
The ECJ clarified that national security concerns do not exclude the bloc's member states from the need to abide by the general principles of EU laws, which 'command respect' for their fundamental rights to privacy and freedom of expression. It further added that the retention of users' phone and internet data can only be allowed when governments face a 'serious threat to national security'. Even in such situations, full access to users' data should be limited to a period that is 'strictly necessary'.
Campaign group Privacy International (PI) raised the initial legal challenge in 2015, arguing that the government's bulk data collection regime was unlawful.
'The result of the judgment is that a decade's worth of secret data capture has been held to be unlawful,' PI stated.
'The unlawfulness would have remained a secret but for PI's work. In the course of these proceedings, the Tribunal rightly praised PI's legal team for its dedication and valuable inquisitiveness, whilst also noting the constant necessity for both PI and Counsel for the Tribunal to probe and consider fresh problems and lacunae.'
The IPT had previously ruled that the bulk communications data regime was in breach of Article 8 of the European Convention of Human Rights, from its commencement to its avowal in December 2015.
Ilia Siatitsa, programme director for Privacy International, described IPT's ruling as "very important" from a democratic society and rule of law perspective.
"It sends a clear message to governments that they should always ensure there is an appropriate legal framework, accountability and transparency when using surveillance capabilities," she added.
In last week's ruling, the IPT also concluded - by a narrow 3-2 majority - that British intelligence agencies' sharing of bulk personal and communications data with foreign intelligence agencies does not violate of Article 8 of the ECHR.
The dissenting opinions were delivered in 'closed', meaning that they are not available for public for review.
The PI and Liberty have issued a judicial review challenge, seeking disclosure of dissenting judicial opinions.
The challenge is currently pending before the High Court.