MI5 breached law with five-year data retention
Home Office failed to investigate safeguarding issues
MI5 workers improperly held people's intercepted data for nearly five years, an independent tribunal concluded on Monday, criticising the spy agency for its "serious failings."
The Investigatory Powers Tribunal (IPT) ruled in favour of the charity Privacy International and human rights group Liberty, in the latest of a series of lawsuits the two organisations have filed against MI5 over alleged mass surveillance practises.
The IPT is an independent body that investigates complaints against the UK's security services.
This specific case focused on MI5's compliance with legal protections for personal data, under the Regulation of Investigatory Powers Act 2000 and the Investigatory Powers Act 2016 - often called the Snooper's Charter by privacy activists.
The laws provide state agencies, like MI5, the legal authority to acquire and retain people's personal information. However, they also establish tight guidelines for how such data should be handled and stored.
The IPT has now ruled that MI5 illegally retained significant volumes of data from late 2014 to early 2019 because, contrary to law, at least one of the agency's technological systems lacked sufficient retention, review and deletion (RRD) measures.
"The holding and handling of data in those circumstances was unlawful on the basis that, under the relevant provisions of RIPA and IPA, satisfactory safeguards relating to RRD were not in place," the tribunal said.
The judges added that, despite repeated warnings, the Home Office failed to conduct sufficient inquiries into these safeguarding issues, leaving successive Home Secretaries unclear as to whether the monitoring warrants they approved had effective protections.
The IPT said there had been a "widespread corporate failure" and it would not be appropriate to blame any specific MI5 or Home Office employees for the violation of law.
The tribunal rejected a broader challenge to the efficiency of protections under the RIPA or IPT. It also declined to quash any orders that could have been improperly issued, or to instruct MI5 to delete any unlawfully retained data. It said doing so would be "very damaging national security."
While praising the tribunal's judgement, both Liberty and Private International said the verdict did not go far enough to stop widespread monitoring and preserve privacy rights.
"UK intelligence agencies seriously intrude on thousands or even millions of people's privacy, we call them out, then the government promises better safeguards. Today's ruling is especially troubling because it confirms that those safeguards can be illusory," said Caroline Wilson Palow, legal director at Privacy International.
"MI5 failed to follow them for years, with successive Home Secretaries ignoring signs of their breach, too.
"These are not technical breaches. At its highest levels, MI5 systemically disregarded the law, and the Home Office's failure to do anything green-lighted their activities. Nothing good comes of unchecked power being exercised by government intelligence agencies operating in the shadows. It's undemocratic and dangerous to our rights to give MI5 a free pass."