UK Investigatory Powers Tribunal finds the regime for bulk communications data to be incompatible with EU law

The result of the judgment is that a decade’s worth of secret data capture has been held to be unlawful. The unlawfulness would have remained a secret but for EDRi member Privacy International’s (PI) work. In the course of these proceedings, the Tribunal rightly praised PI’s legal team for its dedication and valuable inquisitiveness, whilst also noting the constant necessity for both PI and Counsel for the Tribunal to probe and consider fresh problems and lacunae.

What happened

On 22 July 2021, the Investigatory Powers Tribunal (IPT) issued a declaration on PI’s challenge to the UK bulk communications regime finding that section 94 of the Telecommunications Act 1984 (since repealed by the Investigatory Powers Act 2016) was incompatible with EU law human rights standards. The result of the judgment is that a decade’s worth of secret data capture has been held to be unlawful. The unlawfulness would have remained a secret but for PI’s work.

You can find the IPT declaration here.

How PI got there

Six years after their initial claim, the 2021 IPT declaration aligns itself with the Court of Justice of the European Union’s October 2020 Grand Chamber ruling in PI case C-623/17. The EU court ruled that mass data retention and collection practices for national security purposes undertaken by the UK, must be subjected to the same privacy safeguards.

The IPT has issued five decisions/determinations in the course of these proceedings starting on 17 July 2016 until 22 July 2021.

PI first challenged the bulk acquisition and use of communications data by the Security and Intelligence Agencies (SIAs) (that is GCHQ, MI5 and MI6) on 8 June 2015. The bulk personal datasets and bulk communications data regimes collecting personal information on each and everone of us were initially secret, and were only avowed in the course of 2015.

The IPT has already previously found the bulk communications data regime to be breach of Article 8 of the European Convention of Human Rights from its commencement to its avowal in December 2015.

Some ‘amusing’ facts from these legal proceedings

The July 2021 declaration of the IPT may concern legislation that was in force before the Investigatory Powers Act 2016, however many things happened in the course of this case bringing further transparency and ensuring accountability of UK intelligence agencies actions in violation of human rights standards.

First time a GCHQ witness was cross-examined
It was the first case where the IPT permitted the cross-examination of a GCHQ withness, following revelations that the initial written statement had substantive errors. The cross-examination took place on 26 February 2018.

Ostensibly first ever IPT judicial dissents
Two out of five of the IPT judges disagreed with the majority that the regime in respect of sharing of BCD/BPD with foreign agencies complied with Article 8 ECHR in their 23 July 2018 judgment. Rarely do IPT judges dissent. The dissenting opinions were delivered entirely in “closed” – in other words, the dissenting opinions are not available for us to see to this day. PI issued a judicial review challenge asking for the decision not to disclose these dissenting opinions to be reversed, which is currently pending before the High Court.

PI’s data were found in UK intelligence agencies’ databases
In the course of these proceedings, it was revealed that PI’s data were illegally held by all UK intelligence agencies – MI5, MI6 and GCHQ. MI5 had even consulted this data. Then MI5 decided to delete PI’s data before the ongoing investigation was completed. See IPT’s determination on 25 September 2018.

What comes next

The IPT’s declaration is a welcome milestone in the bulk communications data litigation saga, but the fight is far from over.

PI have already asked the IPT to reopen this case following new information that came to light. In parallel, they are seeking disclosure of the judicial dissents given in ‘closed’ in the judgment of 23 July 2018 by way of judicial review proceedings.

PI will continue their work to bolster and protect the right to privacy. To keep up to date with their casework, sign up to PI’s mailing list here.

For more information see the case’s summary and timeline as well as the summary of legal proceedings until July 2019.

The article was first published by EDRi member, Privacy International, here.

Image credit: Etienne Girardet/Unsplash