Lorna Woods, Professor of Internet Law,
University of Essex
(These
comments on the judgment follow part
1 of the analysis, which explained the Court’s reasoning).
The Big Brother Watch judgment is, depending
on your point of view, a confirmation of the possibility of bulk surveillance
(para 314) or a recognition of the fact that the Regulation of Investigatory Powers Act (RIPA) regime was
insufficient and that, to the extent that these weaknesses are copied over into
the Investigatory Powers Act (IPA),
that act is deficient also. These two
different views reflect the fact that the judgment is long and complex and that
a one sentence summary is unlikely to do justice to all its nuances. In fact,
in an area where there is a rapidly increasing body of case law, it is likely
that the full significance of the judgment will not be known for some time and
we know how it has been interpreted, followed, distinguished, over-written or
simply ignored. What follows then is
necessarily a preliminary indication of the issues and points of significance
that arise from the judgment. It
contains a number of themes, or questions:-
-
To what extent is there a consistent, even if gradated,
approach across the different forms of surveillance?
-
To what extent should we say that the case law
from the analogue era is not the best indicator of necessary safeguards for the
digital?
-
What impact will this ruling have for the IPA –
especially given that the Court’s assessment of the RIPA regime changes to
improve accountability following on from the Snowden disclosures?
Admissibility
The
first question, at least in relation to two of the sets of applicants, was the
question of exhaustion. While the Court
accepted that there were “special circumstances” (para 268) (recognised in Sejdovic
v Italy (app no. 56581/00)), so that the case was admissible, it is worth
noting briefly the Court’s approach in getting to this point.
The
applicant’s argument was based on the reasoning of the Court in Kennedy, that while the Investigatory
Powers Tribunal (IPT) has heard cases which effectively constitute a challenge
to the legal regime itself (rather than a claim of interference in the
claimant’s individual case), the domestic regime did not obviously “benefit the
applicant, given that it did not appear to give rise to a binding obligation on
the State to remedy the incompatibility” (Big
Brother Watch para 251, Kennedy
para 109). Here, the Court relied on Zakharov
- in terms of its discussion of victimhood and the admissibility of a claim in abstracto rather than in the context
of availability of a remedy - to suggest that the distinction in Kennedy between an individual grievance
and a general complaint against the system (in which latter case the IPT cannot
provide a remedy) as regards has been removed.
The
fact that there might still not be a remedy for an individual in the context of
a general complaint, even if the IPT agrees to hear the complaint, is not
addressed. Is the Court suggesting that a complainant should (in any event)
bring an individual challenge so as to find a remedy to exhaust? Such a
suggestion would follow the same line as the reasoning of the concurring
opinion in Zakharov: that showed a
preference for specific cases of interference.
While
the Court emphasised the importance of the IPT and how it has changed over its
15 year period – specifically its independence, the scope of its powers and
techniques it has developed to allow it to hear cases without running into
difficulties from the sensitivity of some of claims, it did not address head on
the fact that the IPT has only rarely found against the Government in cases
involving the security and intelligence services and that only after the
Snowden disclosures (see for details the IPT’s report covering
2011-15 and the much shorter statistical
report covering 2016). While the
elucidation of procedures – especially those “below the waterline” - is clearly
helpful to the Court (see para 257), it does not help the victim if there is no
remedy.
This
approach signals that the Court will not accept more applications which seek to
avoid the delays and expense inherent in bringing an action before the IPT –
campaigners take note.
Merits of Case
Article
8 and the Section 8(4) Regime
The
applicants argued that the s. 8(4) regime was not lawful in the sense that the
regime was complex and significant elements of the regime were not made public
but were “below the waterline”; further they argued it did not comply with the
6 requirements to guard against unfettered discretion and the risk of abuse
found in Weber. The Court’s response is detailed and
considered but -in the end – perhaps overly deferential to a set of
institutions which seemed happily unaware of the practices of the security and
intelligence services.
The
Court’s reasoning starts with the statement that in previous judgments
different approaches had been taken to different types of surveillance and that
“there is no one set of general principles which apply in all cases concerning
secret measures of surveillance” (para 303).
Weber consolidated the
position in a number of earlier cases, though these were not cited: e.g Malone
(App no. 8691/79); Huvig (App no. 11105/84) and
-broadly speaking - Leander (App No. 9248/81 but
crucially specifically identified the criteria whereas earlier case law operated
on the basis of a broader test. Later in its judgment the Court pointed to Uzun
(App no. 35623/05) (concerning GPS tracking where the Court considered that
because the tracking of movements in public disclosed less information about
the conduct, opinions and feelings of the person concerned less strict
safeguards were required) and RE
(App no. 62498/11) (concerning covert surveillance of consultations of
individuals with legal advisors in a police station) as cases involving
surveillance where the Weber 6 criteria were not applied (para 351). Nonetheless, following the standard line for
interception cases (albeit targetted interception rather than bulk), it agreed
that the 6 principles from Weber should be the starting point for assessing
foreseeability. In this, the Court is following a well-trodden path – one that
case also be seen in Centrum för Rättvisa (App no.
35252/08) which also deals with bulk interception (para 99). The Court found the complexity point was a
question of foreseeability; insofar as it dealt with that issue, it did so as
part of the Weber criteria.
While
a consistent central principle is desirable, and the intention of the Court to
set this out is to be applauded, the approach of the Court here suggests that
there are differences between types of surveillance which are relevant (see
similarly RE para 130), but it does
not give us a clear framework as to what factors to be taken into account in
determining what relevant differences are.
Should we look at the distinction between bulk and targeted
interception, between content interception and meta-data collection; or even
between the legitimate purposes? It may be that all are relevant; it would have
been helpful had the impact of these differences been clearly mapped; this
judgment, however, seems more to give rise to questions than answers.
One
key factor the Court emphasised was the level of intrusion – and in this it
followed previous jurisprudence. Notably, it argued that:
it would be wrong automatically to assume that bulk
interception constitutes a greater intrusion into the private life of an individual
than targeted interception, which by its nature is more likely to result in the
acquisition and examination of a large volume of his or her communications
(para 316).
Does
this mean that the level of safeguards in relation to bulk acquisition should
be less than those for targeted interception based on the degree of intrusion?
Or, might we argue that untargeted acquisition is more problematic because of its
impact on society generally and because it is less likely to be proportionate? The
Court deals with this issue by distinguishing between interception and
selection/examination. Another area in
which the Court is unclear on the level of intrusion is in its consideration of
meta data and whether it is less intrusive – more intrusive or similarly
intrusive albeit in a different way.
Nonetheless,
in a statement that could be considered an important step forward in terms of
the Court’s recognition of the importance of meta data, it Court commented that
it was “not persuaded that the acquisition of related communications data is
necessarily less intrusive that the acquisition of content” and by contrast to
content interception, bulk acquisition magnified the problem (para 356). It
seems from the discussion of the related communications that the Weber criteria
can be applied to bulk communications data acquisition (para 350). Finally, though lying outside the fact
pattern, the Court referred to its recent decision in Ben Faiza (App no.
31446/12) to say that (perhaps in contrast to Uzun) that real time tracking was more intrusive than the transfer
of historical data.
It
is regrettable that – despite its recognition of the significance of
communications data - the Court did not investigate further the points raised
in some submissions regarding the scope of the data collected and the impact of
new technologies in terms of the types of analytical techniques used. So far this issue has not attracted much
judicial attention (the exception being the brief mention in the ECJ’s Canada
PNR Opinion (Opinion 1/15)). Judge Koskelo in a partly concurring
partly dissenting opinion commented that on the sea change that has taken place
in terms of the amount and nature of data that is available, as well as
mechanisms for carrying out surveillance, exposing individuals to greater
intrusion than before (paras 11-13).
Despite
this ‘sea change’, the Court also rejected the proposal to ‘update’ the Weber
criteria to require objective evidence of reasonable suspicion in relation to
the persons for whom data is being sought and the subsequent notification of
the surveillance subject on the basis that it “would be inconsistent with the
Court’s acknowledgement that the operation of a bulk interception regime in
principle falls within a State’s margin of appreciation” (para 317). This suggests that the powers of European
review are in fact limited so that they cannot exclude a particular instance of
bulk surveillance. Such a position would
seem to be a movement from that which says bulk surveillance is not
automatically prohibited but it still must satisfy the three-stage test in
Article 8(2) as determined at Convention level.
In terms of proportionality of a bulk regime, the Court refers to the Anderson
Review of Bulk Powers. It accepts its findings that there is a case for
bulk surveillance, but seemingly equates that to a finding that such
surveillance is proportionate (paras 384-6). It is clear from the review,
however, that the question of the proportionality of any such measures was not
considered, this being a matter for Parliament.
A
further consideration is the extent to which the proportionality analysis
changes (or should change) depending on the public interest objective in
view. The headline statement about the
acceptability of bulk surveillance related to national security, yet RIPA
allowed (and the IPA does allow) the carrying out of bulk surveillance on a
broader range of grounds. In any event,
as Judge Koskelo commented, is it appropriate to judge the adequacy of
safeguards in the context of cases that arose in very different factual
circumstances? In that context, note that much of the assessment of the facts
in this case is based on what the Court previously found in Kennedy – prior to
the Snowden disclosures. Further, this approach to generalised surveillance
seems to be a point at which there is some divergence between the Court and the
ECJ, as noted in the Joint Partly Dissenting and Partly Concurring Opinion of
Judges Pardalos and Eicke.
The
Court suggested that the 6 criteria in Weber
needed to be adapted for the context of bulk surveillance (as it did in Centrum för Rättvisa para 114) despite
the fact that Weber itself concerned a bulk regime. Moreover, when the Grand Chamber
applied the Weber criteria in the
case of targeted interception it did not adapt Weber, although it also
considered ‘additional relevant factors’ in relation to the consideration of
‘necessary in a democratic society’ (Zakharov,
para 232). It is not therefore clear what the nature of and necessity for this
adaptation is in this case. The Court
here also proposed considering the regime in the light of the Zakharov additional factors (para 320). This consolidation sees to becoming more
common (see also Centrum för Rättvisa). It
should be noted, however, that while the two sets of considerations will be
based on similar facts, their content is slightly different, though whether
this consolidation has a detrimental impact on the level of protection afforded
is an open question.
Another
issue is the extent to which the ex post controls can be seen as compensating
for a lack of ex ante controls. While Judge
Koskelo expressed concerns about the reliance on ex post control generally
(paras 17, 20), a key point from this judgment is the Court’s re-iteration that
prior judicial authorisation is not essential. Nonetheless, although the Court
emphasised the importance of the ex post control by the IPT (para 318) (the new
double lock system under the IPA not being in place at the time of the
hearing), in relation to the selection of the material the ex post oversight
seemed insufficient (paras 345-346). It
may be that the difference in the Court’s approach can be explained by its view
of the degree of intrusion, with the selection of material being more intrusive
than the collection though there is still a degree of uncertainty in what the
test requires here.
Significantly,
the Court has viewed the interception of content as a potential violation in
its own right. This seems to contradict the commonly made assertion that the
automated collection of data (whether content of communications, communications
meta data – or other data eg location via GPS or ANPR) is not an
intrusion. It also reminds us that the
interception of content and its examination is not one event, but on ongoing
process that may lead to multiple intrusions which need to be assessed
individually (the data sharing reasoning reiterates this point too). While the IPA has brought in greater ex ante
controls, this is a weakness that remains in the new act. The great unexplored territory is, as noted,
whether a claim could be made that there should be some sort of control over
types of analytical techniques used when analysing big data sets/predictive
analytics.
A
further point of some significance for the IPA regime is the Court’s approach
to the use of related data which, despite some changes in terminology, is the
same as in RIPA. It seems from the Court’s analysis that the selection for
examination of such data for purposes beyond determining whether the individual
is in the UK or Ireland requires greater oversight than the regime currently
provides. The Court also refrained from
discussing (perhaps because the Government did not raise it) the question of
where the interception takes place (para 271). This issue remains for another
day.
Article 8 and Data Sharing
As
regards the data-sharing regime, there will no doubt be disappointment that the
Court accepted the regime. It could be said that the judgment thereby renders
data sharing acceptable, especially given its emphasis on the global nature of
terrorism and the States’ duties to protect security. The judgment is perhaps
significant for what it did not cover. It carefully limited the topic on which
it ruled, the receipt of intelligence and did not discuss the sharing of
intelligence gather by the British services and shared overseas. There is also
an assumption here that a person outside the UK who data is shared with the
British services will still have convention rights when the information is
shared/processed in the UK. The issue of
where the intrusion happens may become more complex in other situations –
perhaps in the context of equipment interference warrants.
Article 8 and Bulk Communications Data
The
Court’s analysis of the bulk communications data regime is in some ways
disappointing as it does not deal directly with the substance. Instead the
regime falls because there is no basis in law, despite the existing statutory
framework (whether we consider RIPA or IPA). Simply put, the domestic courts
have recognised that the statute must be disapplied for non-compliance with the
requirements of EU law, and the Strasbourg Court therefore concluded that the
regime “cannot be in accordance with the law within the meaning of Article 8” (para
467). The point worth emphasising here
is that the Court based its conclusion on its understanding of domestic law,
not by relying directly on EU law. It
certainly has not gone as far as adopting the reasoning of the Court of Justice
in the data retention cases.
Article 10
Finally,
a relative novelty in Big Brother Watch
is the Article 10 freedom of expression arguments (the Court not having
considered the issue since Weber). Note that the Court relied on its reasoning
under 8(2) with regard to the assessment of 10(2): the considerations seem
therefore to be the same, implicitly introducing the Weber criteria and the Zakharov
additional considerations into freedom of expression. Presumably this jurisprudence will not be
relied on save in the specific context of the impact of secret surveillance on
the media. While the Court did not state that journalistic communications would
be entirely off-limits (similarly lawyers’ conversations are not sacrosanct: Kopp),
there are a couple of points that will have implications for the IPA. In
relation to bulk interception there were concerns about the lack of safeguards
in relation to the selection of material (para 493), an area where the Court
had already found the regime to be weak. Further, the IPA provides safeguards
that are limited to applications that have the purpose of targetting
journalists’ communications; the Court here noted that the protections did not
“apply in every case where there is a request for the communications data of a
journalist or where such collateral intrusion is likely” (para 499). This lack,
adding to the general failings of the regime (above), meant that the regime
could not be considered in accordance with the law for the purposes of Article
10(2).
Barnard
& Peers: chapter 9
JHA4:
chapter II:7
Photo
credit: MiniPress news
No comments:
Post a Comment