Thursday 20 September 2018

Analysis of the ECtHR judgment in Big Brother Watch: part 2





Lorna Woods, Professor of Internet Law, University of Essex

(These comments on the judgment follow part 1 of the analysis, which explained the Court’s reasoning).

The Big Brother Watch judgment is, depending on your point of view, a confirmation of the possibility of bulk surveillance (para 314) or a recognition of the fact that the Regulation of Investigatory Powers Act (RIPA) regime was insufficient and that, to the extent that these weaknesses are copied over into the Investigatory Powers Act (IPA), that act is deficient also.  These two different views reflect the fact that the judgment is long and complex and that a one sentence summary is unlikely to do justice to all its nuances. In fact, in an area where there is a rapidly increasing body of case law, it is likely that the full significance of the judgment will not be known for some time and we know how it has been interpreted, followed, distinguished, over-written or simply ignored.  What follows then is necessarily a preliminary indication of the issues and points of significance that arise from the judgment.  It contains a number of themes, or questions:-

-          To what extent is there a consistent, even if gradated, approach across the different forms of surveillance?
-          To what extent should we say that the case law from the analogue era is not the best indicator of necessary safeguards for the digital?
-          What impact will this ruling have for the IPA – especially given that the Court’s assessment of the RIPA regime changes to improve accountability following on from the Snowden disclosures?

Admissibility

The first question, at least in relation to two of the sets of applicants, was the question of exhaustion.  While the Court accepted that there were “special circumstances” (para 268) (recognised in Sejdovic v Italy (app no. 56581/00)), so that the case was admissible, it is worth noting briefly the Court’s approach in getting to this point.

The applicant’s argument was based on the reasoning of the Court in Kennedy, that while the Investigatory Powers Tribunal (IPT) has heard cases which effectively constitute a challenge to the legal regime itself (rather than a claim of interference in the claimant’s individual case), the domestic regime did not obviously “benefit the applicant, given that it did not appear to give rise to a binding obligation on the State to remedy the incompatibility” (Big Brother Watch para 251, Kennedy para 109). Here, the Court relied on Zakharov - in terms of its discussion of victimhood and the admissibility of a claim in abstracto rather than in the context of availability of a remedy - to suggest that the distinction in Kennedy between an individual grievance and a general complaint against the system (in which latter case the IPT cannot provide a remedy) as regards has been removed. 

The fact that there might still not be a remedy for an individual in the context of a general complaint, even if the IPT agrees to hear the complaint, is not addressed. Is the Court suggesting that a complainant should (in any event) bring an individual challenge so as to find a remedy to exhaust? Such a suggestion would follow the same line as the reasoning of the concurring opinion in Zakharov: that showed a preference for specific cases of interference. 

While the Court emphasised the importance of the IPT and how it has changed over its 15 year period – specifically its independence, the scope of its powers and techniques it has developed to allow it to hear cases without running into difficulties from the sensitivity of some of claims, it did not address head on the fact that the IPT has only rarely found against the Government in cases involving the security and intelligence services and that only after the Snowden disclosures (see for details the IPT’s report covering 2011-15 and the much shorter statistical report covering 2016).  While the elucidation of procedures – especially those “below the waterline” - is clearly helpful to the Court (see para 257), it does not help the victim if there is no remedy. 

This approach signals that the Court will not accept more applications which seek to avoid the delays and expense inherent in bringing an action before the IPT – campaigners take note.

Merits of Case

Article 8 and the Section 8(4) Regime

The applicants argued that the s. 8(4) regime was not lawful in the sense that the regime was complex and significant elements of the regime were not made public but were “below the waterline”; further they argued it did not comply with the 6 requirements to guard against unfettered discretion and the risk of abuse found in Weber.  The Court’s response is detailed and considered but -in the end – perhaps overly deferential to a set of institutions which seemed happily unaware of the practices of the security and intelligence services.

The Court’s reasoning starts with the statement that in previous judgments different approaches had been taken to different types of surveillance and that “there is no one set of general principles which apply in all cases concerning secret measures of surveillance” (para 303).  Weber consolidated the position in a number of earlier cases, though these were not cited: e.g Malone (App no. 8691/79); Huvig (App no. 11105/84) and -broadly speaking - Leander (App No. 9248/81 but crucially specifically identified the criteria whereas earlier case law operated on the basis of a broader test. Later in its judgment the Court pointed to Uzun (App no. 35623/05) (concerning GPS tracking where the Court considered that because the tracking of movements in public disclosed less information about the conduct, opinions and feelings of the person concerned less strict safeguards were required) and RE (App no. 62498/11) (concerning covert surveillance of consultations of individuals with legal advisors in a police station) as cases involving surveillance where the Weber 6 criteria were not applied (para 351).  Nonetheless, following the standard line for interception cases (albeit targetted interception rather than bulk), it agreed that the 6 principles from Weber should be the starting point for assessing foreseeability. In this, the Court is following a well-trodden path – one that case also be seen in Centrum för Rättvisa (App no. 35252/08) which also deals with bulk interception (para 99).  The Court found the complexity point was a question of foreseeability; insofar as it dealt with that issue, it did so as part of the Weber criteria.

While a consistent central principle is desirable, and the intention of the Court to set this out is to be applauded, the approach of the Court here suggests that there are differences between types of surveillance which are relevant (see similarly RE para 130), but it does not give us a clear framework as to what factors to be taken into account in determining what relevant differences are.  Should we look at the distinction between bulk and targeted interception, between content interception and meta-data collection; or even between the legitimate purposes? It may be that all are relevant; it would have been helpful had the impact of these differences been clearly mapped; this judgment, however, seems more to give rise to questions than answers.

One key factor the Court emphasised was the level of intrusion – and in this it followed previous jurisprudence. Notably, it argued that:

it would be wrong automatically to assume that bulk interception constitutes a greater intrusion into the private life of an individual than targeted interception, which by its nature is more likely to result in the acquisition and examination of a large volume of his or her communications (para 316). 

Does this mean that the level of safeguards in relation to bulk acquisition should be less than those for targeted interception based on the degree of intrusion? Or, might we argue that untargeted acquisition is more problematic because of its impact on society generally and because it is less likely to be proportionate? The Court deals with this issue by distinguishing between interception and selection/examination.  Another area in which the Court is unclear on the level of intrusion is in its consideration of meta data and whether it is less intrusive – more intrusive or similarly intrusive albeit in a different way. 

Nonetheless, in a statement that could be considered an important step forward in terms of the Court’s recognition of the importance of meta data, it Court commented that it was “not persuaded that the acquisition of related communications data is necessarily less intrusive that the acquisition of content” and by contrast to content interception, bulk acquisition magnified the problem (para 356). It seems from the discussion of the related communications that the Weber criteria can be applied to bulk communications data acquisition (para 350).  Finally, though lying outside the fact pattern, the Court referred to its recent decision in Ben Faiza (App no. 31446/12) to say that (perhaps in contrast to Uzun) that real time tracking was more intrusive than the transfer of historical data. 

It is regrettable that – despite its recognition of the significance of communications data - the Court did not investigate further the points raised in some submissions regarding the scope of the data collected and the impact of new technologies in terms of the types of analytical techniques used.  So far this issue has not attracted much judicial attention (the exception being the brief mention in the ECJ’s Canada PNR Opinion (Opinion 1/15)). Judge Koskelo in a partly concurring partly dissenting opinion commented that on the sea change that has taken place in terms of the amount and nature of data that is available, as well as mechanisms for carrying out surveillance, exposing individuals to greater intrusion than before (paras 11-13).

Despite this ‘sea change’, the Court also rejected the proposal to ‘update’ the Weber criteria to require objective evidence of reasonable suspicion in relation to the persons for whom data is being sought and the subsequent notification of the surveillance subject on the basis that it “would be inconsistent with the Court’s acknowledgement that the operation of a bulk interception regime in principle falls within a State’s margin of appreciation” (para 317).  This suggests that the powers of European review are in fact limited so that they cannot exclude a particular instance of bulk surveillance.  Such a position would seem to be a movement from that which says bulk surveillance is not automatically prohibited but it still must satisfy the three-stage test in Article 8(2) as determined at Convention level.  In terms of proportionality of a bulk regime, the Court refers to the Anderson Review of Bulk Powers. It accepts its findings that there is a case for bulk surveillance, but seemingly equates that to a finding that such surveillance is proportionate (paras 384-6). It is clear from the review, however, that the question of the proportionality of any such measures was not considered, this being a matter for Parliament.

A further consideration is the extent to which the proportionality analysis changes (or should change) depending on the public interest objective in view.  The headline statement about the acceptability of bulk surveillance related to national security, yet RIPA allowed (and the IPA does allow) the carrying out of bulk surveillance on a broader range of grounds.  In any event, as Judge Koskelo commented, is it appropriate to judge the adequacy of safeguards in the context of cases that arose in very different factual circumstances? In that context, note that much of the assessment of the facts in this case is based on what the Court previously found in Kennedy – prior to the Snowden disclosures. Further, this approach to generalised surveillance seems to be a point at which there is some divergence between the Court and the ECJ, as noted in the Joint Partly Dissenting and Partly Concurring Opinion of Judges Pardalos and Eicke.

The Court suggested that the 6 criteria in Weber needed to be adapted for the context of bulk surveillance (as it did in Centrum för Rättvisa para 114) despite the fact that Weber itself concerned a bulk regime. Moreover, when the Grand Chamber applied the Weber criteria in the case of targeted interception it did not adapt Weber, although it also considered ‘additional relevant factors’ in relation to the consideration of ‘necessary in a democratic society’ (Zakharov, para 232). It is not therefore clear what the nature of and necessity for this adaptation is in this case.  The Court here also proposed considering the regime in the light of the Zakharov additional factors (para 320).  This consolidation sees to becoming more common (see also Centrum för Rättvisa). It should be noted, however, that while the two sets of considerations will be based on similar facts, their content is slightly different, though whether this consolidation has a detrimental impact on the level of protection afforded is an open question. 

Another issue is the extent to which the ex post controls can be seen as compensating for a lack of ex ante controls.  While Judge Koskelo expressed concerns about the reliance on ex post control generally (paras 17, 20), a key point from this judgment is the Court’s re-iteration that prior judicial authorisation is not essential. Nonetheless, although the Court emphasised the importance of the ex post control by the IPT (para 318) (the new double lock system under the IPA not being in place at the time of the hearing), in relation to the selection of the material the ex post oversight seemed insufficient (paras 345-346).  It may be that the difference in the Court’s approach can be explained by its view of the degree of intrusion, with the selection of material being more intrusive than the collection though there is still a degree of uncertainty in what the test requires here. 

Significantly, the Court has viewed the interception of content as a potential violation in its own right. This seems to contradict the commonly made assertion that the automated collection of data (whether content of communications, communications meta data – or other data eg location via GPS or ANPR) is not an intrusion.  It also reminds us that the interception of content and its examination is not one event, but on ongoing process that may lead to multiple intrusions which need to be assessed individually (the data sharing reasoning reiterates this point too).  While the IPA has brought in greater ex ante controls, this is a weakness that remains in the new act.  The great unexplored territory is, as noted, whether a claim could be made that there should be some sort of control over types of analytical techniques used when analysing big data sets/predictive analytics.

A further point of some significance for the IPA regime is the Court’s approach to the use of related data which, despite some changes in terminology, is the same as in RIPA. It seems from the Court’s analysis that the selection for examination of such data for purposes beyond determining whether the individual is in the UK or Ireland requires greater oversight than the regime currently provides.   The Court also refrained from discussing (perhaps because the Government did not raise it) the question of where the interception takes place (para 271). This issue remains for another day.

Article 8 and Data Sharing

As regards the data-sharing regime, there will no doubt be disappointment that the Court accepted the regime. It could be said that the judgment thereby renders data sharing acceptable, especially given its emphasis on the global nature of terrorism and the States’ duties to protect security. The judgment is perhaps significant for what it did not cover. It carefully limited the topic on which it ruled, the receipt of intelligence and did not discuss the sharing of intelligence gather by the British services and shared overseas. There is also an assumption here that a person outside the UK who data is shared with the British services will still have convention rights when the information is shared/processed in the UK.  The issue of where the intrusion happens may become more complex in other situations – perhaps in the context of equipment interference warrants.

Article 8 and Bulk Communications Data

The Court’s analysis of the bulk communications data regime is in some ways disappointing as it does not deal directly with the substance. Instead the regime falls because there is no basis in law, despite the existing statutory framework (whether we consider RIPA or IPA). Simply put, the domestic courts have recognised that the statute must be disapplied for non-compliance with the requirements of EU law, and the Strasbourg Court therefore concluded that the regime “cannot be in accordance with the law within the meaning of Article 8” (para 467).  The point worth emphasising here is that the Court based its conclusion on its understanding of domestic law, not by relying directly on EU law.  It certainly has not gone as far as adopting the reasoning of the Court of Justice in the data retention cases.

Article 10

Finally, a relative novelty in Big Brother Watch is the Article 10 freedom of expression arguments (the Court not having considered the issue since Weber).  Note that the Court relied on its reasoning under 8(2) with regard to the assessment of 10(2): the considerations seem therefore to be the same, implicitly introducing the Weber criteria and the Zakharov additional considerations into freedom of expression.  Presumably this jurisprudence will not be relied on save in the specific context of the impact of secret surveillance on the media. While the Court did not state that journalistic communications would be entirely off-limits (similarly lawyers’ conversations are not sacrosanct: Kopp), there are a couple of points that will have implications for the IPA. In relation to bulk interception there were concerns about the lack of safeguards in relation to the selection of material (para 493), an area where the Court had already found the regime to be weak. Further, the IPA provides safeguards that are limited to applications that have the purpose of targetting journalists’ communications; the Court here noted that the protections did not “apply in every case where there is a request for the communications data of a journalist or where such collateral intrusion is likely” (para 499). This lack, adding to the general failings of the regime (above), meant that the regime could not be considered in accordance with the law for the purposes of Article 10(2).

Barnard & Peers: chapter 9
JHA4: chapter II:7
Photo credit: MiniPress news

No comments:

Post a Comment