The Guardian, UK: EU judges are to be asked to rule on the legality of Britain’s mass digital surveillance powers, the UK’s top national security court has said.
In a politically charged judgment on Friday, the investigatory powers tribunal (IPT) ruled that the European court of justice (ECJ) should decide whether the UK’s bulk collection of communications data, tracking personal use of the web, email, texts and calls, is legal.
The ruling said: “By the end of the hearing it was clear that both parties either agreed to or saw the necessity for a reference to the [ECJ’s] grand chamber, and the need for it is, we suggest, obvious from this judgment.”
The ruling is a victory for the campaign group Privacy International, which brought the case following last December’s ruling by the ECJ that the “general and indiscriminate retention” of communications data by governments was illegal.
That case was brought by Labour’s deputy leader, Tom Watson, and was initially backed by the Brexit secretary, David Davis, when he was a backbench MP.
Friday’s IPT ruling gave some comfort to the British security services and ministers with the statement that the bulk collection of communications data was “essential to the protection of the national security of the United Kingdom”.
The UK judges said applying the Watson European court ruling “would effectively cripple the security and intelligence agencies’ bulk data capabilities”.
The British tribunal, presided over by Sir Michael Burton, refused to expedite the case to the ECJ. This means it is likely to take several years to secure a final ruling, leaving the door open to claims from Brexiters that European judges will get to decide what anti-terror powers are held by the British security services.
The Privacy International challenge was defended by the government in the names of the foreign secretary, the home secretary, GCHQ, MI5 and MI6.
At the opening of the case, the vice-president of the IPT, Mr Justice Mitting, told the hearing: “This case raises a fundamental political question as to the competing powers of the nation state and the EU.”
The case is one of many legal challenges that followed the disclosures by Edward Snowden of the extent of the digital mass surveillance practised by Britain’s GCHQ and the US National Security Agency.
Lawyers for Privacy International told judges that the bulk collection of personal communications data was no less sensitive than the content of emails. They argued that British citizens were already subject to greater surveillance than any other citizens and that the constitutional right to personal privacy set limits on state surveillance powers.
James Eadie, QC, acknowledged that the issue may have to be referred to the grand chamber of the ECJ in Luxembourg for clarification.
A senior MI5 officer gave evidence to the IPT that bulk personal data collection powers had “contributed significantly to the disruption of terrorist operations and the saving of lives”.
Judges were given a statement from MI5’s deputy director for data access and policy describing the importance of bulk communications data (BCD) to the the security services. “The acquisition of BCD enables MI5 to identify threats and investigate in ways that, without this capability, would be either impossible or considerably slower. In many case[s] communications data may be the only investigative lead that we have to work from,” he said.
“Further, without BCD, it would be necessary to carry out other and more intrusive inquiries; for example, many more individual requests for CD or use other more intrusive powers in order to narrow the scope of a search. The inability to use BCD would therefore involve greater intrusion into the privacy of individuals.
The IPT also heard evidence that in 2005, “on the basis of sensitive but fragmentary intelligence, it was possible for MI5, from an entire bulk personal dataset, to establish, by applying a number of filters and matches so as to reduce a pool of 27,000 candidates, one person who was identified as a suspected potential al-Qaida suicide bomber.”
Millie Graham Wood, Privacy International’s legal officer, said: “The welter of information from metadata in the age of 24-hour browsing, mailing, messages, instant messaging apps, where our online activities replace conventional social interactions, is huge. It reveals so much about us.
“One need only think that a visit to an IP address hosting a medical self-diagnosis website, followed by a call to an oncologist, followed by an appointment with your solicitor, then a hospice, may well reveal that the person in question has terminal cancer.
“We need strict safeguards against the state accessing highly sensitive information about us. The UK government and the investigatory powers tribunal have said that the vital and fundamental safeguards as set out in the Watson judgment, such as requiring a judge to approve access to highly sensitive information, should not apply to the information held by intelligence agencies. Privacy International fundamentally disagree.
“Even when bulk metadata is used for the purposes of national security, there should be strong safeguards to protect our sensitive personal data.
“Nevertheless, both Privacy International and the government agree on one thing – the necessity of referring this matter to the European court of justice. We look to the CJEU to reiterate that the very sensible Watson judgment does still apply to our intelligence agencies when they [are] accessing massive troves of our personal data, whether or not it is in the name of national security.”
A government spokesperson said: “We welcome the tribunal’s recognition that collecting bulk personal data and communications data are vital national security capabilities. As litigation is ongoing, it would not be appropriate to comment further.”