June 4, 2021
In his judgment of 25 May 2021, the Grand Chamber of the European Court of Human Rights held that certain aspects of the British regime governing the mass interception of communications were contrary to Articles 8 and 10 of the Convention.
The case concerned three different interception regimes: the mass interception of communications; receiving material intercepted from foreign governments and intelligence agencies; and obtaining communication data from communication service providers (“CSPs”). All three requests were brought by individuals, journalists and human rights organizations following Edward Snowden’s revelations about surveillance programs implemented by US and UK intelligence services. United.
National legal framework
At the material time, the regime for mass interception and obtaining communications data from CSPs was based on the Regulatory Powers of Investigation Act 2000 (“RIPA”). The Grand Chamber’s conclusions concern this regime, which has since been replaced by the 2016 law on investigative powers.
The domestic legal framework is complex and is detailed in §§ 61 – 121. For the purposes of this document, it suffices to note that Article 8 (4) of the RIPA authorized the Secretary of State to issue warrants for “Interception of external communications” (§ 72), subject to the specific guarantees of Articles 15 to 17 (§§ 77-92). These provisions were accompanied by the Code of Practice on the Interception of Communications (“the IC Code”). Chapter II of the RIPA and the code of good practice for the acquisition of communication data that accompanies it govern the process by which certain public authorities may request communication data from CSPs (§§ 117-121). The role of the Investigative Powers Tribunal (“IPT”) is defined in §§ 122 to 134.
Mass interception of communications: Violation of Articles 8 and 10
The Grand Chamber considered the mass interception to be a “gradual process” in which the degree of interference with the rights of individuals under Article 8 increases as it progresses (§ 325). He noted that this process would typically include:
(a) interception and initial retention of communications and associated communications data (traffic data belonging to intercepted communications);
(b) application of specific selectors to retained communications / associated communications data;
(c) review by analysts of certain communications / communications data; and
(d) further retention of data and use of the “end product”, including sharing of data with third parties.
The Court held that while States enjoy a wide margin of appreciation in deciding what type of interception regime is necessary to protect national security, when operating a system of mass interception, the margin of appreciation given to them will be narrower and a number of safeguards will need to be present (§ 347).
The Grand Chamber considered that the guarantees previously identified by the Court with regard to target interception regimes had to be adapted to reflect the specificities of a mass interception regime (§ 348). Mass interception is typically directed at international communications and used primarily for foreign intelligence gathering (§ 344-345), and it allows individuals to be targeted by applying powerful selectors (such as their email addresses) to individuals. mass intercepted communications, rather than monitoring their devices (§ 346). The Court therefore considered that the requirement previously formulated to clearly define in domestic law the categories of persons liable to have their communications intercepted and the nature of the offenses which could give rise to such an order was not “easily applicable”; nor the requirement of “reasonable suspicion” (§ 348). The implications of this aspect of the judgment are discussed in more detail in the Joint Partially Concurring Opinion of Judges Lemmens, Vehabović and Bošnjak (see §§ 17 – 25), and in the Partially Concurring and Partially Dissenting Opinion of Judge Pinto de Albuquerque (see §§ 13 – 23).
Nonetheless, the Grand Chamber stressed that domestic law should contain detailed rules on when the authorities may resort to mass interception measures, the grounds for which it may be authorized and the circumstances in which communications from a individual can be intercepted (§ 348). The Court found that the importance of surveillance and control was magnified in this context because of the inherent risk of abuse and because the legitimate need for secrecy meant that States would often not be free to disclose information concerning the operation of a scheme (§ 349).
Therefore, the process must be subject to “end-to-end guarantees”, which means that: an assessment must be carried out at national level at each stage of the process of the necessity and proportionality of the measures taken; that mass interception should be subject to independent (but not necessarily judicial) authorization from the outset, once the object and scope of the operation is defined; and that the transaction should be subject to monitoring and ex post facto see again. The Court emphasized that it is about:
fundamental guarantees which will be the cornerstone of any mass interception regime in accordance with Article 8 (§ 350).
The use of selectors has been seen as one of the most important steps, as the point at which a particular individual’s communications can be targeted by intelligence services. The Grand Chamber admitted that the inclusion of all selectors in the authorization may not be feasible in practice; however, she believed that the authorization should at a minimum identify the types or categories of selectors to be used. In addition, strengthened safeguards should be put in place when strong selectors linked to identifiable persons have been used (§§ 354-355).
In assessing the functioning of the regime, addressing jointly “in accordance with the law” and “necessity”, the Court examined whether the internal legal framework clearly defined the following (§§ 361; 368 – 415):
- the grounds on which the mass interception may be authorized;
- the circumstances in which an individual’s communications may be intercepted;
- the procedure to be followed for granting the authorization;
- the procedures to be followed for the selection, examination and use of interception equipment;
- the precautions to be taken when communicating the material to other parties;
- the limits on the duration of the interception, the storage of the interception material and the circumstances under which such material must be erased and destroyed;
- the procedures and modalities of control by an independent authority of the respect of the above guarantees and its powers to remedy the non-respect; and
- the procedures for ex post facto independent review of such compliance and the powers conferred on the competent body to deal with cases of non-compliance.
The Grand Chamber considered that the lack of control over the categories of breeders at the time of authorization constituted a deficiency in the scheme. The subsequent control of all individual selectors did not meet the requirement for enhanced safeguards for the use of strong selectors linked to identifiable persons and the need to put in place a prior internal authorization process (§ 383).
Overall, there was considerable potential for the abuse of massive interceptions in a way that infringed individuals’ rights to respect for their privacy (§ 425). The Article 8 (4) regime did not contain sufficient end-to-end safeguards to provide adequate and effective safeguards against arbitrariness and the risk of abuse. The IC commissioner provided independent and effective oversight of the regime, and the IPT provided a strong legal remedy to anyone who suspected communications had been intercepted; however, these were not sufficient to offset the shortcomings (§ 425). As a result, Article 8 (4) did not meet the “quality of law” requirement and was unable to limit the interference to what was necessary in a democratic society (§ 426).
Furthermore, the additional safeguards of the IC Code, regarding the storage, transmission and destruction of confidential journalistic material did not correct the weaknesses identified by the Court in its analysis of the Article 8 regime, and the Article 10 was also violated (§ 456).
Receipt of information from foreign intelligence services: no violation of Articles 8 or 10
The Court considered the complaint regarding the receipt of solicited interception documents from the United States National Security Agency (“NSA”), but was satisfied that the request regime rested on a sufficiently clear and accessible basis. in domestic law and that adequate safeguards were in place (§ § 507 – 510). The regime had adequate independent oversight and ex post facto independent review (§§ 511 – 513).
Acquisition of communication data from communication service providers: Violations of Articles 8 and 10
The Court unanimously concluded that there had been a violation of Articles 8 and 10 since the operation of the regime of Chapter II of the RIPA had not been “provided for by law” (§§ 517 – 528).
The Grand Chamber was faced with the exceptionally difficult task of balancing the legitimate interests pursued by the Contracting States to the Convention and the fundamental rights and freedoms protected by Articles 8 and 10, in the context of the modern threats against which the mass interception is considered a very valuable source of protection. The Grand Chamber underlined that current surveillance, increasingly digital, has the capacity to have a very broad scope and that the guarantees are therefore “pivotal and yet elusive”. Furthermore, when operating in this area, he felt that Contracting States have a “legitimate need for secrecy, which means that little or no information on the operation of the program will be in the public domain, and the information available may be formulated in terminology which is obscure and which may vary significantly from state to state ”(§ 322).
Despite this difficulty, the judgment is rich in its details and nuanced in its reasoning. Unsurprisingly perhaps, it also comes with separate, strongly argued opinions.
The title may signal a victory for the many privacy NGOs involved; however, the judgment also reaffirms the Chamber’s previous point of view (see judgment of December 13, 2018), that mass interception programs are not in themselves illegal and that prior judicial authorization is not required. Moreover, the way in which the Grand Chamber has adapted its previous case law to the context of mass interceptions will be a source of permanent debate. The judgment will have important implications for the compatibility of current surveillance regimes in the UK and other Contracting States to the Convention with human rights standards.