The security and intelligence services will have to obtain independent authorisation before accessing citizens’ private phone and internet records during criminal investigations following a landmark High Court decision.
Two High Court judges have ruled that MI5, MI6 and GCHQ have been unlawfully given permission to access individuals’ communications data for the prevention or detection of serious crime under the Investigatory Powers Act 2016, known as the Snoopers’ Charter.
Lord Justice Singh and Justice Holgate found that the ability of the UK’s intelligence services to authorise their own access to the private communications data of the public for investigating crime is incompatible with EU laws that have been retained by the UK legal system after Brexit.
“The court has agreed that it’s too easy for the security services to get their hands on our data. From now on, when investigating crime, MI5, MI6 and GCHQ will have to obtain independent authorisation before having access to our communications data,” said Megan Goulding, lawyer for Liberty.
The Investigatory Powers Act 2016 allows the intelligence services and other government agencies to access the private communications and personal information of UK citizens irrespective of whether there is any evidence of wrongdoing.
The court found, however, in a 35-page judgment, that there was no reason for the intelligence services not to be subject to the same safeguards as the police when gathering surveillance data to investigate or prevent crime.
The “mere fact” that GCHQ, MI5 and MI6 generally operate in the field of national security does not make them exempt from the safeguards that apply to the police when investigating crime, the judges found.
“The court has agreed that it’s too easy for the security services to get their hands on our data. From now on, when investigating crime, MI5, MI6 and GCHQ will have to obtain independent authorisation before having access to our communications data” Megan Goulding, Liberty
“When the security and intelligence agencies act for an ordinary criminal purpose, we cannot see any logical or practical reason why they should not be subject to the same legal regime as the police,” they wrote.
The case is the latest in a long-running legal battle between Liberty, the Home Department and the Department of Foreign and Commonwealth Affairs over the UK’s bulk surveillance powers.
Ben Jaffey QC, representing Liberty, argued during a two-day hearing that the Investigatory Powers Act allowed intelligence agencies “general and indiscriminate” access to records of people’s private phone an internet activity, contrary to EU law.
The judges rejected the argument on the grounds that the IPA does not impose a blanket requirement on telecoms and internet companies to retain communications data.
All applications to exercise bulk surveillance powers require a warrant from the secretary of state, who must be satisfied the request is necessary and proportionate, according to the High Court judgment. Use of the bulk surveillance powers is also subject to approval by an independent judicial commissioner.
The Office of the Investigatory Powers Commissioner and the Investigatory Powers Tribunal also provide an oversight role, the judges said.
The judges dismissed arguments from Liberty that the automated processing of bulk communications data by the UK intelligence services was incompatible with EU law retained after Brexit.
Singh and Holgate found there was no absolute requirement under EU law to notify people whose communications had been monitored once investigations had been completed.
It was sufficient that an individual who suspects they have been subject to surveillance can make a complaint to the Investigatory Powers Tribunal, which has the power to make legally binding decisions.
The judges said that under a code of practice, public authorities had a duty to report any mistaken access or disclosure of communications data to the surveillance watchdog, the Investigatory Powers Commissioner.
The commissioner must inform anyone affected by errors made by public authorities under the IPA 2016, if the error is serious and it is in the public interest to disclose it.
Journalists’ sources
The judges dismissed arguments by Liberty that bulk interception does not provide sufficient safeguards to protect journalistic material and sources.
They wrote that the government has accepted a decision by the European Court of Human Rights that safeguards are required for journalistic material and has announced plans to legislate to introduce greater protection for journalists in the UK.
Any surveillance requests to identify or confirm a journalistic source must be approved by a judicial commissioner and can only be authorised if there is an “overriding” public interest, according to the judgment.
Following the judgment, Liberty said it would apply for permission to appeal several points, including the question of whether the bulk surveillance powers authorised by the IPA permit “general and indiscriminate” data collection which requires higher safeguards in UK law.
Liberty is also seeking an appeals court decision over whether state agencies are required to obtain independent authorisation each time they access stored communications data.
The civil society group is bringing a wider case against the IPA in the Court of Appeal, which is expected to be heard later this year.
Liberty said it believes the powers of the IPA are too broad and that legal safeguards in the act fail to protect individuals’ rights of privacy and free expression. They also fail to adequately protect journalists and their sources.
“Mass surveillance powers do not make us safer; they breach our privacy and undermine core pillars of our democracy,” said Liberty lawyer Megan Goulding. “[This ruling] represents a huge landmark in reigning in our mass surveillance powers, and we hope now the government creates proper safeguards that protect our rights.”
