By Dr Nora Ni Loideain Director and Lecturer in Law, Information Law & Policy Centre, Institute of Advanced Legal Studies, University of London.
On 25 May 2021, the ECtHR Grand Chamber delivered two landmark judgments in Big Brother Watch v United Kingdom and Centrum för Rättvisa v Sweden, rulings which will shape the future ECHR legal order and the approach of the ECtHR to future applications concerning Article 8 ECHR and bulk interception regimes. Here I will discuss some key takeaways from the Big Brother Watch majority judgment of the Grand Chamber that deal with the latter programmes. For a comprehensive examination of the background and legal assessment that framed the significant holdings of the Chamber judgment in Big Brother Watch, see here.
Accessing data no longer constitutes ‘a separate and further interference’ with the right to respect for private life and correspondence under Article 8(1)
In a departure from the findings of the Chamber judgment, the Grand Chamber considers how an interference with Article 8 ECHR takes place over what it identifies as the four stages of data processing within a bulk interception system, namely the initial retention; application of selectors; examination of selected content/communications data by analysts; and subsequent data retention and use/data sharing of the ‘final product’ (para 325). The Court concludes that the ‘degree of interference with privacy rights will increase as the process moves through the different stages’ and that the need for safeguards will be at its highest at the examination stage involving an analyst (paras 330-331). This more granular Article 8(1) analysis by the Court is welcome as the question of how a particular bulk interception regime constitutes an interference with the rights of Article 8 ECHR has become ever more swiftly addressed in recent cases.
However, this assessment on the extent to which bulk interception programmes interfere with Article 8 ECHR departs dramatically from long-established ECtHR caselaw which provides that accessing data acquired from a bulk interception system constitutes ‘a further separate interference’ with the rights under Article 8 ECHR (see Weber and Saravia v Germany). Indeed, this influential jurisprudence has consequently shaped the standards of the landmark bulk retention cases of the CJEU (see Digital Rights Ireland, La Quadrature du Net). There is no explanation regarding why the Grand Chamber chooses to depart from this well-established Article 8 ECHR standard which provides that the operation of a bulk interception system involves not one but a series of interferences with individuals’ rights under Article 8 ECHR. That said, this whittling down by the Grand Chamber of the intrusiveness to the rights under Article 8(1) posed by the bulk interception programmes in Big Brother Watch is unsurprising for two noteworthy reasons.
First, the analysis is consistent with criticisms by judges of the ECtHR itself and scholars of the Chamber judgment for the distinct lack of engagement by the ECtHR in general regarding how digitalised our lives have become and how this ‘sea change’ has made the power of bulk interception to look into our private lives so much greater. Given the novel and far-reaching scope of these modern and highly sophisticated regimes, it is a cause for concern that the Grand Chamber omits this factor in its Article 8(1) assessment of the degree of interference posed by the operation of bulk interception regimes to the rights to private life and correspondence under Article 8 ECHR. Secondly, this deferential examination of Article 8(1) is evidence of the more general level of scrutiny and wider margin of appreciation granted by the Court in cases where it applies the increasingly criticised ‘joint analysis approach’ to its examination of Article 8(2).
Article 8 ECHR ‘does not prohibit the use of bulk interception to protect national security’ and there is no need to update its safeguards
The most significant question for the Grand Chamber was whether it would determine that the very principle of bulk interception fails to satisfy the proportionality condition of Article 8(2) and thereby falls outside a State’s margin of appreciation rendering such regimes an unjustified interference and a violation of Article 8 ECHR (para 277). For those familiar with the recent data privacy and surveillance cases of the ECtHR, it is not surprising that the Grand Chamber affirms its key holding from the Chamber majority judgment that the decision to operate a bulk interception regime in order to ‘identify threats to national security’ is one which continues to fall within the margin of appreciation granted to Contracting States (para 340). Some inconsistent reasoning follows, however, with respect to the rejection by the Grand Chamber to the applicant’s other main argument that ‘changes in both society and technology had resulted in the need for the Court to update its existing approach – and enhance the necessary safeguards – to ensure that Convention rights remained practical and effective’ (para 280). At one point, the Grand Chamber seems to accept the fact that technology has indeed moved on from when its current safeguards were established in previous caselaw noting that ‘the scope of the surveillance activity considered in those cases would therefore have been much narrower’ (para 341).
Ultimately, the Grand Chamber judgment, following the Chamber judgment, again rejects the applicants’ argument that there is any need to examine whether these safeguards are fit for purpose. The Grand Chamber instead concludes that adapting the ‘six minimum safeguards’ developed from its caselaw dealing with the tapping of landline phones decades ago will suffice. Thus, in striking contrast to the prescriptive safeguards of the CJEU, no minimum standards in fact will apply to the review of the compatibility of bulk interception regimes with Article 8 ECHR. This is in line with the Grand Chamber immediately proceeding to clarify their status as ‘principles’ (para 347). These safeguards effectively amount to no more than best practice in what the Grand Chamber later states will ultimately be ‘an overall assessment’ of a bulk retention regime (para 421):
The Court has already identified those safeguards which should feature in a Convention-compliant targeted interception regime. While those principles provide a useful framework for this exercise, they will have to be adapted to reflect the specific features of a bulk interception regime and, in particular, the increasing degrees of intrusion into the Article 8 rights of individuals as the operation moves through the stages identified in paragraph 325 above (para 347) (emphasis added).
From minimum standards to ‘a global assessment’ primarily focused on the ‘end-to-end’ safeguards of the domestic law
Thus, as held by the Chamber majority judgment, the Grand Chamber affirms that the six foreseeability safeguards developed under the legality condition of Article 8(2) are not the minimum standard to be met in order for a bulk interception regime to be Article 8 ECHR-compliant. Following the unquestionably conservative Grand Chamber judgments delivered this week, it seems incredible that a unanimous ECtHR judgment in 2016 held that Article 8 ECHR safeguards needed ‘to be enhanced’ in light of the capacity of State surveillance to now acquire detailed profiles of the ‘most intimate aspects of individuals’ private lives’ (Szabó and Vissy v Hungary).
In another noteworthy departure from previous caselaw, the Grand Chamber establishes that in future the operation of a bulk interception regime will be subject to ‘a global assessment’ that will focus ‘primarily on whether the domestic legal framework contains sufficient guarantees against abuse’ and is subject to end-to-end safeguards (para 360). The exact details of what the ‘global’ nature of such an assessment will entail are not addressed. Rather, the Grand Chamber proceeds to highlight that in doing so regard will be given to the more traditional proportionality requirement of examining the ‘actual operation of the system … and the existence or absence of any evidence of actual abuse’ (para 360).
The Grand Chamber also places considerable weight on the role of independent oversight to minimise the ‘risk of the bulk interception power being abused’ as the cornerstone of any Article 8 compliant regime (para 350):
[I]n order to minimise the risk of the bulk interception power being abused, the Court considers that the process must be subject to “end-to-end safeguards”, meaning that, at the domestic level, an assessment should be made at each stage of the process of the necessity and proportionality of the measures being taken; that bulk interception should be subject to independent authorisation at the outset, when the object and scope of the operation are being defined; and that the operation should be subject to supervision and independent ex post facto review. In the Court’s view, these are fundamental safeguards which will be the cornerstone of any Article 8 compliant bulk interception regime (see also the report of the Venice Commission, at paragraph 197 above, which similarly found that two of the most significant safeguards in a bulk interception regime were the authorisation and oversight of the process).
A joint-analysis Article 8(2) examination of UK bulk regime framework – shortcomings found
In replacing the so-called Weber criteria (six minimum foreseeability safeguards), the Court establishes a new eight-part set of criteria that it will examine when determining whether a domestic law governing a bulk interception regime contains adequate and effective safeguards and guarantees to meet the requirements of ‘foreseeability’ and ‘necessity in a democratic society’ (para 361):
- the grounds on which bulk interception may be authorised;
- the circumstances in which an individual’s communications may be intercepted;
- the procedure to be followed for granting authorisation;
- the procedures to be followed for selecting, examining and using intercept material;
- the precautions to be taken when communicating the material to other parties;
- the limits on the duration of interception, the storage of intercept material and the circumstances in which such material must be erased and destroyed;
- the procedures and modalities for supervision by an independent authority of compliance with the above safeguards and its powers to address non-compliance;
- the procedures for independent ex post facto review of such compliance and the powers vested in the competent body in addressing instances of non-compliance.
The UK bulk regime framework reviewed by the Grand Chamber is no longer in force and instead focuses on the bulk interception of communications and related communications data regimes permitted to operate under section 8(4) of the Regulation of Investigatory Powers Act 2000. In line with the temporal scope of the Chamber’s review, the Grand Chamber states that it must ‘similarly limit its examination to the legislative regime as is stood on 7 November 2017’ (para 270). This is not, however, the approach adopted by Grand Chamber in its actual assessment of the domestic law, which encompasses legislation, domestic caselaw, and codes of practice. Indeed, the Court attaches weight to evidence put forward in government submissions to the Grand Chamber with respect to its assessment of the eight-part criteria. For instance, when assessing the sixth part of the criteria concerning the limits on duration of interception and storage of material, the Court explicitly refers and takes into account further details provided by the UK government which ultimately contribute to the domestic legal framework being considered to have clearly defined limits on the duration periods (para 405).
In its overall deferential assessment of the domestic law ‘as a whole’, the Grand Chamber determines that the UK domestic law meets each of the above eight-part criteria with the exception of three ‘shortcomings’ (para 426) which result in a violation of Article 8 ECHR. Falling within the scope of the filtering requirements under the fourth criterion, the Court takes issue with the failure of the domestic law to require that ‘categories of selectors’ be included in warrant applications and the failure for there to any ‘prior internal authorisation’ of selectors linked to specific individuals (para 425). The most significant deficiency for the UK legal framework now governing bulk interception regimes is the holding by the Court that the section 8(4) regime ‘lacked one of the fundamental safeguards; namely, that bulk interception should be subject to independent authorisation at the outset’ (para 377).
Under the Investigatory Powers Act 2016, the authorisation of bulk regimes is still not subject to ex ante independent authorisation, ‘a body that is independent of the executive’ (para 351). Instead, the law currently provides that this prior authorisation is made by the Secretary of State with approval from a judicial commissioner from the Investigatory Powers Commissioner’s Office. Civil society have been highly critical of this so-called ‘double lock’ mechanism which they have long argued effectively constitutes a diluted form of independent judicial oversight. Consequently, this important determination by the Grand Chamber has significant implications for the UK legislation currently in force and calls into question its compatibility with Article 8 ECHR and the UK Human Rights Act 1998.
Ultimately, the legal assessment and outcome of the Grand Chamber majority judgment in Big Brother Watch will be unsurprising to those familiar with its recent case law dealing with bulk surveillance systems and data retention. It will still, nevertheless, be a disappointment to civil society groups who had urged the ECtHR to adopt at least some – if not all – of the high standards the CJEU continues to establish in its related landmark cases. Standards that have in fact been built on the previously lauded standard-setting jurisprudence of the ECtHR. Indeed, it has already been observed that both Grand Chamber judgments represent the ‘permanent normalization of mass surveillance in human rights terms’.
These Grand Chamber judgments also have broader implications for the scrutiny of State surveillance programmes across Europe and the ECHR legal order. The first is the clear departure for the ECtHR as an important driving force and its previously lauded role for setting minimum standards in the review of laws governing State surveillance of communications across Europe. Secondly, the general eight-part criteria and more lenient approach of the ECtHR’s joint analysis assessment for bulk interception regimes provides that there is now a clear and significant divergence between the rules and safeguards of the ECHR and EU legal systems with respect to the protection of fundamental rights and laws permitting bulk interception. Whatever comes next, the Grand Chamber has called a clear halt this week to any apparent shift by the ECtHR towards an outright finding that general and indiscriminate surveillance regimes may be incompatible with Article 8 ECHR.
Dr Nora Ni Loideain is Director and Lecturer in Law, Information Law & Policy Centre, Institute of Advanced Legal Studies, University of London and an Associate Fellow of the Leverhulme Centre for the Future of Intelligence, University of Cambridge. She is also a member of the UK Home Office Biometrics and Forensics Ethics Group (BFEG).
Her book, EU Data Privacy Law and Serious Crime, is forthcoming from Oxford University Press.