Regulation of investigatory powers: human rights

The Investigatory Powers Act 2016 contained sufficient safeguards against the risk of abuse of power and was not inconsistent with the requirement that interference with human rights had to be in accordance with the law. The Divisional Court, in dismissing the claimant’s application for judicial review and refusing a declaration of incompatibility, further held that recent disclosures made by the defendants about MI5’s handling procedures did not establish that the Act itself was incompatible with the European Convention on Human Rights.

The court previously determined the claimant’s judicial review challenge to Pt 4 of the Investigatory Powers Act 2016 (the IPA 2016), concerning powers to require the retention of communications data (not the content of communications, but other matters such as where, when and who), under EU law (see [2018] All ER (D) 129 (Apr)). It was now concerned with the second part of the claimant’s challenge, which arose under the Human Rights Act 1998 (the HRA 1998), and concerned other parts of the IPA 2016 which concerned bulk powers, rather than powers which were directed at any particular individual who might be a potential subject of interest. The claimant sought a declaration of incompatibility under the HRA 1998 s 4.

(1) Whether the IPA 2016 Pt 6 Ch 1, which related to bulk interception warrants, contained insufficient safeguards against the risk of abuse of discretionary powers, with the consequence that the Act itself was incapable of applying in a way which was compatible with European Convention on Human Rights.

The broad submission, that the IPA 2016 did not contain sufficient safeguards against the risk of abuse of discretionary powers, with the consequence that the IPA 2016 itself was incapable of applying in a way which is compatible with Convention rights, would not be accepted. The inter-locking provisions of the IPA 2016 did contain sufficient safeguards against the risk of abuse of discretionary powers (see [156] of the judgment) 

Ultimately, sight could not be lost of the fact that it was open to a person to make a complaint or bring a claim under the HRA 1998 to the Investigatory Powers Tribunal.  Therefore, the question of whether there had been a breach of the HRA 1998 on the facts of a particular case was something that could, in principle, be raised and adjudicated by an independent tribunal which could have access to all relevant material, including secret material.  That was another feature of the statutory scheme which established that it was not the IPA 2016 itself which could be said in the abstract to be incompatible with the Convention rights (see [170] of the judgment).  

Further, the fact that bulk interception warrants could include secondary data was compatible with the concept of ‘law’, in particular, the requirement of foreseeability. That was because the IPA 2016 did contain a set of inter-locking safeguards against the abuse of power. Those safeguards included the double-lock provisions, including the involvement of judicial commissioners and the general oversight regime provided by the Investigatory Powers Commissioner (see [174] of the judgment). 

Accordingly, the IPA 2016 was compatible with the Convention rights, in particular because it created an important set of inter-locking safeguards which were sufficient to meet the Convention requirement as to the quality of law (see [178] of the judgment). 

Liberty (The National Council of Civil Liberties) and others v Government Communications Headquarters and others [2015] 3 All ER 142 considered; Big Brother Watch and others v United Kingdom (Applications Nos. 58170/13, 62322/14 and 24960/15), [2018] All ER (D) 22 (Sep) considered.

(2) Whether, with respect to bulk and thematic equipment interference warrants, the IPA 2016 contained insufficient safeguards against the risk of abuse of discretionary power and, therefore, did not comply with the Convention concept of ‘in accordance with the law’ and the scope of application of the bulk equipment interference power was too wide to be compatible with arts 8 and 10.

The IPA 2016 itself was not incompatible with the Convention rights as alleged (see [195] of the judgment).  

The submission concerning the absence of the British Islands safeguard for non-protected material would not be accepted, essentially for the reasons as set out when rejecting a similar complaint in relation to secondary data in the context of bulk interception warrants (see [203] of the judgment). 

Further, the safeguards in the IPA 2016 were sufficient to prevent the risk of abuse of discretionary power and the Act was, therefore, not incompatible with the Convention rights on the ground that it did not comply with the concept of law. That was essentially for the reasons already set out as to the totality of the suite of inter-locking safeguards which were contained in the IPA 2016 and the codes under it (see [208] of the judgment). 

Further, the defendants’ submissions, that both the IPA 2016 and a code of practice contained provisions as to the need for specificity of warrants would be accepted (see [209] of the judgment). 

S and Marper v United Kingdom (Applications 30562/04 and 30566/04) (2008) 25 BHRC 557 considered; Privacy International v Secretary of State for Foreign and Commonwealth Affairs and another; Greennet Ltd and others v Secretary of State for Foreign and Commonwealth Affairs and another [2016] All ER (D) 127 (Feb) considered.

(3) Whether the bulk personal datasets (BPD) powers conferred by the IPA 2016 Pt 7 were too wide to be compatible with arts 8 and 10 of the Convention because virtually any data could be retained and examined under a BPD warrant, so long as it comprised personal data held electronically.

The submission, that the BPD powers conferred by Pt 7 were too wide to be compatible with arts 8 and 10 because virtually any data could be retained and examined under a BPD warrant, would not be accepted. The question for the court was whether the legislation as enacted, and not actual practices or activity, was incompatible with arts 8 or 10. Here the key issue was whether the legislation indicated the scope of the powers conferred and the manner in which they might be exercised with sufficient clarity to give adequate protection against arbitrary interference. The statutory requirement that both the Secretary of State and the independent Judicial Commissioners had to apply necessity and proportionality tests to a properly formulated application was designed to ensure that retention of the kind which had been found to be in breach of the Convention would not be authorised and would, therefore, be prohibited. The conclusion was similar to that reached on the challenge regarding the general and indiscriminate retention of data under the IPA 2016 Pt 4. It was wrong, as a matter of principle, to argue that Pt 7 was incompatible with arts 8 and 10 by advancing factual scenarios which would be incompatible with legal principles (and independent mechanisms to give effect to those principles) enshrined in the IPA 2016 itself (see [224] of the judgment). 

A similar conclusion would be reached on the claimant’s related argument that the legislation gave the Secretary of State a choice as to whether to issue a warrant for the retention of a BPD either in the form of a class BPD warrant or a specific BPD warrant.   If, on a given set of facts, it was not necessary or proportionate to issue a class BPD warrant because a less intrusive specific BPD warrant could be issued to address the purpose of the application, then neither the Secretary of State would be able to issue, nor a Judicial Commissioner to approve, the issuing of a class BPD warrant (see [225] of the judgment).  

The IPA 2016 Pt 7 neither authorised an agency to obtain data, nor to retain data which could not otherwise be retained under other legislation.  Instead, it required the retention of BPD previously obtained under other regimes to be subjected to the safeguards introduced by Pt 7, not least the double lock provision, requiring independent scrutiny and approval through the warrantry procedure and the subsequent monitoring of the audit process of the powers used (see [227] of the judgment).  

There was no force in the criticisms which the claimant made as to Pt 7 for failing to include the British Islands safeguard for the examination of BPDs, especially in view of the fact that that power did not have to be exercised mainly in relation to overseas-related communications, and certainly nothing which could justify a finding of incompatibility of the IPA 2016 with arts 8 and 10 (see [231] of the judgment).  

The double-lock provisions and other safeguards contained in Pt 7 were sufficient to prevent arbitrary interference with rights under arts 8 and 10. Those safeguards were adequate where BPD had been obtained under provisions not contained in the IPA 2016. The regime established by that IPA 2016 was adequate to ensure that BPD was not brought within the scope of Pt 7 from other parts of the IPA 2016 without ensuring that sufficient safeguards continued to apply to the retention and use of that data (see [240] of the judgment). 

S and Marper v United Kingdom (Applications 30562/04 and 30566/04) (2008) 25 BHRC 557 considered.

(4) Whether the examination of communications data under bulk acquisition warrants breached arts 8 or 10 of the Convention.

It was not accepted that the safeguards applicable to an examination of communications data under bulk acquisition warrants, absent a British Islands safeguard, failed to provide adequate protection against arbitrary interference with rights under arts 8 or 10. There was no basis to conclude that the IPA 2016 Pt 6 Ch 2 was not in accordance with the law and, therefore, incompatible with arts 8 or 10 (see [261], [264] of the judgment). 

Big Brother Watch and others v United Kingdom (Applications Nos. 58170/13, 62322/14 and 24960/15), [2018] All ER (D) 22 (Sep) considered; Privacy International v Secretary of State for Foreign and Commonwealth Affairs and others [2018] 2 All ER 166 applied.

(5) Whether the purposes for which the powers in the IPA 2016 Pts 3 and 4 might be exercised were too wide, the range of authorities that might obtain communications data under Pt 3 was too wide, and certain procedures under Pt 4 were insufficiently clear and detailed.

None of the points raised would be accepted. The suggestion that the purposes for which Pts 3 and 4 might be exercised were too wide or arbitrary would not be accepted. First, those purposes had been reduced in scope. Second, the powers were concerned with communications data. Third, the powers in Pts 3 and 4 were subject to the necessity and proportionality tests. Fourth, the powers are subject to Judicial Commissioners or Office for Communications Data Authorisations approval where necessary. Fifth, certain of the powers were limited to specific operations or investigations. Sixth, the mere fact that under Pt 3, powers might be obtained by a range of public authorities did not support an argument of incompatibility. The key consideration was what were the relevant powers, procedures and safeguards, and how were they defined. Nothing in the material indicated that Parliament had enacted legislation giving rise to the risk of arbitrary interference or any other incompatibility with the Convention rights (see [270] of the judgment).

(6) Whether, with respect to lawyer-client communications, the legislation failed to provide safeguards in relation to the bulk acquisition of secondary data and non-protected material and data, and for the bulk acquisition of communications data.

Even if legally privileged items falling outside the scope of content were intercepted or obtained under a warrant, they were subject to the third safeguard in the IPA 2016 s 153(9)-(14), and also ss 55, 131, 194(9)-(14) and 223. The Investigatory Powers Commissioner had to apply the dual tests of whether: (i) the public interest in retention outweighed the public interest in the confidentiality of legally privileged items; and (ii) retention was necessary for national security or for preventing death or significant injury. Subject to the outcome of the Investigatory Powers Commissioner’s assessment applying those tests, the Commissioner might direct destruction of the items in question or the imposition of conditions on their retention or use (see [285] of the judgment). 

The requirement under that third safeguard for both tests to be applied, if a legally privileged item was intercepted or obtained, also met, in substance, the claimant’s criticism that the first safeguard did not require those tests to be applied where the use of selection criteria for examination was only likely to identify legally privileged items, as opposed to its being a purpose of using those criteria to identify such items.  The protections under the third safeguard were not confined to content, protected material or protected data, but applied also to secondary data and to non-protected material or data (see [286] of the judgment).  

Further, neither European Court of Human Rights nor domestic jurisprudence laid down a general requirement for prior independent authorisation of the interference in order to achieve compatibility with art 8 in relation to legally privileged items (see [287] of the judgment).  

Although communications data might reveal when a communication occurred, between which devices and for how long, it would not reveal what had been discussed or the subject-matter. Therefore, it would not touch upon the central purpose of legal privilege, namely to enable a client to disclose whatever he wished to in order to obtain legal advice, without the fear of that material being disclosed to others without his consent (see [291] of the judgment). 

Accordingly, the rules regarding legally privileged items were set out in the IPA 2016 and codes of practice with sufficient clarity and with sufficient safeguards so as to avoid arbitrary interference, and so as to render the statutory scheme compatible with art 8 (see [292] of the judgment).

(7) Whether there were insufficient safeguards for the protection of confidential journalistic material in the IPA 2016, in particular, the confidential sources of journalists.

The provisions of the IPA 2016 were not incompatible with art 10 of the Convention, in so far as it was suggested that there were inadequate protections for journalistic material. Those submissions would require the court to go where the European Court of Human Rights had (to date) not itself been prepared to go. It would not be appropriate to anticipate what the Grand Chamber might say about that (see [337] of the judgment).

R (on the application of Miranda) v Secretary of State for the Home Department and another (Liberty and others intervening) [2016] All ER (D) 123 (Jan) distinguished; Telegraaf Media Nederland Landelijke Media BV v Netherlands (Application No 39315/06) (2012) 34 BHRC 193 considered; Big Brother Watch and others v United Kingdom (Applications Nos. 58170/13, 62322/14 and 24960/15), [2018] All ER (D) 22 (Sep) considered; R (on the application of Ullah) v Special Adjudicator; Do v Secretary of State for the Home Department [2004] 3 All ER 785 considered; R (on the application of Al-Skeini) v Secretary of State for Defence [2007] 3 All ER 685 considered.

(8) Whether the way in which the Security Service (MI5) had, in fact, operated its handling procedures in the last few years had been unlawful and that demonstrated that the safeguards in the IPA 2016 against the risk of abuse of power, even if they had been adequate in theory, were not effective in practice.

The seriousness of the matters which had been raised on behalf of the claimant as a result of the recent disclosure of documents would not be underestimated. However, what they went to was a different question from the one which the court had to address in the proceedings. That was the question of whether and to what extent MI5 had complied with the requirements of the law either in the past or now (see [387] of the judgment). 

In the end, it was not established that the issue provided a basis for making a declaration of incompatibility in respect of the IPA 2016. First, the issue was different from the issue of whether acts of the executive might have been unlawful under the IPA 2016. The question before the court now was whether the IPA 2016 itself was incompatible with the Convention rights (see [388] of the judgment). 

Second and in any event, it was not established that the evidence which had now been made available, in fact, proved that the safeguards created by the IPA 2016 were insufficient to prevent abuse of the powers under challenge. If anything, the fact that that had emerged and the findings which had been made by the Investigatory Powers Commissioner indicated that the system was, in truth, capable of preventing abuse (see [389] of the judgment). 

Third, the recent disclosure had concerned only MI5 and not, for example, the Secret Intelligence Service (MI6) or Government Communications Headquarters.  Yet the claimant’s submission would have the consequence that the IPA 2016, as such, would be declared to be incompatible with the Convention rights (see [390] of the judgment).  

Finally, the claimant’s submission, if correct, would lead to potentially absurd consequences. Suppose the claimant was right and there were defects in the IPA 2016 which should be the subject of a declaration of incompatibility. Presumably, the claimant would then expect those defects to be remedied by Parliament (or by way of a remedial order). However compatible or even perfect the IPA 2016 then was, on the claimant’s case, the fact that MI5 had been found to have defective handling procedures by the Investigatory Powers Commissioner would mean that even a new, amended Act could not be implemented. That underlined the point that the defects which had been found did not lead to the necessary consequence that the IPA 2016 itself was incompatible with the Convention rights (see [391] of the judgment). 

Privacy International v Secretary of State for Foreign and Commonwealth Affairs and others [2017] 3 All ER 647 considered; Privacy International v Secretary of State for Foreign and Commonwealth Affairs and others [2018] 2 All ER 166 considered.

Martin Chamberlain QC, Ben Jaffey QC and David Heaton (instructed by Bhatt Murphy) for the claimant.

James Eadie QC, Gerry Facenna QC, Julian Milford and Michael Armitage (instructed by the Government Legal Department) for the defendants.

Angus McCullough QC and Rachel Toney (instructed by Special Advocates’ Support Office) as Special Advocates.

Jude Bunting (instructed by Bindmans) for the National Union of Journalists, as intervener.

Karina Weller - Solicitor (NSW) (non-practising).