GRAND CHAMBER
 
 
 
CASE OF BIG BROTHER WATCH AND OTHERS
v. THE UNITED KINGDOM
 
(Applications nos. 58170/13, 62322/14 and 24960/15)
 
 
 
JUDGMENT
 
Art 8 • Private life • Convention compliance of secret surveillance regime including bulk interception of communications and intelligence sharing • Need to develop case-law in light of important differences between targeted interception and bulk interception • Adapted test for examining bulk interception regimes through global assessment • Focus on “end-to-end safeguards” to take into account the increasing degree of intrusion with privacy rights as the bulk interception process moves through different stages • Fundamental deficiencies present in bulk interception regime, through absence of independent authorisation, failure to include categories of selectors in the application for a warrant, and failure to subject selectors linked to an individual to prior internal authorisation • Sufficient foreseeability and safeguards in regime for receipt of intelligence from foreign intelligence services • Regime for acquisition of communications data from communications service providers not “in accordance with law”
Art 10 • Freedom of expression • Insufficient protection of confidential journalist material under electronic surveillance schemes

 
STRASBOURG
 
25 May 2021
 
 
This judgment is final but it may be subject to editorial revision. In the case of Big Brother Watch and Others v. the United Kingdom,
The European Court of Human Rights, sitting as a Grand Chamber composed of:
 Robert Spano, President,
 Jon Fridrik Kjølbro,
 Angelika Nußberger,
 Paul Lemmens,
 Yonko Grozev,
 Vincent A. De Gaetano,
 Paulo Pinto de Albuquerque,
 Faris Vehabović,
 Iulia Antoanella Motoc,
 Carlo Ranzoni,
 Mārtiņš Mits,
 Gabriele Kucsko-Stadlmayer,
 Marko Bošnjak,
 Tim Eicke,
 Darian Pavli,
 Erik Wennerström,
 Saadet Yüksel, judges,
and Søren Prebensen, Deputy Grand Chamber Registrar,
Having deliberated in private on 11 July 2019, on 4 and 6 September 2019 and on 17 February 2021,
Delivers the following judgment, which was adopted on the last‑mentioned date:
PROCEDURE
1. The case originated in three applications (nos. 58170/13, 62322/14 and 24960/15) against the United Kingdom of Great Britain and Northern Ireland lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by the companies, charities, organisations and individuals listed in the annex (“the applicants”) on 4 September 2013, 11 September 2014 and 20 May 2015 respectively. 2. The applicants were represented by Mr D. Carey, of Deighton Pierce Glynn Solicitors; Ms R. Curling, of Leigh Day and Co. Solicitors; and Ms E. Norton, of Liberty. The United Kingdom Government (“the Government”) were represented by their Agent, Mr C. Wickremasinghe, of the then Foreign and Commonwealth Office. 3. The applicants complained about the scope and magnitude of the electronic surveillance programmes operated by the Government of the United Kingdom. 4. The applications were communicated to the Government on 7 January 2014, 5 January 2015 and 24 November 2015. In the first case, leave to intervene was granted to Human Rights Watch, Access Now, Dutch Against Plasterk, Center For Democracy & Technology, European Network of National Human Rights Institutions and the Equality and Human Rights Commission, the Helsinki Foundation For Human Rights, the International Commission of Jurists, Open Society Justice Initiative, The Law Society of England and Wales and Project Moore. In the second case, leave to intervene was granted to the Center For Democracy & Technology, the Helsinki Foundation For Human Rights, the International Commission of Jurists, the National Union of Journalists and the Media Lawyers’ Association. In the third case, leave to intervene was granted to Article 19, the Electronic Privacy Information Center and to the Equality and Human Rights Commission. 5. On 4 July 2017, a Chamber of the First Section decided to join the applications and hold an oral hearing. That hearing took place in public in the Human Rights Building, Strasbourg, on 7 November 2017. On 13 September 2018, a Chamber of that Section, composed of Linos‑Alexandre Sicilianos, Kristina Pardalos, Aleš Pejchal, Ksenija Turković, Armen Harutyunyan, Pauliine Koskelo and Tim Eicke, judges, and Abel Campos, Section Registrar, gave judgment. The Chamber unanimously declared inadmissible the complaints made by the applicants in the third of the joined cases concerning Article 6, Article 10, in so far as the applicants relied on their status as NGOs, and Article 14, and declared admissible the remainder of the complaints made by those applicants. By a majority, it declared admissible the complaints made by the applicants in the first and second of the joined cases. Also by a majority, it held that there had been a violation of Articles 8 and 10 of the Convention in respect of both the section 8(4) regime and the Chapter II regime, and it held that there had been no violation of Article 8 of the Convention in respect of the intelligence sharing regime. The partly concurring, partly dissenting opinion of Judge Koskelo, joined by Judge Turković, and the joint partly dissenting and partly concurring opinion of Judges Pardalos and Eicke were annexed to the judgment. 6. On 12 December 2018 and 11 December 2018 respectively, the applicants in the first and third of the joined cases requested the referral of the case to the Grand Chamber in accordance with Article 43 of the Convention. On 4 February 2019, the panel of the Grand Chamber granted that request. 7. The composition of the Grand Chamber was determined according to the provisions of Article 26 §§ 4 and 5 of the Convention and Rule 24 of the Rules of Court. 8. The applicants and the Government each filed observations (Rule 59 § 1) on the admissibility and merits of the case. 9. The President of the Grand Chamber granted leave to intervene in the written procedure, in accordance with Article 36 § 2 of the Convention and Rule 44 § 3 of the Rules, to the Governments of France, Norway and the Netherlands, and to the United Nations’ Special Rapporteur on the promotion of the right to freedom of opinion and expression. 10. A hearing took place in public in the Human Rights Building, Strasbourg, on 10 July 2019. There appeared before the Court:
(a)  for the Government
Mr C. Wickremasinghe, Agent,
Mr J. Eadie Q.C. and
Mr J. Mitford, Counsel,
Mr R. Yardley,
Ms L. Morgan,
Mr H. Mawby,
Mr T. Rutherford and
Mr J. Keay-Bright, Advisers;
(b)  for the applicants
Mr B. Jaffey Q.C.,
Ms H. Mountfield Q.C.,
Mr C. McCarthy,
Mr R. Mehta,
Ms G. Sarathy and
Mr D. Heaton, Counsel,
Mr D. Carey and
Ms R. Curling,  Advisers. 11. The Court heard addresses by Mr Eadie, Mr Jaffey and Ms Mountfield, as well as their replies to questions. THE FACTS
BACKGROUND
12. The three applications were introduced following revelations by Edward Snowden concerning the electronic surveillance programmes operated by the intelligence services of the United States of America and the United Kingdom. 13. The applicants, who are listed in the Appendix, all believed that due to the nature of their activities, their electronic communications were likely to have either been intercepted by the United Kingdom intelligence services; obtained by the United Kingdom intelligence services after being intercepted by foreign governments; and/or obtained by the United Kingdom authorities from communications service providers (“CSPs”). THE RELEVANT INTERNET SECRET SURVEILLANCE SCHEMES
14. Internet communications are primarily carried over international sub‑marine fibre optic cables operated by CSPs. Each cable may carry several “bearers”, and there are approximately 100,000 of these bearers joining up the global Internet. A single communication over the Internet is divided into “packets” (units of data) which may be transmitted separately across multiple bearers. These packets will travel via a combination of the quickest and cheapest paths. Consequently, some or all of the packets of any particular communication sent from one person to another, whether within the United Kingdom or across borders, may be routed through one or more other countries if that is the optimum path for the CSPs involved. The United KingdomBulk interception

15. The Edward Snowden revelations made in 2013 indicated that Government Communications Headquarters (“GCHQ”, being one of the United Kingdom intelligence services) was running an operation, codenamed “TEMPORA”, which allowed it to tap into and store huge volumes of data drawn from bearers. The United Kingdom authorities neither confirmed nor denied the existence of an operation codenamed TEMPORA. 16. However, according to the March 2015 Report of the Intelligence and Security Committee of Parliament (“the ISC report” – see paragraphs 142‑149 below), GCHQ was operating two major processing systems for the bulk interception of communications. 17. The first of the two processing systems referred to in the ISC report was targeted at a very small percentage of bearers. As communications flowed across the targeted bearers, the system compared the traffic against a list of “simple selectors”. These were specific identifiers (for example, an email address) relating to a known target. Any communications which matched the simple selectors were collected; those that did not were automatically discarded. Analysts then carried out a “triage process” in relation to collected communications to determine which were of the highest intelligence value and should therefore be opened and read. In practice, only a very small proportion of the items collected under this process were opened and read by analysts. According to the ISC report, GCHQ did not have the capacity to read all communications. 18. The second processing system was targeted at an even smaller number of bearers (a subset of those accessed by the process described in the paragraph above) which were deliberately targeted as those most likely to carry communications of intelligence interest. This second system had two stages: first, the initial application of a set of “processing rules” designed to discard material least likely to be of value; and secondly, the application of complex queries to the selected material in order to draw out those likely to be of the highest intelligence value. Those searches generated an index, and only items on that index could be examined by analysts. All communications which were not on the index had to be discarded. 19. The legal framework for bulk interception in force at the relevant time is set out in detail in the “relevant domestic law” section below. In brief, section 8(4) of the Regulation of Investigatory Powers Act 2000 (“RIPA” – see paragraph 72 below) allowed the Secretary of State to issue warrants for the “interception of external communications”, and pursuant to section 16 of RIPA (see paragraphs 84-92 below) intercepted material could not be selected to be read, looked at or listened to, “according to a factor which is referable to an individual who is known to be for the time being in the British Islands”. Intelligence sharing
20. Chapter 12 of the Interception of Communications Code of Practice (“the IC Code” – see paragraph 116 below) set out the circumstances in which the United Kingdom intelligence services could request intelligence from foreign intelligence services, and the procedures which had to be followed for making such a request. Chapter 12 was added to the IC Code after the Investigatory Powers Tribunal (“the IPT”) ordered the intelligence services to disclose their arrangements for intelligence sharing in the course of the proceedings brought by the applicants in the third of the joined cases (“the Liberty proceedings” – see paragraphs 28-60 below). Acquisition of communications data from CSPs
21. Chapter II of RIPA and the accompanying Acquisition of Communications Data Code of Practice governed the process by which certain public authorities could request communications data from CSPs (see paragraphs 117-121 below). The United States
22. The National Security Agency (“NSA”) acknowledged the existence of two operations called PRISM and Upstream. PRISM
23. PRISM was a programme through which the United States’ Government obtained intelligence material (such as communications) from Internet Service Providers (“ISPs”). Access under PRISM was specific and targeted (as opposed to a broad “data mining” capability). The United States’ administration stated that the programme was regulated under the Foreign Intelligence Surveillance Act (“FISA”), and applications for access to material through PRISM had to be approved by the Foreign Intelligence Surveillance Court (“FISC”). 24. Documents from the NSA leaked by Edward Snowden suggested that GCHQ had access to PRISM since July 2010 and used it to generate intelligence reports. GCHQ acknowledged that it acquired information from the United States’ which had been obtained via PRISM. Upstream
25. According to the leaked documents, the Upstream programme allowed the collection of content and communications data from fibre optic cables and infrastructure owned by United States’ CSPs. This programme had broad access to global data, in particular that of non-US citizens, which could then be collected, stored and searched using keywords (for further details, see paragraphs 261-264 below). DOMESTIC PROCEEDINGS IN THE FIRST AND SECOND OF THE JOINED CASES
26. The applicants in the first of the joined cases (application no. 58170/13) sent a pre-action protocol letter to the Government on 3 July 2013 setting out their complaints and seeking declarations that sections 1 and 3 of the Intelligence Services Act 1994 (“the ISA” – see paragraphs 108 and 110 below), section 1 of the Security Services Act 1989 (“the SSA” – see paragraph 106 below) and section 8 of RIPA (see paragraph 66 below) were incompatible with the Convention. In their reply of 26 July 2013, the Government stated that the effect of section 65(2) of RIPA was to exclude the jurisdiction of the High Court in respect of human rights complaints against the intelligence services, but that the applicants’ complaints could have been raised before the IPT. The IPT was a specialised Tribunal established under RIPA to hear allegations by citizens of wrongful interference with their communications as a result of conduct covered by that Act, and it was endowed with exclusive jurisdiction to investigate any complaint that a person’s communications had been intercepted and, where interception had occurred, to examine the authority for such interception (see paragraphs 122-133 below). However, no further action was taken by these applicants. 27. The applicants in the second of the joined cases (application no. 62322/14) did not bring any domestic proceedings as they did not believe that they had an effective remedy for their Convention complaints. DOMESTIC PROCEEDINGS IN THE THIRD OF THE JOINED CASES
28. The ten human rights organisations which are the applicants in the third of the joined cases (application no. 24960/15) each lodged a complaint before the IPT between June and December 2013 (hereinafter “the Liberty proceedings”). They alleged that the intelligence services, the Home Secretary and the Foreign Secretary had acted in violation of Articles 8, 10, and 14 of the Convention by: (i) accessing or otherwise receiving intercepted communications and communications data from the United States Government under the PRISM and Upstream programmes (“the PRISM issue”); and (ii) intercepting, inspecting and retaining their communications and their communications data under the TEMPORA programme (“the section 8(4) issue”). 29. On 14 February 2014, the IPT ordered that the ten cases be joined. It subsequently appointed Counsel to the Tribunal (see paragraph 132 below), whose function was to assist the IPT in whatever way it directed, including by making representations on issues in relation to which not all parties could be represented (for example, for reasons of national security). 30. In their response to the applicants’ claims, the Government adopted a “neither confirm nor deny” approach, that is to say, they declined to confirm or deny whether the applicants’ communications had actually been intercepted. It was therefore agreed that the IPT would determine the legal issues on the basis of assumed facts to the effect that the NSA had obtained the applicants’ communications and communications data via PRISM or Upstream and had passed them to GCHQ, where they had been retained, stored, analysed and shared; and that the applicants’ communications and communications data had been intercepted by GCHQ under the TEMPORA programme and had been retained, stored, analysed and shared. The question was whether, on these assumed facts, the interception, retention, storage and sharing of data was compatible with Articles 8 and 10, taken alone and together with Article 14 of the Convention. The hearing
31. The IPT, composed of two High Court Judges, a Circuit Judge and two senior barristers, held a five-day, public hearing from 14-18 July 2014. The Government requested an additional closed hearing in order to enable the IPT to consider GCHQ’s unpublished – described during the public hearing as “below the waterline” – internal arrangements for processing intercept material. The applicants objected, arguing that the holding of a closed hearing was not justified and that the failure to disclose the arrangements to them was unfair. 32. The request for a closed hearing was granted pursuant to Rule 9 of the IPT’s Rules of Procedure (see paragraph 129 below). On 10 September 2014 a closed hearing took place at which the IPT was “assisted by the full, perceptive and neutral participation ... of Counsel to the Tribunal”, who performed the following roles: (i) identifying documents, parts of documents or gists that ought properly to be disclosed; (ii) making such submissions in favour of disclosure as were in the interests of the Claimants and open justice; and (iii) ensuring that all the relevant arguments (from the Claimants’ perspective) on the facts and the law were put before the IPT. 33. In the closed hearing, the IPT examined the internal (“below the waterline”) arrangements regulating the conduct and practice of the intelligence services. On 9 October 2014 it notified the applicants that it was of the view that there was some closed material which could be disclosed. It explained that it had invited the Government to disclose the material and that the Government had agreed to do so. The material was accordingly provided to the applicants in a note (“the 9 October disclosure”) and the parties were invited to make submissions to the IPT on the disclosed material. 34. The applicants sought information on the context and source of the disclosure but the IPT declined to provide further details. The applicants made written submissions on the disclosure. 35. The respondents subsequently amended and amplified the disclosed material. 36. Following final disclosures made on 12 November 2014, the 9 October disclosure provided as follows:
“The US Government has publicly acknowledged that the Prism system and Upstream programme ... permit the acquisition of communications to, from, or about specific tasked selectors associated with non-US persons who are reasonably believed to be located outside the United States in order to acquire foreign intelligence information. To the extent that the Intelligence Services are permitted by the US Government to make requests for material obtained under the Prism system (and/or ... pursuant to the Upstream programme), those requests may only be made for unanalysed intercepted communications (and associated communications data) acquired in this way. 1. A request may only be made by the Intelligence Services to the government of a country or territory outside the United Kingdom for unanalysed intercepted communications (and associated communications data), otherwise than in accordance with an international mutual legal assistance agreement, if either:
a relevant interception warrant under [RIPA] has already been issued by the Secretary of State, the assistance of the foreign government is necessary to obtain the communications at issue because they cannot be obtained under the relevant RIPA interception warrant and it is necessary and proportionate for the Intelligence Services to obtain those communications; or
making the request for the communications at issue in the absence of a relevant RIPA interception warrant does not amount to a deliberate circumvention of RIPA or otherwise contravene the principle established in Padfield v. Minister of Agriculture, Fisheries and Food [1968] AC 997 [that a public body is required to exercise its discretionary powers to promote (and not to circumvent) the policy and the objects of the legislation which created those powers] (for example, because it is not technically feasible to obtain the communications via RIPA interception), and it is necessary and proportionate for the Intelligence Services to obtain those communications. In these circumstances, the question whether the request should be made would be considered and decided upon by the Secretary of State personally. Any such request would only be made in exceptional circumstances, and has not occurred as at the date of this statement.
... 2. Where the Intelligence Services receive intercepted communications content or communications data from the government of a country or territory outside the United Kingdom, irrespective of whether it is/they are solicited or unsolicited, whether the content is analysed or unanalysed, or whether or not the communications data are associated with the content of communications, the communications content and data are, pursuant to internal ‘arrangements’, subject to the same internal rules and safeguards as the same categories of content or data, when they are obtained directly by the Intelligence Services as a result of interception under RIPA. 3. Those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s.8(4) warrant have internal ‘arrangements’ that require a record to be created, explaining why access to the unanalysed intercepted material is required, before an authorised person is able to access such material pursuant to s.16 of RIPA. 4. The internal ‘arrangements’ of those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s.8(4) warrant specify (or require to be determined, on a system-by-system basis) maximum retention periods for different categories of such data which reflect the nature and intrusiveness of the particular data at issue. The periods so specified (or determined) are normally no longer than 2 years, and in certain cases are significantly shorter (intelligence reports that draw on such data are treated as a separate category, and are retained for longer). Data may only be retained for longer than the applicable maximum retention period where prior authorisation has been obtained from a senior official within the particular Intelligence Service at issue on the basis that continued retention of the particular data at issue has been assessed to be necessary and proportionate (if the continued retention of any such data is thereafter assessed no longer to meet the tests of necessity and proportionality, such data are deleted). As far as possible, all retention periods are implemented by a process of automated deletion which is triggered once the applicable maximum retention period has been reached for the data at issue. The maximum retention periods are overseen by, and agreed with the Commissioner. As regards related communications data in particular, Sir Anthony May made a recommendation to those of the Intelligence Services that receive unanalysed intercepted material and related communications data from interception under a s8(4) warrant, and the interim Commissioner (Sir Paul Kennedy) has recently expressed himself to be content with the implementation of that recommendation. 5. The Intelligence Services’ internal ‘arrangements’ under [the Security Services Act 1989], [the Intelligence Services Act 1994] and ss.15-16 of RIPA are periodically reviewed to ensure that they remain up-to-date and effective. Further, the Intelligence Services are henceforth content to consider, during the course of such periodic reviews, whether more of those internal arrangements might safely and usefully be put into the public domain (for example, by way of inclusion in a relevant statutory Code of Practice).”
The IPT’s first judgment of 5 December 2014
37. The IPT issued its first judgment on 5 December 2014. The judgment addressed the arrangements then in place for intercepting communications and receiving communications intercepted by foreign intelligence services. The PRISM issue
38. The IPT accepted that the PRISM issue engaged Article 8 of the Convention, albeit at a “lower level” than the regime under consideration in Weber and Saravia v. Germany (dec.), no. 54934/00, ECHR 2006‑XI. As a consequence, the authorities involved in processing communications received from foreign intelligence services had to comply with the requirements of Article 8, particularly in relation to their storage, sharing, retention and destruction. In the IPT’s view, following Bykov v. Russia [GC], no. 4378/02, §§ 76 and 78, 10 March 2009 and Malone v. the United Kingdom, 2 August 1984, Series A no. 82, in order for the interference to be considered “in accordance with the law”, there could not be unfettered discretion for executive action; rather, the nature of the rules had to be clear and the ambit of the rules had – in so far as possible – to be in the public domain. However, it considered it plain that in the field of national security, much less was required to be put in the public domain and the degree of foreseeability required by Article 8 had to be reduced, otherwise the whole purpose of the steps taken to protect national security would be at risk (citing Leander v. Sweden, 26 March 1987, § 51, Series A no. 116). 39. The IPT continued:
“41. We consider that what is required is a sufficient signposting of the rules or arrangements insofar as they are not disclosed ... We are satisfied that in the field of intelligence sharing it is not to be expected that rules need to be contained in statute (Weber) or even in a code (as was required by virtue of the Court’s conclusion in Liberty v. [the United Kingdom, no. 58243/00, 1 July 2008]). It is in our judgment sufficient that:
i)  Appropriate rules or arrangements exist and are publicly known and confirmed to exist, with their content sufficiently signposted, such as to give an adequate indication of it (as per Malone ...).
ii)  They are subject to proper oversight.”
40. The IPT noted that arrangements for information sharing were provided for in the statutory framework set out in the Security Service Act 1989 (see paragraphs 105-106 below) and the Intelligence Services Act 1994 (see paragraphs 107-110 below). It further referred to a witness statement made in the above-mentioned Liberty proceedings by Charles Farr, the Director-General of the Office for Security and Counter Terrorism (“OSCT”) at the Home Office, which explained that the statutory framework set out in those Acts was underpinned by detailed internal guidance, including arrangements for securing that the services only obtained the information necessary for the proper discharge of their functions. He further indicated that staff received mandatory training on the legal and policy framework in which they operated, including clear instructions on the need for strict adherence to the law and internal guidance. Finally, he stated that the full details of the arrangements were confidential since they could not be published safely without undermining the interests of national security. 41. The IPT acknowledged that as the arrangements were not made known to the public, even in summary form, they were not accessible. However, the IPT considered it significant that the arrangements were subject to oversight and investigation by the Intelligence and Security Committee of Parliament (“the ISC”) and the independent Interception of Communications Commissioner (“the IC Commissioner”). Furthermore, it itself was in a position to provide oversight, having access to all secret information, and being able to adjourn into closed hearing to assess whether the arrangements referred to by Mr Farr existed and were capable of giving the individual protection against arbitrary interference. 42. Having considered the “below the waterline” arrangements, the IPT was satisfied that the 9 October disclosure (as subsequently amended – see paragraphs 33 and 36 above) provided a clear and accurate summary of that part of the evidence given in the closed hearing, and that the rest of the evidence given in closed hearing was too sensitive for disclosure without risk to national security or to the “neither confirm nor deny” principle. It was further satisfied that the preconditions for requesting information from the Government of the United States of America were clear: there had to exist either a section 8(1) warrant, or a section 8(4) warrant within whose ambit the proposed target’s communications fell, together, if the individual was known to be in the British Islands, with a section 16(3) modification (see paragraph 86 below). Any request pursuant to PRISM or Upstream in respect of intercept or communications data was therefore subject to the RIPA regime, unless it fell within the wholly exceptional scenario outlined in 1(b) of the material disclosed after the first hearing. However, a 1(b) request had never occurred. 43. The IPT nevertheless identified the following “matter of concern”:
“Although it is the case that any request for, or receipt of, intercept or communications data pursuant to Prism and/or Upstream is ordinarily subject to the same safeguards as in a case where intercept or communication data are obtained directly by the Respondents, if there were a 1(b) request, albeit that such request must go to the Secretary of State, and that any material so obtained must be dealt with pursuant to RIPA, there is the possibility that the s.16 protection might not apply. As already indicated, no 1(b) request has in fact ever occurred, and there has thus been no problem hitherto. We are however satisfied that there ought to be introduced a procedure whereby any such request, if it be made, when referred to the Secretary of State, must address the issue of s.16(3).”
44. However, subject to this caveat, the IPT reached the following conclusions:
“(i)  Having considered the arrangements below the waterline, as described in this judgment, we are satisfied that there are adequate arrangements in place for the purpose of ensuring compliance with the statutory framework and with Articles 8 and 10 of the Convention, so far as the receipt of intercept from Prism and/or Upstream is concerned. (ii)  This is of course of itself not sufficient, because the arrangements must be sufficiently accessible to the public. We are satisfied that they are sufficiently signposted by virtue of the statutory framework to which we have referred and the Statements of the ISC and the Commissioner quoted above, and as now, after the two closed hearings that we have held, publicly disclosed by the Respondents and recorded in this judgment. (iii)  These arrangements are subject to oversight. (iv)  The scope of the discretion conferred on the Respondents to receive and handle intercepted material and communications data and (subject to the s.8(4) issues referred to below) the manner of its exercise, are accordingly (and consistent with Bykov - see paragraph 37 above) accessible with sufficient clarity to give the individual adequate protection against arbitrary interference.”
45. Finally, the IPT addressed an argument raised by Amnesty International only; namely, that the United Kingdom owed a positive obligation under Article 8 of the Convention to prevent or forestall the United States from intercepting communications, including an obligation not to acquiesce in such interception by receiving its product. However, the IPT, citing M. and Others v. Italy and Bulgaria, no. 40020/03, § 127, 31 July 2012, noted that “the Convention organs have repeatedly stated that the Convention does not contain a right which requires a High Contracting Party to exercise diplomatic protection, or espouse an applicant’s complaints under international law, or otherwise to intervene with the authorities of another State on his or her behalf”. The IPT therefore rejected this submission. The section 8(4) issue
46. The IPT formulated four questions to be decided in order to determine whether the section 8(4) regime (which provided the legal framework for the bulk interception of external communications) was compatible with the Convention:
“(1)  Is the difficulty of determining the difference between external and internal communications ... such as to cause the s.8(4) regime not to be in accordance with law contrary to Article 8(2)? (2)  Insofar as s.16 of RIPA is required as a safeguard in order to render the interference with Article 8 in accordance with law, is it a sufficient one? (3)  Is the regime, whether with or without s.16, sufficiently compliant with the Weber requirements, insofar as such is necessary in order to be in accordance with law? (4)  Is s.16(2) indirectly discriminatory contrary to Article 14 of the Convention, and, if so, can it be justified?”
47. In relation to the first question, the applicants had contended that following the “sea-change in technology since 2000”, substantially more communications were now external, and as a result the internal/external distinction in section 8(4) was no longer “fit for purpose”. While the IPT accepted that the changes in technology had been substantial, and that it was impossible to differentiate at interception stage between external and internal communications, it found that the differences in view as to the precise definition of “external communications” did not per se render the section 8(4) regime incompatible with Article 8 § 2. In this regard, it considered that the difficulty in distinguishing between “internal” and “external” communications had existed since the enactment of RIPA and the changes in technology had not materially added to the quantity or proportion of communications which could or could not be differentiated as being external or internal at the time of interception. At worst, they had “accelerated the process of more things in the world on a true analysis being external than internal”. In any case the distinction was only relevant at interception stage. The “heavy lifting” was done by section 16 of RIPA, which prevented intercepted material being selected to be read, looked at or listened to “according to a factor which is referable to an individual who is known to be for the time being in the British Islands” (see paragraphs 84-92 below). Furthermore, all communications intercepted under a section 8(4) warrant could only be considered for examination by reference to that section. 48. In respect of the second question, the IPT held that the section 16 safeguards, which applied only to intercept material and not to related communications data, were sufficient. Although it concluded that the Weber criteria also extended to communications data, it considered that there was adequate protection or safeguards by reference to section 15 of RIPA (see paragraphs 77-82 below). In addition, in so far as section 16 offered greater protection for communications content than for communications data, the difference was justified and proportionate because communications data were necessary to identify individuals whose intercepted material was protected by section 16 (that is, individuals known to be in the British Islands). 49. Turning to the third question, the IPT concluded that the section 8(4) regime was sufficiently compliant with the Weber criteria (being the criteria set out in Weber and Saravia, cited above, § 95; see also paragraphs 274 and 335 below) and was in any event “in accordance with the law”. With regard to the first and second requirements, it considered that the reference to “national security” was sufficiently clear (citing Esbester v. the United Kingdom (dec.), no. 18601/91, 2 April 1993 and Kennedy v. the United Kingdom, no. 26839/05, 18 May 2010); the absence of targeting at the interception stage was acceptable and inevitable, as it had been in Weber; on their face, the provisions of paragraph 5.2 of the IC Code, together with paragraphs 2.4, 2.5, 5.3, 5.4, 5.5 and 5.6 (see paragraph 96 below), were satisfactory; there was no call for search words to be included in an application for a warrant or in the warrant itself, as this would unnecessarily undermine and limit the operation of the warrant and might in any event be entirely unrealistic; and there was no requirement for the warrant to be judicially authorised. 50. In considering the third, fourth, fifth and sixth of the Weber criteria, the IPT had regard to the safeguards in sections 15 and 16 of RIPA, the IC Code, and the “below the waterline” arrangements. It did not consider it necessary that the precise details of all the safeguards should be published or contained in either statute or code of practice. Particularly in the field of national security, undisclosed administrative arrangements, which by definition could be changed by the executive without reference to Parliament, could be taken into account, provided that what was disclosed indicated the scope of the discretion and the manner of its exercise. This was particularly so when, as was the case here, the IC Code referred to the arrangements, and there was a system of oversight (being the IC Commissioner, the IPT itself, and the ISC) which ensured that these arrangements were kept under review. The IPT was satisfied that, as a result of what it had heard at the closed hearing, there was no large databank of communications data being built up and there were adequate arrangements in respect of the duration of the retention of data and their destruction. As with the PRISM issue, the IPT considered that the section 8(4) arrangements were sufficiently signposted in statute, in the IC Code, in the IC Commissioner’s reports and, now, in its own judgment. 51. As regards the fourth and final question, the IPT did not make any finding as to whether there was in fact indirect discrimination on grounds of national origin as a result of the different regimes applicable to individuals located in the British Islands and those located outside, since it considered that any indirect discrimination was sufficiently justified on the grounds that it was harder to investigate terrorist and criminal threats from abroad. Given that the purpose of accessing external communications was primarily to obtain information relating to those abroad, the consequence of eliminating the distinction would be the need to obtain a certificate under section 16(3) of RIPA (which exceptionally allowed access to material concerning persons within the British Islands intercepted under a section 8(4) warrant – see paragraph 86 below) in almost every case, which would radically undermine the efficacy of the section 8(4) regime. 52. Finally, the applicants had argued that the protection afforded by Article 10 of the Convention applied to investigatory NGOs in the same way it applied to journalists. Amnesty International initially alleged before the IPT that there were likely to be no adequate arrangements for material protected by legal professional privilege, a complaint which was subsequently “hived off” to be dealt with in the Belhadj case (see paragraphs 99-101 below), to which Amnesty International was joined as an additional claimant. No similar argument was made in respect of NGO confidence until 17 November 2014 (after the first and second open hearings). As the IPT considered that this argument could have been raised at any time, in its judgment it had been raised “far too late” to be incorporated into the ambit of the proceedings. 53. With regard to the remaining Article 10 complaints, the IPT noted that there was no separate argument over and above that arising in respect of Article 8. Although the IPT had regard to Sanoma Uitgevers B.V. v. the Netherlands [GC], no. 38224/03, 14 September 2010, it emphasised that the applicants’ case did not concern targeted surveillance of journalists or non-governmental organisations. In any case, in its view, in the context of untargeted monitoring via a section 8(4) warrant, it would be “clearly impossible” to anticipate a judicial pre-authorisation prior to the warrant limited to what might turn out to impact upon Article 10. Although the IPT accepted that an issue might arise in the event that, in the course of examination of the contents, some question of journalistic confidence arose, there were additional safeguards in the IC Code in relation to treatment of such material. 54. Following the publication of the judgment, the parties were invited to make submissions on whether, prior to the disclosures made to the IPT, the legal regime in place in respect of the PRISM issue complied with Articles 8 and 10, and on the proportionality and lawfulness of any alleged interception of their communications. The IPT did not see any need for further submissions on the proportionality of the section 8(4) regime as a whole. The IPT’s second judgment of 6 February 2015
55. In its second judgment of 6 February 2015, the IPT considered whether, prior to its December 2014 judgment, the PRISM or Upstream arrangements breached Article 8 and/or 10 of the Convention. 56. It agreed that it was only by reference to the 9 October disclosure as amended (see paragraphs 33 and 36 above) that it was satisfied the regime was “in accordance with the law”. The IPT was of the view that without the disclosures made, there would not have been adequate signposting, as was required under Articles 8 and 10. It therefore made a declaration that prior to the disclosures:
“23.  ... [T]he regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities pursuant to Prism and/or ... Upstream, contravened Articles 8 or 10 ECHR, but now complies.”
The IPT’s third judgment of 22 June 2015 as amended by its letter of 1 July 2015
57. The third judgment of the IPT, published on 22 June 2015, determined whether the applicants’ communications obtained under PRISM or Upstream had been solicited, received, stored or transmitted by the United Kingdom authorities in contravention of Articles 8 and/or 10 of the Convention; and whether the applicants’ communications had been intercepted, viewed, stored or transmitted by the United Kingdom authorities so as to amount to unlawful conduct or in contravention of Articles 8 and/or 10. 58. The IPT made no determination in favour of eight of the ten applicants. In line with its usual practice where it did not find in favour of a claimant, it did not confirm whether or not their communications had been intercepted. However, the IPT made determinations in relation to two applicants. The identity of one of the organisations was wrongly noted in the judgment and the error was corrected by the IPT’s letter of 1 July 2015. 59. In respect of Amnesty International, the IPT found that email communications had been lawfully and proportionately intercepted and accessed pursuant to section 8(4) of RIPA but that the time-limit for retention permitted under the internal policies of GCHQ had been overlooked and the material had therefore been retained for longer than permitted. However, the IPT was satisfied that the material had not been accessed after the expiry of the relevant retention time-limit and that the breach could be characterised as a technical one. It amounted nonetheless to a breach of Article 8 and GCHQ was ordered to destroy any of the communications which had been retained for longer than the relevant period and to deliver one hard copy of the documents within seven days to the IC Commissioner to retain for five years in case they were needed for any further legal proceedings. GCHQ was also ordered to provide a closed report within fourteen days confirming the destruction of the documents. No award of compensation was made. 60. In respect of the Legal Resources Centre, the IPT found that communications from an email address associated with the applicant had been intercepted and selected for examination under a section 8(4) warrant. Although it was satisfied the interception was lawful and proportionate and that selection for examination was proportionate, the IPT found that the internal procedure for selection had not been followed. There had therefore been a breach of the Legal Resources Centre’s Article 8 rights. However, the IPT was satisfied that no use was made of the material and that no record had been retained so the applicant had not suffered material detriment, damage or prejudice. Its determination therefore constituted just satisfaction and no compensation was awarded. RELEVANT LEGAL FRAMEWORK AND PRACTICE
RELEVANT DOMESTIC LAWThe interception of communicationsWarrants: general

61. Section 1(1) of RIPA 2000 (which has now been replaced by the Investigatory Powers Act 2016) rendered unlawful the interception of any communication in the course of its transmission by means of a public postal service or a public telecommunication system unless it took place in accordance with a warrant under section 5 (“intercept warrant”). 62. Section 5(2) allowed the Secretary of State to authorise an intercept warrant if he or she believed that it was necessary for the reasons set out in section 5(3), namely that it was in the interests of national security, for the purpose of preventing or detecting serious crime, or for safeguarding the economic well-being of the United Kingdom (so far as those interests are also relevant to the interests of national security – see paragraphs 3.5 and 6.11 of the IC Code at paragraph 96 below); and that the conduct authorised by the warrant was proportionate to what was sought to be achieved by that conduct. In assessing necessity and proportionality, account had to be taken of whether the information sought under the warrant could reasonably have been obtained by other means. 63. Section 81(2)(b) of RIPA defined “serious crime” as crime which satisfied one of the following criteria:
“(a)  that the offence or one of the offences that is or would be constituted by the conduct is an offence for which a person who has attained the age of twenty-one and has no previous convictions could reasonably be expected to be sentenced to imprisonment for a term of three years or more;
(b)  that the conduct involves the use of violence, results in substantial financial gain or is conduct by a large number of persons in pursuit of a common purpose.”
64. Section 81(5) provided:
“For the purposes of this Act detecting crime shall be taken to include–
(a)  establishing by whom, for what purpose, by what means and generally in what circumstances any crime was committed; and
(b)  the apprehension of the person by whom any crime was committed;
and any reference in this Act to preventing or detecting serious crime shall be construed accordingly ...”
65. Section 6 provided that in respect of the intelligence services, only the Director General of MI5, the Chief of MI6 and the Director of GCHQ could have applied for an intercept warrant. 66. There were two types of intercept warrant to which sections 5 and 6 applied: a targeted warrant as provided for by section 8(1), and an untargeted warrant as provided for by section 8(4). 67. By virtue of section 9 of RIPA, a warrant issued in the interests of national security or for safeguarding the economic well-being of the United Kingdom ceased to have effect at the end of six months, and a warrant issued for the purpose of detecting serious crime ceased to have effect after three months. At any time before the end of those periods, the Secretary of State was able to renew the warrant (for periods of six and three months respectively) if he or she believed that the warrant continued to be necessary on grounds falling within section 5(3). The Secretary of State was required to cancel an interception warrant if he or she was satisfied that the warrant was no longer necessary on grounds falling within section 5(3). 68. Pursuant to section 5(6), the conduct authorised by an interception warrant had to be taken to include the interception of communications not identified by the warrant if necessary to do what was expressly authorised or required by the warrant; and the obtaining of related communications data. 69. Section 21(4) defined “communications data” as
(a)    any traffic data comprised in or attached to a communication (whether by the sender or otherwise) for the purposes of any postal service or telecommunication system by means of which it is being or may be transmitted;
(b)    any information which includes none of the contents of a communication (apart from any information falling within paragraph (a)) and is about the use made by any person—
of any postal service or telecommunications service; or
in connection with the provision to or use by any person of any telecommunications service, of any part of a telecommunication system;
(c)    any information not falling within paragraph (a) or (b) that is held or obtained, in relation to persons to whom he provides the service, by a person providing a postal service or telecommunications service.”
70. The March 2015 Acquisition and Disclosure of Communications Data Code of Practice referred to these three categories as “traffic data”, “service use information”, and “subscriber information”. Section 21(6) of RIPA further defined “traffic data” as data which identified the person, apparatus, location or address to or from which a communication was transmitted, and information about a computer file or program accessed or run in the course of sending or receiving a communication. 71. According to section 20 of RIPA, “related communications data”, in relation to a communication intercepted in the course of its transmission by means of a postal service or telecommunication system, meant “so much of any communications data as was obtained by, or in connection with, the interception”; and related “to the communication or to the sender or recipient, or intended recipient, of the communication”. Warrants: section 8(4)
(a)   Authorisation
72. “Bulk interception” of communications was carried out pursuant to a section 8(4) warrant. Section 8(4) and (5) of RIPA allowed the Secretary of State to issue a warrant for “the interception of external communications in the course of their transmission by means of a telecommunication system”. 73. At the time of issuing a section 8(4) warrant, the Secretary of State was also required to issue a certificate setting out a description of the intercepted material which he or she considered it necessary to examine, and stating that he or she considered the examination of that material to be necessary for the reasons set out in section 5(3) (that is, that it was necessary in the interests of national security, for the purpose of preventing or detecting serious crime, or for safeguarding the economic well-being of the United Kingdom – so far as those interests are also relevant to the interests of national security; see s. 3.5 and 6.11 of the IC Code at paragraph 96 below). (b)   “External” communications
74. Section 20 defined “external communication” as “a communication sent or received outside the British Islands”. 75. In the course of the Liberty proceedings, Charles Farr, the Director General of the OSCT, indicated that two people in the United Kingdom who emailed each other were engaging in “internal communication” even if the email service was housed on a server in the United States of America; however, that communication could nevertheless be intercepted as a “by‑catch” of a warrant targeting external communications. On the other hand, a person in the United Kingdom who communicated with a search engine overseas was engaging in an external communication, as was a person in the United Kingdom who posted a public message (such as a tweet or Facebook status update), unless all the recipients of that message were in the British Islands. 76. Giving evidence to the ISC in October 2014, the Secretary of State for the Foreign and Commonwealth considered that:
“In terms of an email, if one or both of the sender or recipient is overseas then this would be an external communication. In terms of browsing the Internet, if an individual reads the Washington Post’s website, then they have ‘communicated’ with a web server located overseas, and that is therefore an external communication. In terms of social media, if an individual posts something on Facebook, because the web server is based overseas, this would be treated as an external communication. In terms of cloud storage (for example, files uploaded to Dropbox), these would be treated as external communications, because they have been sent to a web server overseas.”
Specific safeguards under RIPA
(a)   Section 15
77. Pursuant to Section 15(1), it was the duty of the Secretary of State to ensure, in relation to all interception warrants, that such arrangements were in force as he or she considered necessary for securing that the requirements of subsections (2) and (3) were satisfied in relation to the intercepted material and any related communications data; and, in the case of warrants in relation to which there were section 8(4) certificates, that the requirements of section 16 were also satisfied. 78. Section 15(2) provided:
“The requirements of this subsection are satisfied in relation to the intercepted material and any related communications data if each of the following–
the number of persons to whom any of the material or data is disclosed or otherwise made available,
the extent to which any of the material or data is disclosed or otherwise made available,
the extent to which any of the material or data is copied, and
the number of copies that are made,
is limited to the minimum that is necessary for the authorised purposes.”
79. Section 15(3) provided:
“The requirements of this subsection are satisfied in relation to the intercepted material and any related communications data if each copy made of any of the material or data (if not destroyed earlier) is destroyed as soon as there are no longer any grounds for retaining it as necessary for any of the authorised purposes.”
80. Pursuant to section 15(4), something was necessary for the authorised purposes if, and only if, it continued to be, or was likely to become, necessary as mentioned in section 5(3) of the Act (that is, it was necessary in the interests of national security, for the purpose of preventing or detecting serious crime; for the purpose of safeguarding the economic well-being of the United Kingdom (so far as those interests are also relevant to the interests of national security – see paragraphs 3.5 and 6.11 of the IC Code at paragraph 96 below); or for the purpose of giving effect to the provisions of any international mutual assistance agreement); it was necessary for facilitating the carrying out of any of the interception functions of the Secretary of State; it was necessary for facilitating the carrying out of any functions of the IC Commissioner or of the IPT; it was necessary to ensure that a person conducting a criminal prosecution had the information needed to determine what was required by his or her duty to secure the fairness of the prosecution; or it was necessary for the performance of any duty imposed on any person under public records legislation. 81. Section 15(5) required the arrangements in place to secure compliance with section 15(2) to include such arrangements as the Secretary of State considered necessary for securing that every copy of the material or data that was made was stored, for so long as it was retained, in a secure manner. 82. Pursuant to section 15(6), the arrangements to which section 15(1) referred were not necessary to secure that the requirements of section 15(2) and (3) were satisfied in so far as they related to any of the intercepted material or related communications data, or any copy of any such material or data, possession of which had been surrendered to any authorities of a country or territory outside the United Kingdom. However, such arrangements were required to secure, in the case of every such warrant, that possession of the intercepted material and data and of copies of the material or data were surrendered to authorities of a country or territory outside the United Kingdom only if the requirements of section 15(7) were satisfied. Section 15(7) provided:
“The requirements of this subsection are satisfied in the case of a warrant if it appears to the Secretary of State–
that requirements corresponding to those of subsections (2) and (3) will apply, to such extent (if any) as the Secretary of State thinks fit, in relation to any of the intercepted material or related communications data possession of which, or of any copy of which, is surrendered to the authorities in question; and
that restrictions are in force which would prevent, to such extent (if any) as the Secretary of State thinks fit, the doing of anything in, for the purposes of or in connection with any proceedings outside the United Kingdom which would result in such a disclosure as, by virtue of section 17, could not be made in the United Kingdom.”
83. Section 17 of RIPA provided that as a general rule no evidence could be adduced, disclosure made or other thing done in connection with legal proceedings which would disclose the content or related communications data of an intercepted communication. (b)   Section 16
84. Section 16 set out additional safeguards in relation to the interception of “external” communications under section 8(4) warrants. Section 16(1) required that intercepted material could only be read, looked at or listened to by the persons to whom it became available by virtue of the warrant if and to the extent that it had been certified as material the examination of which was necessary as mentioned in section 5(3) of the Act; and fell within section 16(2). Section 20 defined “intercepted material” as the contents of any communications intercepted by an interception to which the warrant related. 85. Section 16(2) provided:
“Subject to subsections (3) and (4), intercepted material falls within this subsection so far only as it is selected to be read, looked at or listened to otherwise than according to a factor which–
is referable to an individual who is known to be for the time being in the British Islands; and
has as its purpose, or one of its purposes, the identification of material contained in communications sent by him, or intended for him.”
86. Pursuant to section 16(3), intercepted material fell within section 16(2), notwithstanding that it was selected by reference to one of the factors mentioned in that subsection, if it was certified by the Secretary of State for the purposes of section 8(4) that the examination of material selected according to factors referable to the individual in question was necessary as mentioned in subsection 5(3) of the Act; and the material related only to communications sent during a period specified in the certificate that was no longer than the permitted maximum. 87. The “permitted maximum” was defined in section 16(3A) as follows:
(a)    in the case of material the examination of which is certified for the purposes of section 8(4) as necessary in the interests of national security, six months; and
(b)    in any other case, three months.”
88. Pursuant to section 16(4), intercepted material also fell within section 16(2), even if it was selected by reference to one of the factors mentioned in that subsection, if the person to whom the warrant was addressed believed, on reasonable grounds, that the circumstances were such that the material would fall within that subsection; or the conditions set out in section 16(5) were satisfied in relation to the selection of the material. 89. Section 16(5) provided:
“Those conditions are satisfied in relation to the selection of intercepted material if –
(a) it has appeared to the person to whom the warrant is addressed that there has been such a relevant change of circumstances as, but for subsection (4)(b), would prevent the intercepted material from falling within subsection (2);
(b) since it first so appeared, a written authorisation to read, look at or listen to the material has been given by a senior official; and
(c) the selection is made before the end of the permitted period.”
90. Pursuant to section 16(5A), the “permitted period” meant:
“(a) in the case of material the examination of which is certified for the purposes of section 8(4) as necessary in the interests of national security, the period ending with the end of the fifth working day after it first appeared as mentioned in subsection (5)(a) to the person to whom the warrant is addressed; and
(b) in any other case, the period ending with the end of the first working day after it first so appeared to that person.”
91. Section 16(6) explained that a “relevant change of circumstances” meant that it appeared that either the individual in question had entered the British Islands; or that a belief by the person to whom the warrant was addressed in the individual’s presence outside the British Islands was in fact mistaken. 92. Giving evidence to the ISC in October 2014, the Secretary of State for Foreign and Commonwealth Affairs explained that:
“When an analyst selects communications that have been intercepted under the authority of an 8(4) warrant for examination, it does not matter what form of communication an individual uses, or whether his other communications are stored on a dedicated mail server or in cloud storage physically located in the UK, the US or anywhere else (and in practice the individual user of cloud services will not know where it is stored). If he or she is known to be in the British Islands it is not permissible to search for his or her communications by use of his or her name, e-mail address or any other personal identifier.”
The Interception of Communications Code of Practice
93. Section 71 of RIPA provided for the adoption of codes of practice by the Secretary of State in relation to the exercise and performance of his or her powers and duties under the Act. Draft codes of practice had to be laid before Parliament and were public documents. They could only enter into force in accordance with an order of the Secretary of State. The Secretary of State could only make such an order if a draft of the order had been laid before Parliament and approved by a resolution of each House. 94. Under section 72(1) of RIPA, a person exercising or performing any power or duty relating to interception of communications had to have regard to the relevant provisions of a code of practice. The provisions of a code of practice could, in appropriate circumstances, be taken into account by courts and tribunals under section 72(4) of RIPA. 95. The IC Code was issued pursuant to section 71 of RIPA. The IC Code in force at the relevant time was issued in 2016. 96. In so far as relevant, that IC Code provided:
“3.2. There are a limited number of persons who can make an application for an interception warrant, or an application can be made on their behalf. These are:
The Director-General of the Security Service. The Chief of the Secret Intelligence Service. The Director of the Government Communications Headquarters (GCHQ). The Director-General of the National Crime Agency (NCA handles interception on behalf of law enforcement bodies in England and Wales). The Chief Constable of the Police Service of Scotland. The Commissioner of the Police of the Metropolis (the Metropolitan Police Counter Terrorism Command handles interception on behalf of Counter Terrorism Units, Special Branches and some police force specialist units in England and Wales). The Chief Constable of the Police Service of Northern Ireland. The Commissioners of Her Majesty’s Revenue & Customs (HMRC). The Chief of Defence Intelligence. A person who, for the purposes of any international mutual assistance agreement, is the competent authority of a country or territory outside the UK.
3.3. Any application made on behalf of one of the above must be made by a person holding office under the Crown.
3.4. All interception warrants are issued by the Secretary of State. Even where the urgency procedure is followed, the Secretary of State personally authorises the warrant, although it is signed by a senior official. Necessity and proportionality
3.5. Obtaining a warrant under RIPA will only ensure that the interception authorised is a justifiable interference with an individual’s rights under Article 8 (right to respect for private and family life) of the European Convention on Human Rights (ECHR) if it is necessary and proportionate for the interception to take place. RIPA recognises this by first requiring that the Secretary of State believes that the authorisation is necessary for one or more of the following statutory grounds:
In the interests of national security;
To prevent or detect serious crime;
To safeguard the economic well-being of the UK so far as those interests are also relevant to the interests of national security.
3.6. These purposes are set out in section 5(3) of RIPA. The Secretary of State must also believe that the interception is proportionate to what is sought to be achieved by that conduct. Any assessment of proportionality involves balancing the seriousness of the intrusion into the privacy or property of the subject of the operation (or any other person who may be affected) against the need for the activity in investigative, operational or capability terms. The warrant will not be proportionate if it is excessive in the overall circumstances of the case. Each action authorised should bring an expected benefit to the investigation or operation and should not be disproportionate or arbitrary. The fact that there is a potential threat to national security (for example) may not alone render the most intrusive actions proportionate. No interference should be considered proportionate if the information which is sought could reasonably be obtained by other less intrusive means. 3. GENERAL RULES ON INTERCEPTION WITH A WARRANT
...
3.7. The following elements of proportionality should therefore be considered:
Balancing the size and scope of the proposed interference against what is sought to be achieved;
Explaining how and why the methods to be adopted will cause the least possible intrusion on the subject and others;
Considering whether the activity is an appropriate use of the legislation and a reasonable way, having considered all reasonable alternatives, of obtaining the necessary result;
Evidencing, as far as reasonably practicable, what other methods have been considered and were either not implemented or have been employed but which are assessed as insufficient to fulfil operational objectives without the addition of the intercept material sought.
... Duration of interception warrants
3.18. Interception warrants issued on serious crime grounds are valid for an initial period of three months. Interception warrants issued on national security/economic well-being of the UK grounds are valid for an initial period of six months. A warrant issued under the urgency procedure (on any grounds) is valid for five working days following the date of issue unless renewed by the Secretary of State.
3.19. Upon renewal, warrants issued on serious crime grounds are valid for a further period of three months. Warrants renewed on national security/economic well‑being of the UK grounds are valid for a further period of six months. These dates run from the date on the renewal instrument.
3.20. Where modifications to an interception warrant are made, the warrant expiry date remains unchanged. However, where the modification takes place under the urgency provisions, the modification instrument expires after five working days following the date of issue, unless it is renewed in line with the routine procedure.
3.21. Where a change in circumstance leads the intercepting agency to consider it no longer necessary, proportionate or practicable for a warrant to be in force, the agency must make a recommendation to the Secretary of State that it should be cancelled with immediate effect.
... 4. SPECIAL RULES ON INTERCEPTION WITH A WARRANT
Collateral intrusion
4.1. Consideration should be given to any interference with the privacy of individuals who are not the subject of the intended interception, especially where communications relating to religious, medical, journalistic or legally privileged material may be involved, or where communications between a Member of Parliament and another person on constituency business may be involved or communications between a Member of Parliament and a whistle-blower. An application for an interception warrant should state whether the interception is likely to give rise to a degree of collateral infringement of privacy. A person applying for an interception warrant must also consider measures, including the use of automated systems, to reduce the extent of collateral intrusion. Where it is possible to do so, the application should specify those measures. These circumstances and measures will be taken into account by the Secretary of State when considering a warrant application made under section 8(1) of RIPA. Should an interception operation reach the point where individuals other than the subject of the authorisation are identified as investigative targets in their own right, consideration should be given to applying for separate warrants covering those individuals. Confidential information
4.2. Particular consideration should also be given in cases where the subject of the interception might reasonably assume a high degree of privacy, or where confidential information is involved. This includes where the communications relate to legally privileged material; where confidential journalistic material may be involved; where interception might involve communications between a medical professional or Minister of Religion and an individual relating to the latter’s health or spiritual welfare; or where communications between a Member of Parliament and another person on constituency business may be involved.
4.3. Confidential journalistic material includes material acquired or created for the purposes of journalism and held subject to an undertaking to hold it in confidence, as well as communications resulting in information being acquired for the purposes of journalism and held subject to such an undertaking. See also paragraphs 4.26 and 4.28 – 4.31 for additional safeguards that should be applied in respect of confidential journalistic material.
... Communications involving confidential journalistic material, confidential personal information and communications between a Member of Parliament and another person on constituency business
4.26. Particular consideration must also be given to the interception of communications that involve confidential journalistic material, confidential personal information, or communications between a Member of Parliament and another person on constituency business. Confidential journalistic material is explained at paragraph 4.3. Confidential personal information is information held in confidence concerning an individual (whether living or dead) who can be identified from it, and the material in question relates to his or her physical or mental health or to spiritual counselling. Such information can include both oral and written communications. Such information as described above is held in confidence if it is held subject to an express or implied undertaking to hold it in confidence, or is subject to a restriction on disclosure or an obligation of confidentiality contained in existing legislation. For example, confidential personal information might include consultations between a health professional and a patient, or information from a patient’s medical records.
...
4.28. Where the intention is to acquire confidential personal information, the reasons should be clearly documented and the specific necessity and proportionality of doing so should be carefully considered. If the acquisition of confidential personal information is likely but not intended, any possible mitigation steps should be considered and, if none is available, consideration should be given to whether special handling arrangements are required within the intercepting agency.
4.29. Material which has been identified as confidential information should be retained only where it is necessary and proportionate to do so for one or more of the authorised purposes set out in section 15(4). It must be securely destroyed when its retention is no longer needed for those purposes. If such information is retained, there must be adequate information management systems in place to ensure that continued retention remains necessary and proportionate for the authorised statutory purposes.
4.30. Where confidential information is retained or disseminated to an outside body, reasonable steps should be taken to mark the information as confidential. Where there is any doubt as to the lawfulness of the proposed handling or dissemination of confidential information, advice should be sought from a legal adviser within the relevant intercepting agency and before any further dissemination of the material takes place.
4.31. Any case where confidential information is retained should be notified to the Interception of Communications Commissioner as soon as reasonably practicable, as agreed with the Commissioner. Any material which has been retained should be made available to the Commissioner on request.
4.32. The safeguards set out in paragraphs 4.28 – 4.31 also apply to any section 8(4) material (see chapter 6) which is selected for examination and which constitutes confidential information.
... 6. INTERCEPTION WARRANTS (SECTION 8(4))
6.1. This section applies to the interception of external communications by means of a warrant complying with section 8(4) of RIPA.
6.2. In contrast to section 8(1), a section 8(4) warrant instrument need not name or describe the interception subject or a set of premises in relation to which the interception is to take place. Neither does section 8(4) impose an express limit on the number of external communications which may be intercepted. For example, if the requirements of sections 8(4) and (5) are met, then the interception of all communications transmitted on a particular route or cable, or carried by a particular CSP, could, in principle, be lawfully authorised. This reflects the fact that section 8(4) interception is an intelligence gathering capability, whereas section 8(1) interception is primarily an investigative tool that is used once a particular subject for interception has been identified.
6.3. Responsibility for the issuing of interception warrants under section 8(4) of RIPA rests with the Secretary of State. When the Secretary of State issues a warrant of this kind, it must be accompanied by a certificate. The certificate ensures that a selection process is applied to the intercepted material so that only material described in the certificate is made available for human examination. If the intercepted material cannot be selected to be read, looked at or listened to with due regard to proportionality and the terms of the certificate, then it cannot be read, looked at or listened to by anyone. Section 8(4) interception in practice
6.4. A section 8(4) warrant authorises the interception of external communications. Where a section 8(4) warrant results in the acquisition of large volumes of communications, the intercepting agency will ordinarily apply a filtering process to automatically discard communications that are unlikely to be of intelligence value. Authorised persons within the intercepting agency may then apply search criteria to select communications that are likely to be of intelligence value in accordance with the terms of the Secretary of State’s certificate. Before a particular communication may be accessed by an authorised person within the intercepting agency, the person must provide an explanation of why it is necessary for one of the reasons set out in the certificate accompanying the warrant issued by the Secretary of State, and why it is proportionate in the particular circumstances. This process is subject to internal audit and external oversight by the Interception of Communications Commissioner. Where the Secretary of State is satisfied that it is necessary, he or she may authorise the selection of communications of an individual who is known to be in the British Islands. In the absence of such an authorisation, an authorised person must not select such communications. Definition of external communications
6.5. External communications are defined by RIPA to be those which are sent or received outside the British Islands. They include those which are both sent and received outside the British Islands, whether or not they pass through the British Islands in the course of their transmission. They do not include communications both sent and received in the British Islands, even if they pass outside the British Islands en route. For example, an email from a person in London to a person in Birmingham will be an internal, not external communication for the purposes of section 20 of RIPA, whether or not it is routed via IP addresses outside the British Islands, because the sender and intended recipient are within the British Islands. Intercepting non-external communications under section 8(4) warrants
6.6. Section 5(6)(a) of RIPA makes clear that the conduct authorised by a section 8(4) warrant may, in principle, include the interception of communications which are not external communications to the extent this is necessary in order to intercept the external communications to which the warrant relates.
6.7. When conducting interception under a section 8(4) warrant, an intercepting agency must use its knowledge of the way in which international communications are routed, combined with regular surveys of relevant communications links, to identify those individual communications bearers that are most likely to contain external communications that will meet the descriptions of material certified by the Secretary of State under section 8(4). It must also conduct the interception in ways that limit the collection of non-external communications to the minimum level compatible with the objective of intercepting wanted external communications. Application for a section 8(4) warrant
6.8. An application for a warrant is made to the Secretary of State. Interception warrants, when issued, are addressed to the person who submitted the application. The purpose of such a warrant will typically reflect one or more of the intelligence priorities set by the National Security Council (NSC).
6.9. Prior to submission, each application is subject to a review within the agency making the application. This involves scrutiny by more than one official, who will consider whether the application is for a purpose falling within section 5(3) of RIPA and whether the interception proposed is both necessary and proportionate.
6.10. Each application, a copy of which must be retained by the applicant, should contain the following information:
Background to the operation in question:
         Description of the communications to be intercepted, details of the CSP(s) and an assessment of the feasibility of the operation where this is relevant; and
         Description of the conduct to be authorised, which must be restricted to the interception of external communications, or the conduct (including the interception of other communications not specifically identified by the warrant as foreseen under section 5(6)(a) of RIPA) it is necessary to undertake in order to carry out what is authorised or required by the warrant, and the obtaining of related communications data. The certificate that will regulate examination of intercepted material;
An explanation of why the interception is considered to be necessary for one or more of the section 5(3) purposes;
A consideration of why the conduct to be authorised by the warrant is proportionate to what is sought to be achieved by that conduct;
Where an application is urgent, supporting justification;
An assurance that intercepted material will be read, looked at or listened to only so far as it is certified and it meets the conditions of sections 16(2)‑16(6) of RIPA; and
An assurance that all material intercepted will be handled in accordance with the safeguards required by sections 15 and 16 of RIPA (see paragraphs 7.2 and 7.10 respectively). Authorisation of a section 8(4) warrant
6.11. Before issuing a warrant under section 8(4), the Secretary of State must believe the warrant is necessary:
In the interests of national security;
For the purpose of preventing or detecting serious crime; or
For the purpose of safeguarding the economic well-being of the UK so far as those interests are also relevant to the interests of national security.
6.12. The power to issue an interception warrant for the purpose of safeguarding the economic well-being of the UK (as provided for by section 5(3)(c) of RIPA), may only be exercised where it appears to the Secretary of State that the circumstances are relevant to the interests of national security. The Secretary of State will not issue a warrant on section 5(3)(c) grounds if a direct link between the economic well-being of the UK and national security is not established. Any application for a warrant on section 5(3)(c) grounds should therefore identify the circumstances that are relevant to the interests of national security.
6.13. The Secretary of State must also consider that the conduct authorised by the warrant is proportionate to what it seeks to achieve (section 5(2)(b)). In considering necessity and proportionality, the Secretary of State must take into account whether the information sought could reasonably be obtained by other means (section 5(4)).
6.14. When the Secretary of State issues a warrant of this kind, it must be accompanied by a certificate in which the Secretary of State certifies that he or she considers examination of the intercepted material to be necessary for one or more of the section 5(3) purposes. The purpose of the statutory certificate is to ensure that a selection process is applied to intercepted material so that only material described in the certificate is made available for human examination. Any certificate must broadly reflect the ‘Priorities for Intelligence Collection’ set by the NSC for the guidance of the intelligence agencies. For example, a certificate might provide for the examination of material providing intelligence on terrorism (as defined in the Terrorism Act 2000) or on controlled drugs (as defined by the Misuse of Drugs Act 1971). The Interception of Communications Commissioner must review any changes to the descriptions of material specified in a certificate.
6.15. The Secretary of State has a duty to ensure that arrangements are in force for securing that only that material which has been certified as necessary for examination for a section 5(3) purpose, and which meets the conditions set out in section 16(2) to section 16(6) is, in fact, read, looked at or listened to. The Interception of Communications Commissioner is under a duty to review the adequacy of those arrangements. Urgent authorisation of a section 8(4) warrant
6.16. RIPA makes provision (section 7(l)(b)) for cases in which an interception warrant is required urgently, yet the Secretary of State is not available to sign the warrant. In these cases the Secretary of State will still personally authorise the interception but the warrant is signed by a senior official, following discussion of the case between officials and the Secretary of State. RIPA restricts the issue of warrants in this way to urgent cases where the Secretary of State has personally and expressly authorised the issue of the warrant (section 7(2)(a)), and requires the warrant to contain a statement to that effect (section 7(4)(a)).
6.17. A warrant issued under the urgency procedure lasts for five working days following the date of issue unless renewed by the Secretary of State, in which case it expires after three months in the case of serious crime or six months in the case of national security or economic well-being, in the same way as other section 8(4) warrants. Format of a section 8(4) warrant
6.18. Each warrant is addressed to the person who submitted the application. A copy may then be served upon such providers of communications services as he or she believes will be able to assist in implementing the interception. CSPs will not normally receive a copy of the certificate. The warrant should include the following:
A description of the communications to be intercepted;
The warrant reference number; and
Details of the persons who may subsequently modify the certificate applicable to the warrant in an urgent case (if authorised in accordance with section 10(7) of RIPA). Modification of a section 8(4) warrant and/or certificate
6.19. Interception warrants and certificates may be modified under the provisions of section 10 of RIPA. A warrant may only be modified by the Secretary of State or, in an urgent case, by a senior official with the express authorisation of the Secretary of State. In these cases a statement of that fact must be endorsed on the modifying instrument, and the modification ceases to have effect after five working days following the date of issue unless it is endorsed by the Secretary of State.
6.20. A certificate must be modified by the Secretary of State, except in an urgent case where a certificate may be modified by a senior official provided that the official holds a position in which he or she is expressly authorised by provisions contained in the certificate to modify the certificate on the Secretary of State’s behalf, or the Secretary of State has expressly authorised the modification and a statement of that fact is endorsed on the modifying instrument. In the latter case, the modification ceases to have effect after five working days following the date of issue unless it is endorsed by the Secretary of State.
6.21. Where the Secretary of State is satisfied that it is necessary, a certificate may be modified to authorise the selection of communications of an individual in the British Islands. An individual’s location should be assessed using all available information. If it is not possible, to determine definitively where the individual is located using that information, an informed assessment should be made, in good faith, as to the individual’s location. If an individual is strongly suspected to be in the UK, the arrangements set out in this paragraph will apply. Renewal of a section 8(4) warrant
6.22. The Secretary of State may renew a warrant at any point before its expiry date. Applications for renewals are made to the Secretary of State and contain an update of the matters outlined in paragraph 6.10 above. In particular, the applicant must give an assessment of the value of interception to date and explain why it is considered that interception continues to be necessary for one or more of the purposes in section 5(3), and why it is considered that interception continues to be proportionate.
6.23. Where the Secretary of State is satisfied that the interception continues to meet the requirements of RIPA, the Secretary of State may renew the warrant. Where the warrant is issued on serious crime grounds, the renewed warrant is valid for a further three months. Where it is issued on national security/economic well-being grounds the renewed warrant is valid for six months. These dates run from the date of signature on the renewal instrument.
6.24. In those circumstances where the assistance of CSPs has been sought, a copy of the warrant renewal instrument will be forwarded to all those on whom a copy of the original warrant instrument has been served, providing they are still actively assisting. A renewal instrument will include the reference number of the warrant or warrants being renewed under this single instrument. Warrant cancellation
6.25. The Secretary of State must cancel an interception warrant if, at any time before its expiry date, he or she is satisfied that the warrant is no longer necessary on grounds falling within section 5(3) of RIPA. Intercepting agencies will therefore need to keep their warrants under continuous review and must notify the Secretary of State if they assess that the interception is no longer necessary. In practice, the responsibility to cancel a warrant will be exercised by a senior official in the warrant issuing department on behalf of the Secretary of State.
6.26. The cancellation instrument will be addressed to the person to whom the warrant was issued (the intercepting agency). A copy of the cancellation instrument should be sent to those CSPs, if any, who have given effect to the warrant during the preceding twelve months. Records
6.27. The oversight regime allows the Interception of Communications Commissioner to inspect the warrant application upon which the Secretary of State’s decision is based, and the interception agency may be required to justify the content. Each intercepting agency should keep the following to be made available for scrutiny by the Commissioner as he or she may require:
All applications made for warrants complying with section 8(4), and applications made for the renewal of such warrants;
All warrants and certificates, and copies of renewal and modification instruments (if any);
Where any application is refused, the grounds for refusal as given by the Secretary of State;
The dates on which interception started and stopped.
6.28. Records should also be kept of the arrangements for securing that only material which has been certified for examination for a purpose under section 5(3) and which meets the conditions set out in section 16(2) – 16(6) of RIPA in accordance with section 15 of RIPA is, in fact, read, looked at or listened to. Records should be kept of the arrangements by which the requirements of section 15(2) (minimisation of copying and distribution of intercepted material) and section 15(3) (destruction of intercepted material) are to be met. For further details see the chapter on ‘Safeguards’. 7. SAFEGUARDS
7.1. All material intercepted under the authority of a warrant complying with section 8(1) or section 8(4) of RIPA and any related communications data must be handled in accordance with safeguards which the Secretary of State has approved in conformity with the duty imposed on him or her by RIPA. These safeguards are made available to the Interception of Communications Commissioner, and they must meet the requirements of section 15 of RIPA which are set out below. In addition, the safeguards in section 16 of RIPA apply to warrants complying with section 8(4). Any breach of these safeguards must be reported to the Interception of Communications Commissioner. The intercepting agencies must keep their internal safeguards under periodic review to ensure that they remain up-to-date and effective. During the course of such periodic reviews, the agencies must consider whether more of their internal arrangements might safely and usefully be put into the public domain. The section 15 safeguards
7.2. Section 15 of RIPA requires that disclosure, copying and retention of intercepted material is limited to the minimum necessary for the authorised purposes. Section 15(4) of RIPA provides that something is necessary for the authorised purposes if the intercepted material:
Continues to be, or is likely to become, necessary for any of the purposes set out in section 5(3) – namely, in the interests of national security, for the purpose of preventing or detecting serious crime, or for the purpose, in circumstances appearing to the Secretary of State to be relevant to the interests of national security, of safeguarding the economic well-being of the UK;
Is necessary for facilitating the carrying out of the functions of the Secretary of State under Chapter I of Part I of RIPA;
Is necessary for facilitating the carrying out of any functions of the Interception of Communications Commissioner or the Tribunal;
Is necessary to ensure that a person conducting a criminal prosecution has the information needed to determine what is required of him or her by his or her duty to secure the fairness of the prosecution; or
Is necessary for the performance of any duty imposed by the Public Record Acts. Dissemination of intercepted material
7.3. The number of persons to whom any of the intercepted material is disclosed, and the extent of disclosure, is limited to the minimum that is necessary for the authorised purposes set out in section 15(4) of RIPA. This obligation applies equally to disclosure to additional persons within an agency, and to disclosure outside the agency. It is enforced by prohibiting disclosure to persons who have not been appropriately vetted and also by the need-to-know principle: intercepted material must not be disclosed to any person unless that person’s duties, which must relate to one of the authorised purposes, are such that he or she needs to know about the intercepted material to carry out those duties. In the same way, only so much of the intercepted material may be disclosed as the recipient needs. For example, if a summary of the intercepted material will suffice, no more than that should be disclosed.
7.4. The obligations apply not just to the original interceptor, but also to anyone to whom the intercepted material is subsequently disclosed. In some cases this will be achieved by requiring the latter to obtain the originator’s permission before disclosing the intercepted material further. In others, explicit safeguards are applied to secondary recipients.
7.5. Where intercepted material is disclosed to the authorities of a country or territory outside the UK, the agency must take reasonable steps to ensure that the authorities in question have and will maintain the necessary procedures to safeguard the intercepted material, and to ensure that it is disclosed, copied, distributed and retained only to the minimum extent necessary. In particular, the intercepted material must not be further disclosed to the authorities of a third country or territory unless explicitly agreed with the issuing agency, and must be returned to the issuing agency or securely destroyed when no longer needed. Copying
7.6. Intercepted material may only be copied to the extent necessary for the authorised purposes set out in section 15(4) of RIPA. Copies include not only direct copies of the whole of the intercepted material, but also extracts and summaries which identify themselves as the product of an interception, and any record referring to an interception which includes the identities of the persons to or by whom the intercepted material was sent. The restrictions are implemented by requiring special treatment of such copies, extracts and summaries that are made by recording their making, distribution and destruction. Storage
7.7. Intercepted material and all copies, extracts and summaries of it, must be handled and stored securely, so as to minimise the risk of loss or theft. It must be held so as to be inaccessible to persons without the required level of vetting. This requirement to store intercept product securely applies to all those who are responsible for handling it, including CSPs. The details of what such a requirement will mean in practice for CSPs will be set out in the discussions they have with the Government before a Section 12 Notice is served (see paragraph 3.13). Destruction
7.8. Intercepted material, and all copies, extracts and summaries which can be identified as the product of an interception, must be marked for deletion and securely destroyed as soon as possible once it is no longer needed for any of the authorised purposes. If such intercepted material is retained, it should be reviewed at appropriate intervals to confirm that the justification for its retention is still valid under section 15(3) of RIPA.
7.9. Where an intercepting agency undertakes interception under a section 8(4) warrant and receives unanalysed intercepted material and related communications data from interception under that warrant, the agency must specify (or must determine on a system by system basis) maximum retention periods for different categories of the data which reflect its nature and intrusiveness. The specified periods should normally be no longer than two years, and should be agreed with the Interception of Communications Commissioner. Data may only be retained for longer than the applicable maximum retention periods if prior authorisation is obtained from a senior official within the particular intercepting agency on the basis that continued retention of the data has been assessed to be necessary and proportionate. If continued retention of any such data is thereafter assessed to no longer meet the tests of necessity and proportionality, it must be deleted. So far as possible, all retention periods should be implemented by a process of automated deletion, which is triggered once the applicable maximum retention period has been reached for the data at issue. Personnel security
7.10. All persons who may have access to intercepted material or need to see any reporting in relation to it must be appropriately vetted. On an annual basis, managers must identify any concerns that may lead to the vetting of individual members of staff being reconsidered. The vetting of each individual member of staff must also be periodically reviewed. Where it is necessary for an officer of one agency to disclose intercepted material to another, it is the former’s responsibility to ensure that the recipient has the necessary clearance. The section 16 safeguards
7.11. Section 16 provides for additional safeguards in relation to intercepted material gathered under section 8(4) warrants, requiring that the safeguards:
Ensure that intercepted material is read, looked at or listened to by any person only to the extent that the intercepted material is certified; and
Regulate the use of selection factors that refer to the communications of individuals known to be currently in the British Islands.
7.12. In addition, any individual selection of intercepted material must be proportionate in the particular circumstances (given section 6(1) of the Human Rights Act 1998).
7.13. The certificate ensures that a selection process is applied to material intercepted under section 8(4) warrants so that only material described in the certificate is made available for human examination (in the sense of being read, looked at or listened to). No official is permitted to gain access to the data other than as permitted by the certificate.
7.14. In general, automated systems must, where technically possible, be used to effect the selection in accordance with section 16(1) of RIPA. As an exception, a certificate may permit intercepted material to be accessed by a limited number of specifically authorised staff without having been processed or filtered by the automated systems. Such access may only be permitted to the extent necessary to determine whether the material falls within the main categories to be selected under the certificate, or to ensure that the methodology being used remains up to date and effective. Such checking must itself be necessary on the grounds specified in section 5(3) of RIPA. Once those functions have been fulfilled, any copies made of the material for those purposes must be destroyed in accordance with section 15(3) of RIPA. Such checking by officials should be kept to an absolute minimum; whenever possible, automated selection techniques should be used instead. Checking will be kept under review by the Interception of Communications Commissioner during his or her inspections.
7.15. Material gathered under a section 8(4) warrant should be read, looked at or listened to only by authorised persons who receive regular mandatory training regarding the provisions of RIPA and specifically the operation of section 16 and the requirements of necessity and proportionality. These requirements and procedures must be set out in internal guidance provided to all authorised persons and the attention of all authorised persons must be specifically directed to the statutory safeguards. All authorised persons must be appropriately vetted (see paragraph 7.10 for further information).
7.16. Prior to an authorised person being able to read, look at or listen to material, a record should be created setting out why access to the material is required consistent with, and pursuant to, section 16 and the applicable certificate, and why such access is proportionate. Save where the material or automated systems are being checked as described in paragraph 7.14, the record must indicate, by reference to specific factors, the material to which access is being sought and systems should, to the extent possible, prevent access to the material unless such a record has been created. The record should include any circumstances that are likely to give rise to a degree of collateral infringement of privacy, and any measures taken to reduce the extent of the collateral intrusion. All records must be retained for the purposes of subsequent examination or audit.
7.17. Access to the material as described in paragraph 7.15 must be limited to a defined period of time, although access may be renewed. If access is renewed, the record must be updated with the reason for the renewal. Systems must be in place to ensure that if a request for renewal is not made within that period, then no further access will be granted. When access to the material is no longer sought, the reason for this must also be explained in the record.
7.18. Periodic audits should be carried out to ensure that the requirements set out in section 16 of RIPA and Chapter 3 of this code are being met. These audits must include checks to ensure that the records requesting access to material to be read, looked at, or listened to have been correctly compiled, and specifically, that the material requested falls within matters certified by the Secretary of State. Any mistakes or procedural deficiencies should be notified to management, and remedial measures undertaken. Any serious deficiencies should be brought to the attention of senior management and any breaches of safeguards (as noted in paragraph 7.1) must be reported to the Interception of Communications Commissioner. All intelligence reports generated by the authorised persons must be subject to a quality control audit.
7.19. In order to meet the requirements of RIPA described in paragraph 6.3 above, where a selection factor refers to an individual known to be for the time being in the British Islands, and has as its purpose or one of its purposes, the identification of material contained in communications sent by or intended for him or her, a submission must be made to the Secretary of State, or to a senior official in an urgent case, giving an explanation of why an amendment to the section 8(4) certificate in relation to such an individual is necessary for a purpose falling within section 5(3) of RIPA and is proportionate in relation to any conduct authorised under section 8(4) of RIPA.
7.20. The Secretary of State must ensure that the safeguards are in force before any interception under section 8(4) warrants can begin. The Interception of Communications Commissioner is under a duty to review the adequacy of the safeguards.
... 8. DISCLOSURE TO ENSURE FAIRNESS IN CRIMINAL PROCEEDINGS
... Exclusion of matters from legal proceedings
8.3. The general rule is that neither the possibility of interception, nor intercepted material itself, plays any part in legal proceedings. This rule is set out in section 17 of RIPA, which excludes evidence, questioning, assertion or disclosure in legal proceedings likely to reveal the existence (or the absence) of a warrant issued under this Act (or the Interception of Communications Act 1985). This rule means that the intercepted material cannot be used either by the prosecution or the defence. This preserves ‘equality of arms’ which is a requirement under Article 6 of the ECHR.
... 10. OVERSIGHT
10.1. RIPA provides for an Interception of Communications Commissioner, whose remit is to provide independent oversight of the use of the powers contained within the warranted interception regime under Chapter I of Part I of RIPA.
10.2. The Commissioner carries out biannual inspections of each of the nine interception agencies. The primary objectives of the inspections are to ensure that the Commissioner has the information he or she requires to carry out his or her functions under section 57 of RIPA and produce his or her report under section 58 of RIPA. This may include inspection or consideration of:
The systems in place for the interception of communications;
The relevant records kept by the intercepting agency;
The lawfulness of the interception carried out; and
Any errors and the systems designed to prevent such errors.
10.3. Any person who exercises the powers in RIPA Part I Chapter I must report to the Commissioner any action that is believed to be contrary to the provisions of RIPA or any inadequate discharge of section 15 safeguards. He or she must also comply with any request made by the Commissioner to provide any such information as the Commissioner requires for the purpose of enabling him or her to discharge his or her functions.”
Statement of Charles Farr
97. In his witness statement prepared for the Liberty proceedings (see paragraph 40 above), Charles Farr indicated that, beyond the details set out in RIPA, the 2010 IC Code, and the draft IC 2016 Code (which had at that stage been published for consultation), the full details of the sections 15 and 16 safeguards were kept confidential. He had personally reviewed the arrangements and was satisfied that they could not safely be put in the public domain without undermining the effectiveness of the interception methods. However, the arrangements were made available to the IC Commissioner who was required by RIPA to keep them under review. Furthermore, each intercepting agency was required to keep a record of the arrangements in question and any breach had to be reported to the IC Commissioner. National Security Strategy and Strategic Defence and Security Review 2015: A Secure and Prosperous United Kingdom
98. In this review the National Security Council (“NSC”) stated that its priorities over the next five years would be to:
“Tackle terrorism head-on at home and abroad in a tough and comprehensive way, counter extremism and challenge the poisonous ideologies that feed it. We will remain a world leader in cyber security. We will deter state-based threats. We will respond to crises rapidly and effectively and build resilience at home and abroad. Help strengthen the rules-based international order and its institutions, encouraging reform to enable further participation of growing powers. We will work with our partners to reduce conflict, and to promote stability, good governance and human rights. Promote our prosperity, expanding our economic relationship with growing powers such as India and China, helping to build global prosperity, investing in innovation and skills, and supporting UK defence and security exports.”
Judgment of the IPT of 29 March 2015 in Belhadj and Others v. Security Service, Secret Intelligence Service, Government Communications Headquarters, the Secretary of State for the Home Department, and the Secretary of State for the Foreign and Commonwealth Office, IPT/13/132‑9/H and IPT/14/86/CH
99. The applicants in this case complained of breaches of Articles 6, 8 and 14 of the Convention arising from the alleged interception of their legally privileged communications. In so far as Amnesty International, in the course of the Liberty proceedings, complained about the adequacy of the arrangements for the protection of material subject to legal professional privilege (“LPP”), those complaints were “hived off” to be dealt with in this case, and Amnesty International was joined as a claimant (see paragraph 52 above). 100. In the course of the proceedings, the respondents conceded that by virtue of there not being in place a lawful system for dealing with LPP, from January 2010 the regime for the interception/obtaining, analysis, use, disclosure and destruction of legally privileged material had not been in accordance with the law for the purposes of Article 8 § 2 of the Convention and was accordingly unlawful. The Security Service and GCHQ confirmed that they would work in the forthcoming weeks to review their policies and procedures in light of the draft IC Code and otherwise. 101. The IPT subsequently held a closed hearing, with the assistance of Counsel to the Tribunal (see paragraph 132 below), to consider whether any documents or information relating to any legally privileged material had been intercepted or obtained by the respondents. In a determination of 29 March 2015, it found that the intelligence services had only held two documents belonging to any of the claimants which contained material subject to LPP, and they neither disclosed nor referred to legal advice. It therefore found that the claimant concerned had not suffered any detriment or damage, and that the determination provided adequate just satisfaction. It nevertheless required that GCHQ provide an undertaking that those parts of the documents containing legally privileged material would be destroyed or deleted; that a copy of the documents would be delivered to the IC Commissioner to be retained for five years; and that a closed report would be provided within fourteen days confirming the destruction and deletion of the documents. 102. Draft amendments to both the IC Code and the Acquisition and Disclosure of Communications Data Code of Practice were subsequently put out for consultation and the Codes which were adopted as a result in 2018 contained expanded sections concerning access to privileged information. Intelligence sharingBritish-US Communication Intelligence Agreement

103. A British-US Communication Intelligence Agreement of 5 March 1946 governed the arrangements between the British and United States authorities in relation to the exchange of intelligence information relating to “foreign” communications, defined by reference to countries other than the United States, the United Kingdom and the Commonwealth. Pursuant to the agreement, the parties undertook to exchange the products of a number of interception operations relating to foreign communications. Relevant statutory framework for the operation of the intelligence services
104. There are three intelligence services in the United Kingdom: the security service (“MI5”), the secret intelligence service (“MI6”) and GCHQ. (a)   MI5
105. Pursuant to section 2 of the Security Service Act 1989 (“SSA”), it was the duty of the Director-General of MI5, who was appointed by the Secretary of State for the Home Department, to ensure that there were arrangements for securing that no information was obtained by MI5 except so far as necessary for the proper discharge of its functions or disclosed by it except so far as necessary for that purpose or for the purpose of the prevention or detection of serious crime or for the purpose of any criminal proceedings. 106. According to section 1 of the SSA, the functions of MI5 were the protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy by political, industrial or violent means; to safeguard the economic well-being of the United Kingdom against threats posed by the actions or intentions of persons outside the British Islands; and to act in support of the activities of police forces, the National Crime Agency and other law enforcement agencies in the prevention and detection of serious crime. (b)   MI6
107. Section 2 of the Intelligence Services Act 1994 (“ISA”) provided that the duties of the Chief of Service of MI6, who was appointed by the Secretary of State for Foreign and Commonwealth Affairs (as he then was), included ensuring that there were arrangements for securing that no information was obtained by MI6 except so far as necessary for the proper discharge of its functions, and that no information was disclosed by it except so far as necessary for that purpose, in the interests of national security, for the purposes of the prevention or detection of serious crime or for the purpose of any criminal proceedings. 108. According to section 1 of the ISA, the functions of MI6 were to obtain and provide information relating to the actions or intentions of persons outside the British Islands; and to perform other tasks relating to the actions or intentions of such persons. Those functions could only be exercised in the interests of national security, with particular reference to the State’s defence and foreign policies; in the interests of the economic well‑being of the United Kingdom; or in support of the prevention or detection of serious crime. (c)   GCHQ
109. Section 4 of the ISA provided that it was the duty of the Director of GCHQ, who was appointed by the Secretary of State for Foreign and Commonwealth Affairs (as he then was), to ensure that there were arrangements for securing that it obtained no information except so far as necessary for the proper discharge of its functions and that no information was disclosed by it except so far as necessary. 110. According to section 3 of the ISA, one of the functions of GCHQ was to monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material. This function was exercisable only in the interests of national security, with particular reference to the State’s defence and foreign policies; in the interests of the economic well-being of the United Kingdom in relation to the actions or intentions of persons outside the British Islands; or in support of the prevention or detection of serious crime. (d)   Counter-Terrorism Act 2008
111. Section 19 of the Counter-Terrorism Act 2008 allowed the disclosure of information to any of the intelligence services for the purpose of the exercise of any of their functions. Information obtained by an intelligence service in connection with the exercise of its functions could be used by that service in connection with the exercise of any of its other functions. 112. Information obtained by MI5 could be disclosed for the purpose of the proper discharge of its functions, for the purpose of the prevention or detection of serious crime, or for the purpose of any criminal proceedings. Information obtained by MI6 could be disclosed for the purpose of the proper discharge of its functions, in the interests of national security, for the purpose of the prevention or detection of serious crime, or for the purpose of any criminal proceedings. Information obtained by GCHQ could be disclosed by it for the purpose of the proper discharge of its functions or for the purpose of any criminal proceedings. (e)   The Data Protection Act 1998 (“the DPA”)
113. The DPA was the legislation transposing into United Kingdom law Directive 95/46/EC on the protection of personal data. Each of the intelligence services was a “data controller” for the purposes of the DPA and, as such, they were required to comply – subject to exemption by Ministerial certificate – with the data protection principles in Part 1 of Schedule 1, including:
“(5)  Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes ...”
and
“(7)  Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”
(f)     The Official Secrets Act 1989 (“the OSA”)
114. A member of the intelligence services would commit an offence under section 1(1) of the OSA if he or she disclosed, without lawful authority, any information, document or other article relating to security or intelligence which was in his or her possession by virtue of his or her position as a member of those services. (g)   The Human Rights Act 1998 (“the HRA”)
115. Pursuant to section 6 of the HRA, it was unlawful for a public authority to act in a way which was incompatible with a Convention right. The Interception of Communications Code of Practice
116. Following the Liberty proceedings, the information contained in the 9 October disclosure (see paragraphs 33 and 36 above) was incorporated into the IC Code:
“12. RULES FOR REQUESTING AND HANDLING UNANALYSED INTERCEPTED COMMUNICATIONS FROM A FOREIGN GOVERNMENT
Application of this chapter
12.1. This chapter applies to those intercepting agencies that undertake interception under a section 8(4) warrant. Requests for assistance other than in accordance with an international mutual assistance agreement
12.2. A request may only be made by an intercepting agency to the government of a country or territory outside the UK for unanalysed intercepted communications (and associated communications data), otherwise than in accordance with an international mutual assistance agreement, if either:
A relevant interception warrant under RIPA has already been issued by the Secretary of State, the assistance of the foreign government is necessary to obtain the particular communications because they cannot be obtained under the relevant RIPA interception warrant and it is necessary and proportionate for the intercepting agency to obtain those communications; or
Making the request for the particular communications in the absence of a relevant RIPA interception warrant does not amount to a deliberate circumvention of RIPA or otherwise frustrate the objectives of RIPA (for example, because it is not technically feasible to obtain the communications via RIPA interception), and it is necessary and proportionate for the intercepting agency to obtain those communications.
12.3. A request falling within the second bullet of paragraph 12.2 may only be made in exceptional circumstances and must be considered and decided upon by the Secretary of State personally.
12.4. For these purposes, a ‘relevant RIPA interception warrant’ means one of the following: (i) a section 8(1) warrant in relation to the subject at issue; (ii) a section 8(4) warrant and an accompanying certificate which includes one or more ‘descriptions of intercepted material’ (within the meaning of section 8(4)(b) of RIPA) covering the subject’s communications, together with an appropriate section 16(3) modification (for individuals known to be within the British Islands); or (iii) a section 8(4) warrant and an accompanying certificate which includes one or more ‘descriptions of intercepted material’ covering the subject’s communications (for other individuals). Safeguards applicable to the handling of unanalysed intercepted communications from a foreign government
12.5. If a request falling within the second bullet of paragraph 12.2 is approved by the Secretary of State other than in relation to specific selectors, any communications obtained must not be examined by the intercepting agency according to any factors as are mentioned in section 16(2)(a) and (b) of RIPA unless the Secretary of State has personally considered and approved the examination of those communications by reference to such factors.[1]
12.6. Where intercepted communications content or communications data are obtained by the intercepting agencies as set out in paragraph 12.2, or are otherwise received by them from the government of a country or territory outside the UK in circumstances where the material identifies itself as the product of an interception, (except in accordance with an international mutual assistance agreement), the communications content and communications data must be subject to the same internal rules and safeguards that apply to the same categories of content or data when they are obtained directly by the intercepting agencies as a result of interception under RIPA.
12.7. All requests in the absence of a relevant RIPA interception warrant to the government of a country or territory outside the UK for unanalysed intercepted communications (and associated communications data) will be notified to the Interception of Communications Commissioner.”
Acquisition of communications data
117. Chapter II of Part 1 of RIPA set out the framework under which public authorities could acquire communications data from Communications Service Providers (“CSPs”). 118. Pursuant to section 22, authorisation for the acquisition of communications data from CSPs was granted by a “designated person”, being a person holding such office, rank or position with relevant public authorities as prescribed by an order made by the Secretary of State. The designated person could either grant authorisation for persons within the same “relevant public authority” as himself or herself to “engage in conduct to which this Chapter applies” (authorisation under section 22(3)), or he or she could, by notice to the CSP, require it either to disclose data already in its possession, or to obtain and disclose data (notice under section 22(4)). For the purposes of section 22(3), “relevant public authorities” included a police force, the National Crime Agency, Her Majesty’s Revenue and Customs, any of the intelligence services, and any such public authority as could be specified by an order made by the Secretary of State. 119. Section 22(2) further provided that the designated person could only grant an authorisation under section 22(3) or give a notice under section 22(4) if he or she believed it was necessary for one of the following grounds:
“(a) in the interests of national security;
(b) for the purpose of preventing or detecting crime or of preventing disorder;
(c) in the interests of the economic well-being of the United Kingdom;
(d) in the interests of public safety;
(e) for the purpose of protecting public health;
(f) for the purpose of assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department;
(g) for the purpose, in an emergency, of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health; or
(h) for any purpose (not falling within paragraphs (a) to (g)) which is specified for the purposes of this subsection by an order made by the Secretary of State.”
120. He or she also had to believe that obtaining the data was proportionate to what was sought to be achieved. 121. Chapter II of RIPA was supplemented by the Acquisition and Disclosure of Communications Data: Code of Practice, issued under section 71 of RIPA. IPT practice and procedureRIPA

122. The IPT was established under section 65(1) of RIPA to hear allegations by citizens of wrongful interference with their communications as a result of conduct covered by that Act. It had jurisdiction to investigate any complaint that a person’s communications had been intercepted and, where interception had occurred, to examine the authority for such interception. 123. Appointments to the IPT were essentially judicial in nature but varied depending on whether the proposed candidate was a serving member of the senior judiciary of England and Wales, Scotland or Northern Ireland (referred to as a “judicial member”) or if they were a “non-judicial member”. A non-judicial member could be a former member of the judiciary who was no longer serving or a senior member of the legal profession of at least ten years’ standing who was not a full-time judge. Where judicial members were selected from the judiciary in England and Wales, the Judicial Office, on behalf of the Lord Chief Justice, managed the selection process. The Judicial Office invited expressions of interest from serving High Court Judges in England and Wales and applicants were interviewed by a panel, which consisted of the President of the IPT, a non‑judicial member of the IPT and a lay Commissioner from the Judicial Appointments Commission. The panel then reported to the Lord Chief Justice who wrote to the Home Secretary making formal recommendations for appointments. The Home Secretary then wrote to the Prime Minister asking him to seek permission for Letters Patent from Her Majesty the Queen for the recommended appointment(s). The Prime Minister recommended the chosen candidate(s) to Her Majesty the Queen who formalised the appointment through Letters Patent. Non judicial-members were recruited through open competition. The IPT placed advertisements for non-judicial members in a selection of national newspapers and recruitment sites asking for expressions of interest from suitably qualified individuals. The process differed from that of judicial members in that it did not involve the Lord Chief Justice, but was the same in all other respects. There are currently five judicial members (two members of the English Court of Appeal (one of whom is the President), one member of the English High Court and two members of the Outer House of the Court of Session in Scotland (one of whom is the Vice-President)) and five non-judicial members (of whom one is a retired High Court judge from Northern Ireland). 124. According to sections 67(2) and 67(3)(c), the IPT was to apply the principles applicable by a court on an application for judicial review. It did not, however, have power to make a Declaration of Incompatibility if it found primary legislation to be incompatible with the European Convention on Human Rights as it was not a “court” for the purposes of section 4 of the Human Rights Act 1998. 125. Section 68(6) and (7) required those involved in the authorisation and execution of an interception warrant to disclose or provide to the IPT all documents and information it required. 126. Section 68(4) provided that where the IPT determined any complaint it had the power to award compensation and to make such other orders as it thought fit, including orders quashing or cancelling any warrant and orders requiring the destruction of any records obtained thereunder (section 67(7)). In the event that a claim before the IPT was successful, the IPT was generally required to make a report to the Prime Minister (section 68(5)). 127. Section 68(1) entitled the IPT to determine its own procedure, although section 69(1) provided that the Secretary of State could also make procedural rules. The Investigatory Powers Tribunal Rules 2000 (“the Rules”)
128. The Rules were adopted by the Secretary of State to govern various aspects of the procedure before the IPT. 129. Rule 9 allowed the IPT to hold, at any stage of consideration, oral hearings at which the complainant could make representations, give evidence and call witnesses. Although Rule 9 provided that the IPT’s proceedings, including any oral hearings, were to be conducted in private, in cases IPT/01/62 and IPT/01/77 the IPT itself decided that, subject to the general duty imposed by Rule 6 (1) to prevent the disclosure of sensitive information, it could exercise its discretion in favour of holding an open hearing. Following this commitment to hold hearings in open when possible, the IPT has also published its significant rulings on its website, provided that there is no risk of disclosure of any prejudicial information. 130. Rule 11 allowed the IPT to receive evidence in any form, even where it would not be admissible in a court of law. 131. Rule 6 required the IPT to carry out its functions in such a way as to ensure that information was not disclosed that was contrary to the public interest or prejudicial to national security, the prevention or detection of serious crime, the economic well-being of the United Kingdom or the continued discharge of the functions of any of the intelligence services. Counsel to the Tribunal
132. The IPT could appoint Counsel to the Tribunal to make submissions on behalf of applicants in hearings at which they could not be represented. In the Liberty case, Counsel to the Tribunal described his role as follows:
“Counsel to the Tribunal performs a different function [from special advocates in closed proceedings conducted before certain tribunals], akin to that of amicus curiae. His or her function is to assist the Tribunal in whatever way the Tribunal directs. Sometimes (e.g. in relation to issues on which all parties are represented), the Tribunal will not specify from what perspective submissions are to be made. In these circumstances, counsel will make submissions according to his or her own analysis of the relevant legal or factual issues, seeking to give particular emphasis to points not fully developed by the parties. At other times (in particular where one or more interests are not represented), the Tribunal may invite its counsel to make submissions from a particular perspective (normally the perspective of the party or parties whose interests are not otherwise represented).”
133. This description was accepted and endorsed by the IPT. R (on the application of Privacy International) v Investigatory Powers Tribunal and others [2019] UKSC 22
134. In this judgment, which was handed down on 15 May 2019, the Supreme Court held that section 67(8) of RIPA did not preclude judicial review of a decision of the IPT. Oversight
135. Part IV of RIPA provided for the appointment by the Prime Minister of an Interception of Communications Commissioner (“the IC Commissioner”) and an Intelligence Services Commissioner charged with supervising the activities of the intelligence services. 136. The IC Commissioner was responsible for keeping under review the interception of communications and the acquisition and disclosure of communications data by intelligence services, police forces and other public authorities. In undertaking his review of surveillance practices, the IC Commissioner and his inspectors had access to all relevant documents, including closed materials, and all those involved in interception activities had a duty to disclose to him any material he required. The obligation on intercepting agencies to keep records ensured that the IC Commissioner had effective access to details of surveillance activities undertaken. After each inspection a report was sent to the head of the public authority which contained formal recommendations and which required the public authority to report back within two months to confirm whether the recommendations had been implemented or what progress had been made. The Commissioner reported to the Prime Minister on a half-yearly basis with respect to the carrying out of his functions and prepared an annual report. This report was a public document (subject to the non-disclosure of confidential annexes) which was laid before Parliament. 137. The Intelligence Services Commissioner provided further independent external oversight of the use of the intrusive powers of the intelligence services and parts of the Ministry of Defence. He also submitted annual reports to the Prime Minister, which were laid before Parliament. 138. The Investigatory Powers Act 2016 (see paragraphs 183-190 below) repealed these provisions, in so far as they related to England, Scotland and Wales, and in September 2017 the Investigatory Powers Commissioner’s Office (“IPCO”) took over responsibility for the oversight of investigatory powers. The IPCO consists of around fifteen Judicial Commissioners, made up of current and recently retired High Court, Court of Appeal and Supreme Court Judges; a Technical Advisory Panel made up of scientific experts; and almost fifty official staff, including inspectors, lawyers and communications experts. Reviews of interception operations by the intelligence serviceIntelligence and Security Committee of Parliament (“ISC”): July 2013 Statement on GCHQ’s alleged interception of communications under the US PRISM programme

139. The ISC was originally established by the ISA to examine the policy, administration and expenditure of MI5, MI6, and GCHQ. Since the introduction of the Justice and Security Act 2013, however, the ISC was expressly given the status of a Committee of Parliament; it was provided with greater powers; and its remit was increased to include oversight of operational activity and the wider intelligence and security activities of Government. Pursuant to sections 1-4 of the Justice and Security Act 2013, it consisted of nine members drawn from both Houses of Parliament, and, in the exercise of their functions, those members were routinely given access to highly classified material. 140. Following the Edward Snowden revelations, the ISC conducted an investigation into GCHQ’s access to the content of communications intercepted under the United States’ PRISM programme, the legal framework governing access, and the arrangements GCHQ had with its overseas counterpart for sharing information. In the course of the investigation, the ISC took detailed evidence from GCHQ and discussed the programme with the NSA. 141. The ISC concluded that allegations that GCHQ had circumvented United Kingdom law by using the PRISM programme to access the content of private communications were unfounded as GCHQ had complied with its statutory duties contained in the ISA. It further found that in each case in which GCHQ had sought information from the United States, a warrant for interception, signed by a Government Minister, had already been in place. Privacy and security: a modern and transparent legal framework
142. Following its statement in July 2013, the ISC conducted a more in-depth inquiry into the full range of the intelligence services’ capabilities. Its report, which contained an unprecedented amount of information about the intelligence services’ intrusive capabilities, was published on 12 March 2015. 143. The ISC was satisfied that the United Kingdom’s intelligence and security services did not seek to circumvent the law, including the requirements of the Human Rights Act 1998, which governed everything that they did. However, it considered that as the legal framework had developed piecemeal, it was unnecessarily complicated. The ISC therefore had serious concerns about the resulting lack of transparency, which was not in the public interest. Consequently, its key recommendation was that the existing legal framework be replaced by a new Act of Parliament which clearly set out the intrusive powers available to the intelligence services, the purposes for which they could use them, and the authorisation required before they could do so. 144. With regard to GCHQ’s bulk interception capability, the inquiry showed that the intelligence services did not have the legal authority, the resources, the technical capability, or the desire to intercept every communication of British citizens, or of the Internet as a whole. GCHQ were not, therefore, reading the emails of everyone in the United Kingdom. On the contrary, GCHQ’s bulk interception systems operated on a very small percentage of the bearers that made up the Internet and the ISC was satisfied that GCHQ applied levels of filtering and selection such that only a certain amount of the material on those bearers was collected. Further targeted searches ensured that only those items believed to be of the highest intelligence value were ever presented for analysts to examine, with the consequence that only a tiny fraction of those collected were ever seen by human eyes. 145. In respect of Internet communications, the ISC considered that the distinction between “internal” and “external” communications was confusing and lacked transparency. It therefore suggested that the Government publish an explanation of which Internet communications fell under which category. Nevertheless, the inquiry had established that bulk interception could not be used to target the communications of an individual in the United Kingdom without a specific authorisation, signed by a Secretary of State, naming that individual. 146. The ISC observed that the section 8(4) warrant was very brief. In so far as the accompanying certificate set out the categories of communications which might be examined, those categories were expressed in very general terms (for example, “material providing intelligence on terrorism (as defined by the Terrorism Act 2000 (as amended)), including, but not limited to, terrorist organisations, terrorists, active sympathisers, attack planning, fund-raising”). Given that the certificate was so generic, the ISC questioned whether it needed to be secret or whether, in the interests of transparency, it could be published. 147. Although the section 8(4) certificate set out the general categories of information which could be examined, the ISC found that in practice it was the selection of the bearers and the application of simple selectors and search criteria which determined what communications were examined. The ISC had therefore sought assurances that these were subject to scrutiny and review by Ministers and/or the Commissioners. However, the evidence before the ISC indicated that neither Ministers nor the Commissioners had any significant visibility of these issues. The ISC therefore recommended that the IC Commissioner should be given statutory responsibility to review the various selection criteria used in bulk interception to ensure that they followed directly from the certificate and valid national security requirements. 148. The ISC noted that communications data were central to most intelligence services’ investigations: they could be analysed to find patterns that reflected particular online behaviours associated with activities such as attack planning, to establish links, to help focus on individuals who might pose a threat, to ensure that interception was properly targeted, and to illuminate networks and associations relatively quickly. They were particularly useful in the early stages of an investigation, when the intelligence services had to be able to determine whether those associating with a target were connected to the plot (and therefore required further investigation) or were innocent bystanders. According to the Secretary of State for the Home Department, they had “played a significant role in every Security Service counter-terrorism operation over the last decade”. Nevertheless, the ISC expressed concern about the definition of “communications data”. While it accepted that there was a category of communications data which was less intrusive than content, and therefore did not require the same degree of protection, it considered that there existed certain categories of communications data which had the potential to reveal more intrusive details about a person’s private life and, therefore, required greater safeguards. 149. Finally, with regard to the IPT, the ISC expressly recognised the importance of a domestic right of appeal. “A Question of Trust”: Report of the Investigatory Powers Review by the Independent Reviewer of Terrorism Legislation (“the Anderson Report”)
150. The Independent Reviewer of Terrorism Legislation is a person wholly independent of Government, appointed by the Home Secretary and by the Treasury for a renewable three-year term. He is tasked with reporting to the Home Secretary and to Parliament on the operation of counter‑terrorism law in the United Kingdom. These reports are laid before Parliament to inform the public and political debate. 151. The purpose of the Anderson Report, which was both laid before Parliament and published on 11 June 2015, and which was named after David Anderson Q.C., the then Independent Reviewer of Terrorism Legislation, was to inform the public and political debate on the threats to the United Kingdom, the capabilities required to combat those threats, the safeguards in place to protect privacy, the challenges of changing technology, issues relating to transparency and oversight, and the case for new or amended legislation. In conducting the review the Independent Reviewer had unrestricted access, at the highest level of security clearance, to the responsible Government departments and public authorities. He also engaged with service providers, independent technical experts, non‑governmental organisations, academics, lawyers, judges and regulators. 152. The Independent Reviewer had noted that the statutory framework governing investigatory powers had “developed in a piecemeal fashion”, with the consequence that there were “few [laws] more impenetrable than RIPA and its satellites”. 153. With regard to the importance of communications data, he observed that they enabled the intelligence services to build a picture of a subject of interest’s activities and were extremely important in providing information about criminal and terrorist activity. They identified targets for further work and also helped to determine if someone was completely innocent. Of central importance was the ability to use communications data (subject to necessity and proportionality) for:
(a)  linking an individual to an account or action (for example, visiting a website or sending an email) through IP resolution;
(b)  establishing a person’s whereabouts, traditionally via cell site or GPRS data;
(c)   establishing how suspects or victims were communicating (that is, via which applications or services);
(d)  observing online criminality (for example, which websites were being visited for the purposes of terrorism, child sexual exploitation or purchases of firearms or illegal drugs); and
(e)  exploiting data (for example, to identify where, when and with whom or what someone was communicating, how malware or a denial of service attack was delivered, and to corroborate other evidence). 154. Moreover, analysis of communications data could be performed speedily, making them extremely useful in fast-moving operations, and use of communications data could either build a case for using a more intrusive measure, or deliver the information that would make other measures unnecessary. 155. The Independent Reviewer’s proposals for reform can be summarised as follows:
(a)  the drafting of a comprehensive and comprehensible new law, replacing “the multitude of current powers” and providing clear limits and safeguards on any intrusive power it might be necessary for public authorities to use;
(b)  the review and clarification of the definitions of “content” and “communications data”;
(c)   the retention of the capability of the security and intelligence services to practice bulk collection of intercepted material and associated communications data, but only subject to strict additional safeguards including the authorisation of all warrants by a Judicial Commissioner at a new Independent Surveillance and Intelligence Commission (“ISIC”);
(d)  the spelling out in the accompanying certificate of the purposes for which material or data were sought by reference to specific operations or mission purposes (for example, “attack planning by ISIL in Iraq/Syria against the UK”);
(e)  the creation of a new form of bulk warrant limited to the acquisition of communications data which could be a proportionate option in certain cases;
(f)     the ISIC should take over intelligence oversight functions and should be public-facing, transparent and accessible to the media; and
(g)  the IPT should have the capacity to make declarations of incompatibility and its rulings should be subject to appeals on points of law. A Democratic Licence to Operate: Report of the Independent Surveillance Review (“ISR”)
156. The ISR was undertaken by the Royal United Services Institute, an independent think-tank, at the request of the then deputy Prime Minister, partly in response to the revelations by Edward Snowden. Its terms of reference were to look at the legality of United Kingdom surveillance programmes and the effectiveness of the regimes that governed them, and to suggest reforms which might be necessary to protect both individual privacy and the necessary capabilities of the police and security and intelligence services. 157. Having completed its review the ISR found no evidence that the British Government was knowingly acting illegally in intercepting private communications, or that the ability to collect data in bulk was being used by the Government to provide it with a perpetual window into the private lives of British citizens. On the other hand, it found evidence that the existing legal framework authorising the interception of communications was unclear, had not kept pace with developments in communications’ technology, and did not serve either the Government or members of the public satisfactorily. It therefore concluded that a new, comprehensive and clearer legal framework was required. 158. In particular, it supported the view set out in both the ISC and Anderson Report that while the current surveillance powers were needed, both a new legislative framework and oversight regime were required. It further considered that the definitions of “content” and “communications data” should be reviewed as part of the drafting of the new legislation so that they could be delineated clearly in law. 159. With regard to communications data, the report noted that greater volumes were available on an individual relative to content, because every piece of content was surrounded by multiple pieces of communications data. Furthermore, aggregating data sets could create an extremely accurate picture of an individual’s life since, given enough raw data, algorithms and powerful computers could generate a substantial picture of the individual and his or her patterns of behaviour without ever accessing content. In addition, the use of increasingly sophisticated encryption methods had made content increasingly difficult to access. 160. It further considered that the capability of the security and intelligence services to collect and analyse intercepted material in bulk should be maintained, but with the stronger safeguards recommended in the Anderson Report. In particular, it agreed that warrants for bulk interception should include much more detail and should be the subject of a judicial authorisation process, save for when there was an urgent requirement. 161. In addition, it agreed with both the ISC and the Anderson Report that there should be different types of warrant for the interception and acquisition of communications and related data. It was proposed that warrants for a purpose relating to the detection or prevention of serious and organised crime should always be authorised by a Judicial Commissioner, while warrants for purposes relating to national security should be authorised by the Secretary of State subject to judicial review by a Judicial Commissioner. 162. With regard to the IPT, the ISR recommended open public hearings, except where it was satisfied private or closed hearings were necessary in the interests of justice or other identifiable public interest. Furthermore, the IPT should have the ability to test secret evidence put before it, possibly through the appointment of Special Counsel. Finally, it agreed with the ISC and Anderson Report that a domestic right of appeal was important and should be considered in future legislation. Report of the Bulk Powers Review
163. The bulk powers review was set up in May 2016 to evaluate the operational case for the four bulk powers contained in what was then the Investigatory Powers Bill (now the Investigatory Powers Act 2016: see paragraphs 183-190 below). Those powers related to bulk interception and the bulk acquisition of communications data, bulk equipment interference and the acquisition of bulk personal datasets. 164. The review was again carried out by the Independent Reviewer of Terrorism Legislation. To conduct the review he recruited three team members, all of whom had the necessary security clearance to access very highly classified material, including a person with the necessary technical background to understand the systems and techniques used by GCHQ, and the uses to which they could be put; an investigator with experience as a user of secret intelligence, including intelligence generated by GCHQ; and senior independent counsel with the skills and experience to challenge forensically the evidence and the case studies presented by the security and intelligence services. 165. In conducting their review, the team had significant and detailed contact with the intelligence services at all levels of seniority as well as the relevant oversight bodies (including the IPT and Counsel to the Tribunal), NGOs and independent technical experts. 166. Although the review was of the Investigatory Powers Bill, a number of its findings in respect of bulk interception were relevant to the case at hand. In particular, having examined a great deal of closed material, the review concluded that bulk interception was an essential capability: first, because terrorists, criminal and hostile foreign intelligence services had become increasingly sophisticated at evading detection by traditional means; and secondly, because the nature of the global Internet meant that the route a particular communication would travel had become hugely unpredictable. The review team looked at alternatives to bulk interception (including targeted interception, the use of human sources and commercial cyber-defence products) but concluded that no alternative or combination of alternatives would be sufficient to substitute for the bulk interception power as a method of obtaining the necessary intelligence. Attacks in London and Manchester March-June 2017: Independent Assessment of MI5 and Police Internal Reviews
167. Following a series of four terrorist attacks in the short period between March and June 2017, in the course of which some thirty-six innocent people were killed and almost 200 more were injured, the Home Secretary asked the recently retired Independent Reviewer of Terrorism Legislation, David Anderson Q.C., to assess the classified internal reviews of the police and intelligence services involved. In placing the attacks in context, the Report made the following observations:
“1.4  First, the threat level in the UK from so-called ‘international terrorism’ (in practice, Islamist terrorism whether generated at home or abroad) has been assessed by the Joint Terrorism Analysis Centre (JTAC) as SEVERE since August 2014, indicating that Islamist terrorist attacks in the UK are ‘highly likely’. Commentators with access to the relevant intelligence have always been clear that this assessment is realistic. They have pointed also to the smaller but still deadly threat from extreme right wing (XRW) terrorism, exemplified by the murder of Jo Cox MP in June 2016 and by the proscription of the neo-Nazi group National Action in December 2016.
1.5  Secondly, the growing scale of the threat from Islamist terrorism is striking. The Director General of MI5, Andrew Parker, spoke in October 2017 of ‘a dramatic upshift in the threat this year’ to ‘the highest tempo I’ve seen in my 34 year career’. Though deaths from Islamist terrorism occur overwhelmingly in Africa, the Middle East and South Asia, the threat has grown recently across the western world, and has been described as ‘especially diffuse and diverse in the UK’. It remains to be seen how this trend will be affected, for good or ill, by the physical collapse of the so‑called Islamic State in Syria and Iraq.
1.6  Thirdly, the profiles of the attackers ... display many familiar features. ...
1.7  Fourthly, though the targets of the first three attacks did not extend to the whole of the current range, they had strong similarities to the targets of other recent western attacks: political centres (e.g. Oslo 2011, Ottawa 2014, Brussels 2016); concert-goers, revellers and crowds (e.g. Orlando 2016, Paris 2016, Barcelona 2017); and police officers (e.g. Melbourne 2014, Berlin 2015, Charleroi 2016). There are precedents also for attacks on observant Muslims which have crossed the boundary from hate crime to terrorism, including the killing of Mohammed Saleem in the West Midlands in 2013.
1.8  Fifthly, the modus operandi (MO) of terrorist attacks has diversified and simplified over the years, as Daesh has employed its formidable propaganda effort to inspire rather than to direct acts of terrorism in the west. The attacks under review were typical in style for their time and place:
(a)  Unlike the large, directed Islamist plots characteristic of the last decade, all four attacks were committed by lone actors or small groups, with little evidence of detailed planning or precise targeting. (b)  Strong gun controls in the UK mean that bladed weapons are more commonly used than firearms in gang-related and terrorist crime. (c)  Since a truck killed 86 innocent people in Nice (July 2016), vehicles – which featured in three of the four attacks under review – have been increasingly used as weapons. (d)  The combination of a vehicle and bladed weapons, seen at Westminster and London Bridge, had previously been used to kill the soldier Lee Rigby (Woolwich, 2013). (e)  Explosives, used in Manchester, were the most popular weapon for Islamist terrorists targeting Europe between 2014 and 2017. The explosive TATP has proved to be capable of manufacture (aided by on-line purchases and assembly instructions) more easily than was once assumed.”
Annual Report of the Interception of Communications Commissioner for 2016
168. The IC Commissioner observed that when conducting interception under a section 8(4) warrant, an intercepting agency had to use its knowledge of the way in which international communications were routed, combined with regular surveys of relevant communications links, to identify those individual communications bearers that were most likely to contain external communications that would meet the descriptions of material certified by the Secretary of State under section 8(4). It also had to conduct the interception in ways that limited the collection of non-external communications to the minimum level compatible with the objective of intercepting the wanted external communications. 169. He further observed that prior to analysts being able to read, look at or listen to material, they had to provide a justification, which included why access to the material was required, consistent with, and pursuant to section 16 and the applicable certificate, and why such access was proportionate. Inspections and audits showed that although the selection procedure was carefully and conscientiously undertaken, it relied on the professional judgment of analysts, their training and management oversight. 170. According to the report, 3007 interception warrants were issued in 2016 and five applications were refused by a Secretary of State. In the view of the IC Commissioner, these figures did not capture the critical quality assurance function initially carried out by the staff and lawyers within the intercepting agency or the warrant-granting department (the warrant-granting departments were a source of independent advice to the Secretary of State and performed pre-authorisation scrutiny of warrant applications and renewals to ensure that they were (and remained) necessary and proportionate). Based on his inspections, he was confident that the low number of rejections reflected the careful consideration given to the use of these powers. 171. A typical inspection of an interception agency included the following:
a review of the action points or recommendations from the previous inspection and their implementation;
an evaluation of the systems in place for the interception of communications to ensure they were sufficient for the purposes of Chapter 1 of Part 1 of RIPA and that all relevant records had been kept;
the examination of selected interception applications to assess whether they were necessary in the first instance and whether the requests met the necessity and proportionality requirements;
interviews with case officers, analysts and/or linguists from selected investigations or operations to assess whether the interception and the justifications for acquiring all of the material were proportionate;
the examination of any urgent oral approvals to check that the process was justified and used appropriately;
a review of those cases where communications subject to legal privilege or otherwise confidential information had been intercepted and retained, and any cases where a lawyer was the subject of an investigation;
a review of the adequacy of the safeguards and arrangements under sections 15 and 16 of RIPA;
an investigation of the procedures in place for the retention, storage and destruction of intercepted material and related communications data; and
a review of the errors reported, including checking that the measures put in place to prevent recurrence were sufficient. 172. After each inspection, inspectors produced a report, including:
an assessment of how far the recommendations from the previous inspection had been achieved;
a summary of the number and type of interception documents selected for inspection, including a detailed list of those warrants;
detailed comments on all warrants selected for further examination and discussion during the inspection;
an assessment of the errors reported to the IC Commissioner’s office during the inspection period;
an account of the examination of the retention, storage and destruction procedures;
an account of other policy or operational issues which the agency or warrant-granting departments raised during the inspection;
an assessment of how any material subject to legal professional privilege (or otherwise confidential material) had been handled; and
a number of recommendations aimed at improving compliance and performance. 173. During 2016, the IC Commissioner’s office inspected all nine interception agencies once and the four main warrant-granting departments twice. This, together with extra visits to GCHQ, made a total of twenty-two inspection visits. In addition, he and his inspectors arranged other ad hoc visits to agencies. 174. Inspection of the systems in place for applying for and authorising interception warrants usually involved a three-stage process. First, to achieve a representative sample of warrants, inspectors selected them across different crime types and national security threats. In addition, inspectors focussed on those of particular interest or sensitivity (such as those which gave rise to an unusual degree of collateral intrusion, those which had been extant for a considerable period, those which were approved orally, those which resulted in the interception of legal or otherwise confidential communications, and so-called “thematic” warrants). Secondly, inspectors scrutinised the selected warrants and associated documentation in detail during reading days which preceded the inspections. At this stage, inspectors were able to examine the necessity and proportionality statements made by analysts when adding a selector to the collection system for examination. Each statement had to stand on its own and had to refer to the overall requirement of priorities for intelligence collection. Thirdly, they identified those warrants, operations or areas of the process which required further information or clarification and arranged to interview relevant operational, legal or technical staff. Where necessary, they examined further documentation or systems relating to those warrants. 175. Nine hundred and seventy warrants were examined during the twenty-two interception inspections (sixty-one percent of the number of warrants in force at the end of the year and thirty-two percent of the total of new warrants issued in 2016). 176. Retention periods were not prescribed by legislation, but the agencies had to consider section 15(3) of RIPA, which provided that the material or data had to be destroyed as soon as retaining them was no longer necessary for any of the authorised purposes in section 15(4). According to the report, every interception agency had a different view on what constituted an appropriate retention period for intercepted material and related communications data. The retention periods therefore differed within the interception agencies; for content, they ranged between thirty days and one year, and for related communications data, they ranged between six months and one year. In practice, however, the vast majority of content was reviewed and automatically deleted after a very short period of time unless specific action was taken to retain the content for longer because it was necessary to do so. 177. The IC Commissioner expressly noted the he “was impressed by the quality” of the necessity and proportionality statements made by analysts when adding a selector to the collection system for examination. 178. Inspectors made a total of twenty-eight recommendations in their inspection reports, eighteen of which were made in relation to the application process. The majority of the recommendations in this category related to the necessity, proportionality and/or collateral intrusion justifications in the applications, or to the handling of legally privileged or otherwise confidential material relating to sensitive professions. 179. The total number of interception errors reported to the IC Commissioner during 2016 was 108. Key causes of interception errors were over-collection (generally technical software or hardware errors that caused over-collection of intercepted material and related communications data), unauthorised selection/examination, incorrect dissemination, the failure to cancel interception, and the interception of either an incorrect communications address or person. 180. Finally, with regard to intelligence sharing, the IC Commissioner noted that:
“GCHQ provided comprehensive details of the sharing arrangements whereby Five Eyes partners can access elements of the product of GCHQ’s interception warrants on their own systems. My inspectors also met representatives of the Five Eyes community and received a demonstration of how other Five Eyes members can request access to GCHQ’s data. Access to GCHQ systems is tightly controlled and has to be justified in accordance with the laws of the host country and handling instructions of section 15/16 safeguards. Before getting any access to GCHQ data, Five Eyes analysts must complete the same legalities training as GCHQ staff.”
Annual report of the Intelligence Services Commissioner for 2016
181. The Intelligence Services Commissioner, in his report on compliance with the “Consolidated Guidance to Intelligence Officers and Service Personnel on the Detention and Interviewing of Detainees Overseas, and on the Passing and Receipt of Intelligence Relating to Detainees”, observed that
“In the course of their work, each of the agencies works closely with foreign liaison partners. This involves routine intelligence sharing and at times collaborative operations. I am satisfied that the agencies are sensitive to the implications of working with partners acting under different legal systems and note that [the United Kingdom Intelligence Community] working overseas are careful to apply the principles of UK law as far as possible.
... GCHQ works closely with liaison partners and is involved in regular intelligence sharing and at times collaborative work. This is a complex area for both GCHQ and SIS, where agency staff work with partners who are applying different and sometimes incompatible legal frameworks. I have been impressed by the efforts of GCHQ’s staff to gain assurances from partners, particularly with regard to the consolidated guidance. I have recommended that GCHQ should consider making reference in relevant submissions to the fact of local laws which will affect any partner’s activity. I was satisfied that GCHQ is applying the principles of the consolidated guidance sensitively, and am pleased that changes made to the training for 24/7 staff are raising the already high standard of the referrals process. I noted that on occasion GCHQ officers updated the consolidated guidance log after the fact to clarify judgements or details. While it is important to represent the fullest available facts, I recommended that GCHQ should set out points of clarification in addition to and not amendment to the original log entry. GCHQ subsequently confirmed that this has been implemented.
... The Foreign Secretary is also responsible for providing ministerial oversight on occasions where the consolidated guidance has been engaged and the agencies intend to proceed, either with intelligence sharing or a live operation. I have recommended that the [Foreign and Commonwealth Office] should obtain a copy of any assurances that SIS have obtained from a liaison partner. I would advise that these should be made available for the Foreign Secretary to scrutinise while considering any consolidated guidance-related submissions.”
182. Oversight of compliance with the Consolidated Guidance now falls under the remit of the new Investigatory Powers Commissioner. The Guidance is currently being reviewed since the Intelligence Services Commissioner, in his 2015 report, indicated that while he did “not think that the Consolidated Guidance was fundamentally defective or not fit for purpose”, he nevertheless expressed the view that it had been “in operation in its current form for some years and that there was room for improvement”. The Investigatory Powers Act 2016
183. The Investigatory Powers Act 2016 received Royal Assent on 29 November 2016. The new regime which it introduced is now largely operational, with the majority of the powers under the Act having been brought into force during the course of 2018. 184. Under the 2016 Act a bulk interception warrant – which may cover both the “content” of communications and “secondary data” – has to be necessary at least in the interests of national security (but may also be for the purpose of preventing or detecting serious crime or in the interests of the economic well-being of the United Kingdom in so far as those interests are also relevant to national security). The warrant must specify the “operational purposes” for which any material obtained under that warrant may be selected for examination. There are detailed provisions about the making of the list of “operational purposes” by the heads of the intelligence services. An operational purpose may be specified in that list only with the approval of the Secretary of State. The list of operational purposes must be provided to the ISC every three months and must be reviewed by the Prime Minister at least once a year. 185. An application for a bulk warrant must be made by or on behalf of the head of an intelligence service. The power to issue a warrant must be exercised by the Secretary of State personally and in deciding whether to issue a bulk warrant he or she must apply the principles of necessity and proportionality. The issuing of the warrant is subject to prior approval by a Judicial Commissioner, who must apply the principles of judicial review (the so-called “double-lock”). The Judicial Commissioner must therefore consider for himself or herself questions such as whether an interference is justified as being proportionate under Article 8 § 2 of the Convention. 186. The warrant lasts for six months unless it has already been cancelled or renewed. Renewal is subject to approval by a Judicial Commissioner. 187. The “main purpose” of the warrant must be to obtain “overseas‑related communications”, being communications sent to or received by individuals outside the British Islands. Selection for examination of intercepted content or “protected material” is subject to the “British Islands safeguard”, meaning that it may not at any time be selected for examination if any criteria used for the selection of the intercepted content for examination are referable to an individual known to be in the British Islands at that time, and the purpose of using those criteria is to identify the content of communications sent by, or intended for, that individual. 188. The 2016 Act also created a right of appeal from the IPT and replaced the Interception of Communications Commissioner with a new Investigatory Powers Commissioner (see paragraph 138 above). 189. A series of new Codes of Practice, including a new Interception of Communications Code of Practice, entered into force on 8 March 2018 (see paragraph 102 above). 190. Part 4 of the 2016 Act, which came into force on 30 December 2016, included a power to issue “retention notices” to telecommunications operators requiring the retention of data. Following a legal challenge by Liberty, the Government conceded that Part 4 of the 2016 Act was, in its existing form, inconsistent with the requirements of EU law. Part 4 was not amended and on 27 April 2018 the High Court found Part 4 to be incompatible with fundamental rights in EU law since, in the area of criminal justice, access to retained data was not limited to the purpose of combating “serious crime”; and access to retained data was not subject to prior review by a court or an independent administrative body. RELEVANT INTERNATIONAL LAWThe United Nations

191. Resolution no. 68/167, adopted by the General Assembly on 18 December 2013, reads as follows:
“The General Assembly,
... 4. Calls upon all States:
... (c)  To review their procedures, practices and legislation regarding the surveillance of communications, their interception and the collection of personal data, including mass surveillance, interception and collection, with a view to upholding the right to privacy by ensuring the full and effective implementation of all their obligations under international human rights law;
(d)  To establish or maintain existing independent, effective domestic oversight mechanisms capable of ensuring transparency, as appropriate, and accountability for State surveillance of communications, their interception and the collection of personal data ...”
The Council of EuropeThe Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data 1981

192. The Convention, which entered into force in respect of the United Kingdom on 1 December 1987, sets out standards for data protection in the sphere of automatic processing of personal data in the public and private sectors. It provides, in so far as relevant:
Preamble
“The member States of the Council of Europe, signatory hereto,
Considering that the aim of the Council of Europe is to achieve greater unity between its members, based in particular on respect for the rule of law, as well as human rights and fundamental freedoms;
Considering that it is desirable to extend the safeguards for everyone’s rights and fundamental freedoms, and in particular the right to the respect for privacy, taking account of the increasing flow across frontiers of personal data undergoing automatic processing;
Reaffirming at the same time their commitment to freedom of information regardless of frontiers;
Recognising that it is necessary to reconcile the fundamental values of the respect for privacy and the free flow of information between peoples,
Have agreed as follows:”
Article 1 – Object and purpose
“The purpose of this Convention is to secure in the territory of each Party for every individual, whatever his nationality or residence, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him (‘data protection’).”
... Article 8 – Additional safeguards for the data subject
“Any person shall be enabled:
a.  to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file;
b.  to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form;
c.  to obtain, as the case may be, rectification or erasure of such data if these have been processed contrary to the provisions of domestic law giving effect to the basic principles set out in Articles 5 and 6 of this convention;
d.  to have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in paragraphs b and c of this article is not complied with.”
Article 9 – Exceptions and restrictions
“1. No exception to the provisions of Articles 5, 6 and 8 of this Convention shall be allowed except within the limits defined in this article. 2. Derogation from the provisions of Articles 5, 6 and 8 of this Convention shall be allowed when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of:
a.  protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences;
b.  protecting the data subject or the rights and freedoms of others.
...”
Article 10 – Sanctions and remedies
“Each Party undertakes to establish appropriate sanctions and remedies for violations of provisions of domestic law giving effect to the basic principles for data protection set out in this chapter.”
193. The Explanatory Report to the above-mentioned Convention explains that:
Article 9 – Exceptions and restrictions
“55. Exceptions to the basic principles for data protection are limited to those which are necessary for the protection of fundamental values in a democratic society. The text of the second paragraph of this article has been modelled after that of the second paragraphs of Articles 6, 8, 10 and 11 of the European Human Rights Convention. It is clear from the decisions of the Commission and the Court of Human Rights relating to the concept of ‘necessary measures’ that the criteria for this concept cannot be laid down for all countries and all times, but should be considered in the light of the given situation in each country. 56. Littera a in paragraph 2 lists the major interests of the State which may require exceptions. These exceptions are very specific in order to avoid that, with regard to the general application of the convention, States would have an unduly wide leeway. States retain, under Article 16, the possibility to refuse application of the convention in individual cases for important reasons, which include those enumerated in Article 9. The notion of ‘State security’ should be understood in the traditional sense of protecting national sovereignty against internal or external threats, including the protection of the international relations of the State.”
The Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data regarding supervisory authorities and transborder data flows of 8 November 2001 (CETS No. 181)
194. The Protocol, which has not been ratified by the United Kingdom, provides, in so far as relevant:
Article 1 – Supervisory authorities
“1. Each Party shall provide for one or more authorities to be responsible for ensuring compliance with the measures in its domestic law giving effect to the principles stated in Chapters II and III of the Convention and in this Protocol.
2. a. To this end, the said authorities shall have, in particular, powers of investigation and intervention, as well as the power to engage in legal proceedings or bring to the attention of the competent judicial authorities violations of provisions of domestic law giving effect to the principles mentioned in paragraph 1 of Article 1 of this Protocol.
b. Each supervisory authority shall hear claims lodged by any person concerning the protection of his/her rights and fundamental freedoms with regard to the processing of personal data within its competence. 3. The supervisory authorities shall exercise their functions in complete independence. 4. Decisions of the supervisory authorities, which give rise to complaints, may be appealed against through the courts.
...”
Article 2 – Transborder flows of personal data to a recipient which is not subject to the jurisdiction of a Party to the Convention
“1. Each Party shall provide for the transfer of personal data to a recipient that is subject to the jurisdiction of a State or organisation that is not Party to the Convention only if that State or organisation ensures an adequate level of protection for the intended data transfer. 2. By way of derogation from paragraph 1 of Article 2 of this Protocol, each Party may allow for the transfer of personal data:
a.  if domestic law provides for it because of:
–  specific interests of the data subject, or
–  legitimate prevailing interests, especially important public interests, or
b.  if safeguards, which can in particular result from contractual clauses, are provided by the controller responsible for the transfer and are found adequate by the competent authorities according to domestic law.”
Recommendation of the Committee of Ministers on the protection of personal data in the area of telecommunication services
195. Recommendation (No. R (95) 4 of the Committee of Ministers), which was adopted on 7 February 1995, reads, in so far as relevant, as follows:
“2.4. Interference by public authorities with the content of a communication, including the use of listening or tapping devices or other means of surveillance or interception of communications, must be carried out only when this is provided for by law and constitutes a necessary measure in a democratic society in the interests of:
a.  protecting state security, public safety, the monetary interests of the state or the suppression of criminal offences;
b.  protecting the data subject or the rights and freedoms of others.
2.5. In the case of interference by public authorities with the content of a communication, domestic law should regulate:
a.  the exercise of the data subject’s rights of access and rectification;
b.  in what circumstances the responsible public authorities are entitled to refuse to provide information to the person concerned, or delay providing it;
c.  storage or destruction of such data. If a network operator or service provider is instructed by a public authority to effect an interference, the data so collected should be communicated only to the body designated in the authorisation for that interference.”
The 2015 Report of the European Commission for Democracy through Law (“the Venice Commission”) on the Democratic Oversight of Signals Intelligence Agencies
196. The Venice Commission noted, at the outset, the value that bulk interception could have for security operations, since it enabled the security services to adopt a proactive approach, looking for hitherto unknown dangers rather than investigating known ones. However, it also noted that intercepting bulk data in transmission, or requirements that telecommunications companies store and then provide telecommunications content data or metadata to law-enforcement or security agencies, involved an interference with the privacy and other human rights of a large proportion of the population of the world. In this regard, the Venice Commission considered that the main interference with privacy occurred when stored personal data were accessed and/or processed by the agencies. For this reason, the computer analysis (usually with the help of selectors) was one of the important stages for balancing personal integrity concerns against other interests. 197. According to the report, the two most significant safeguards were the authorisation (of collection and access) and the oversight of the process. It was clear from the Court’s case-law that the latter had to be performed by an independent, external body. While the Court had a preference for judicial authorisation, it had not found this to be a necessary requirement. Rather, the system had to be assessed as a whole, and where independent controls were absent at the authorisation stage, particularly strong safeguards had to exist at the oversight stage. In this regard, the Venice Commission considered the example of the system in the United States, where authorisation was given by the FISC. However, despite the existence of judicial authorisation, the lack of independent oversight of the conditions and limitations set by the court was problematic. 198. Similarly, the Commission observed that notification of the subject of surveillance was not an absolute requirement of Article 8 of the Convention, since a general complaints procedure to an independent oversight body could compensate for non-notification. 199. The report also considered internal controls to be a “primary safeguard”. Recruitment and training were key issues; in addition, it was important for the agencies to build in respect for privacy and other human rights when promulgating internal rules. 200. The report acknowledged that journalists were a group which required special protection, since searching their contacts could reveal their sources (and the risk of discovery could be a powerful disincentive to whistle-blowers). Nevertheless, it considered there to be no absolute prohibition on searching the contacts of journalists, provided that there were very strong reasons for doing so. According to the report, the journalistic profession was not one which was easily identified, since NGOs were also engaged in building public opinion and even bloggers could claim to be entitled to equivalent protections. 201. Finally, the report considered briefly the issue of intelligence sharing, and in particular the risk that States could thereby circumvent stronger domestic surveillance procedures and/or any legal limits which their agencies might be subject to as regards domestic intelligence operations. It considered that a suitable safeguard would be to provide that the bulk material transferred could only be searched if all the material requirements of a national search were fulfilled and this was duly authorised in the same way as a search of bulk material obtained by the signals intelligence agency using its own techniques. EUROPEAN UNION LAWCharter of Fundamental Rights of the European Union

202. Articles 7, 8 and 11 of the Charter provide as follows:
Article 7 – Respect for private and family life
“Everyone has the right to respect for his or her private and family life, home and communications.”
Article 8 – Protection of personal data
“1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which have been collected concerning him or her, and the right to have them rectified. 3. Compliance with these rules shall be subject to control by an independent authority.”
Article 11 – Freedom of expression and information
“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. 2. The freedom and pluralism of the media shall be respected.”
European Union directives and regulations relating to protection and processing of personal data
203. The Data Protection Directive (Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data), adopted on 24 October 1995, regulated for many years the protection and processing of personal data within the European Union. As the activities of Member States regarding public safety, defence and State security fell outside the scope of Community law, the Directive did not apply to these activities (Article 3(2)). 204. The General Data Protection Regulation, adopted in April 2016, superseded the Data Protection Directive and became enforceable on 25 May 2018. The regulation, which is directly applicable in Member States,[2] contains provisions and requirements pertaining to the processing of personally identifiable information of data subjects inside the European Union, and applies to all enterprises, regardless of location, doing business with the European Economic Area. Business processes that handle personal data must be built with data protection by design and by default, meaning that personal data must be stored using pseudonymisation or full anonymization, and use the highest-possible privacy settings by default, so that the data are not available publicly without explicit consent, and cannot be used to identify a subject without additional information stored separately. No personal data may be processed unless it is done under a lawful basis specified by the regulation, or if the data controller or processor has received explicit, opt-in consent from the data’s owner. The data owner has the right to revoke this permission at any time. 205. A processor of personal data must clearly disclose any data collection, declare the lawful basis and purpose for data processing, how long data are being retained, and if they are being shared with any third‑parties or outside of the European Union. Users have the right to request a portable copy of the data collected by a processor in a common format, and the right to have their data erased under certain circumstances. Public authorities, and businesses whose core activities centre around regular or systematic processing of personal data, are required to employ a data protection officer (DPO), who is responsible for managing compliance with the GDPR. Businesses must report any data breaches within 72 hours if they have an adverse effect on user privacy. 206. The Privacy and Electronic Communications Directive (Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector), adopted on 12 July 2002, states, in recitals 2 and 11:
“(2)  This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by the Charter of fundamental rights of the European Union. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of that Charter.
... ... ... (11)  Like Directive 95/46/EC, this Directive does not address issues of protection of fundamental rights and freedoms related to activities which are not governed by Community law. Therefore it does not alter the existing balance between the individual’s right to privacy and the possibility for Member States to take the measures referred to in Article 15(1) of this Directive, necessary for the protection of public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the enforcement of criminal law. Consequently, this Directive does not affect the ability of Member States to carry out lawful interception of electronic communications, or take other measures, if necessary for any of these purposes and in accordance with the European Convention for the Protection of Human Rights and Fundamental Freedoms, as interpreted by the rulings of the European Court of Human Rights. Such measures must be appropriate, strictly proportionate to the intended purpose and necessary within a democratic society and should be subject to adequate safeguards in accordance with the European Convention for the Protection of Human Rights and Fundamental Freedoms.”
207. The Directive further provides, in so far as relevant:
Article 1 – Scope and aim
“1. This Directive harmonises the provisions of the Member States required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the Community. 2. The provisions of this Directive particularise and complement Directive 95/46/EC for the purposes mentioned in paragraph 1. Moreover, they provide for protection of the legitimate interests of subscribers who are legal persons. 3. This Directive shall not apply to activities which fall outside the scope of the Treaty establishing the European Community, such as those covered by Titles V and VI of the Treaty on European Union, and in any case to activities concerning public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the activities of the State in areas of criminal law.”
Article 15 – Application of certain provisions of Directive 95/46/EC
“1. Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.”
208. On 15 March 2006 the Data Retention Directive (Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC) was adopted. Prior to the judgment of 2014 declaring it invalid (see paragraph 209 below), it provided, in so far as relevant:
Article 1 - Subject matter and scope
“1. This Directive aims to harmonise Member States’ provisions concerning the obligations of the providers of publicly available electronic communications services or of public communications networks with respect to the retention of certain data which are generated or processed by them, in order to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime, as defined by each Member State in its national law. 2. This Directive shall apply to traffic and location data on both legal entities and natural persons and to the related data necessary to identify the subscriber or registered user. It shall not apply to the content of electronic communications, including information consulted using an electronic communications network.”
Article 3 – Obligation to retain data
“1. By way of derogation from Articles 5, 6 and 9 of Directive 2002/58/EC, Member States shall adopt measures to ensure that the data specified in Article 5 of this Directive are retained in accordance with the provisions thereof, to the extent that those data are generated or processed by providers of publicly available electronic communications services or of a public communications network within their jurisdiction in the process of supplying the communications services concerned.”
Relevant case-law of the Court of Justice of the European Union (“CJEU”)Digital Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others (Cases C‑293/12 and C‑594/12; ECLI:EU:C:2014:238)

209. In a judgment of 8 April 2014 the CJEU declared invalid the Data Retention Directive 2006/24/EC laying down the obligation on the providers of publicly available electronic communication services or of public communications networks to retain all traffic and location data for periods from six months to two years, in order to ensure that the data were available for the purpose of the investigation, detection and prosecution of serious crime, as defined by each Member State in its national law. The CJEU noted that, even though the directive did not permit the retention of the content of the communication, the traffic and location data covered by it might allow very precise conclusions to be drawn concerning the private lives of the persons whose data had been retained. Accordingly, the obligation to retain the data constituted in itself an interference with the right to respect for private life and communications guaranteed by Article 7 of the Charter of Fundamental Rights of the European Union and the right to protection of personal data under Article 8 of the Charter. 210. The access of the competent national authorities to the data constituted a further interference with those fundamental rights, which the CJEU considered to be “particularly serious”. The fact that data were retained and subsequently used without the subscriber or registered user being informed was, according to the CJEU, likely to generate in the minds of the persons concerned the feeling that their private lives were the subject of constant surveillance. The interference satisfied an objective of general interest, namely to contribute to the fight against serious crime and terrorism and thus, ultimately, to public security. However, it failed to satisfy the requirement of proportionality. 211. Firstly, the directive covered, in a generalised manner, all persons and all means of electronic communication as well as all traffic data without any differentiation, limitation or exception being made in the light of the objective of fighting against serious crime. It therefore entailed an interference with the fundamental rights of practically the entire European population, according to the CJEU. It applied even to persons for whom there was no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime. 212. Secondly, the directive did not contain substantive and procedural conditions relating to the access of the competent national authorities to the data and to their subsequent use. By simply referring, in a general manner, to serious crime, as defined by each Member State in its national law, the directive failed to lay down any objective criterion by which to determine which offences might be considered to be sufficiently serious to justify such an extensive interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter. Above all, the access by the competent national authorities to the data retained was not made dependent on a prior review carried out by a court or by an independent administrative body whose decision sought to limit access to the data and their use to what was strictly necessary for the purpose of attaining the objective pursued. 213. Thirdly, the directive required that all data be retained for a period of at least six months, without any distinction being made between the categories of data on the basis of their possible usefulness for the purposes of the objective pursued or according to the persons concerned. The CJEU concluded that the directive entailed a wide-ranging and particularly serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, without such an interference being precisely circumscribed by provisions to ensure that it was actually limited to what was strictly necessary. The CJEU also noted that the directive did not provide for sufficient safeguards, by means of technical and organisational measures, to ensure effective protection of the data retained against the risk of abuse and against any unlawful access and use of those data. Tele2 Sverige AB v. Post- och telestyrelsen and Secretary of State for the Home Department v. Tom Watson and Others (Cases C‑203/15 and C‑698/15; ECLI:EU:C:2016:970)
214. In Secretary of State for the Home Department v. Watson and Others, the applicants had sought judicial review of the legality of section 1 of the Data Retention and Investigatory Powers Act 2014 (“DRIPA”), pursuant to which the Secretary of State could require a public telecommunications operator to retain relevant communications data if he or she considered it necessary and proportionate for one or more of the purposes falling within paragraphs (a) to (h) of section 22(2) of RIPA. The applicants claimed, inter alia, that section 1 was incompatible with Articles 7 and 8 of the Charter and Article 8 of the Convention. 215. On 17 July 2015, the High Court held that the Digital Rights judgment laid down “mandatory requirements of EU law” applicable to the legislation of Member States on the retention of communications data and access to such data. Since the CJEU, in that judgment, held that Directive 2006/24 was incompatible with the principle of proportionality, national legislation containing the same provisions as that directive could, equally, not be compatible with that principle. In fact, it followed from the underlying logic of the Digital Rights judgment that legislation that established a general body of rules for the retention of communications data was in breach of the rights guaranteed in Articles 7 and 8 of the Charter, unless that legislation was complemented by a body of rules for access to the data, defined by national law, which provided sufficient safeguards to protect those rights. Accordingly, section 1 of DRIPA was not compatible with Articles 7 and 8 of the Charter as it did not lay down clear and precise rules providing for access to and use of retained data and access to those data was not made dependent on prior review by a court or an independent administrative body. 216. On appeal by the Secretary of State, the Court of Appeal sought a preliminary ruling from the CJEU. 217. Before the CJEU this case was joined with the request for a preliminary ruling from the Kammarrätten i Stockholm in Case C‑203/15 Tele2 Sverige AB v Post- och telestyrelsen. Following an oral hearing in which some fifteen European Union Member States intervened, the CJEU gave judgment on 21 December 2016. The CJEU held that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, had to be interpreted as precluding national legislation governing the protection and security of traffic and location data and, in particular, access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, was not restricted solely to fighting serious crime, where access was not subject to prior review by a court or an independent administrative authority, and where there was no requirement that the data concerned should be retained within the European Union. 218. The CJEU declared the Court of Appeal’s question whether the protection afforded by Articles 7 and 8 of the Charter was wider than that guaranteed by Article 8 of the Convention inadmissible. 219. Following the handing down of the CJEU’s judgment, the case was relisted before the Court of Appeal. On 31 January 2018 it granted declaratory relief in the following terms: that section 1 of DRIPA was inconsistent with European Union law to the extent that it permitted access to retained data where the object pursued by access was not restricted solely to fighting serious crime; or where access was not subject to prior review by a court or independent administrative authority. Ministerio Fiscal (Case C-207/16; ECLI:EU:C:2018:788)
220. This request for a preliminary ruling arose after Spanish police, in the course of investigating the theft of a wallet and mobile telephone, asked the investigating magistrate to grant them access to data identifying the users of telephone numbers activated with the stolen telephone during a period of twelve days prior to the theft. The investigating magistrate rejected the request on the ground, inter alia, that the acts giving rise to the criminal investigation did not constitute a “serious” offence. The referring court subsequently sought guidance from the CJEU on fixing the threshold of seriousness of offences above which an interference with fundamental rights, such as competent national authorities’ access to personal data retained by providers of electronic communications services, may be justified. 221. On 2 October 2018 the Grand Chamber of the CJEU ruled that Article 15(1) of Directive 2002/58/EC, read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, had to be interpreted as meaning that the access of public authorities to data for the purpose of identifying the owners of SIM cards activated with a stolen mobile telephone, such as the surnames, forenames and, if need be, addresses of the owners, entailed an interference with their fundamental rights which was not sufficiently serious to entail that access being limited, in the area of prevention, investigation, detection and prosecution of criminal offences, to the objective of fighting serious crime. In particular, it indicated that:
“In accordance with the principle of proportionality, serious interference can be justified, in areas of prevention, investigation, detection and prosecution of criminal offences, only by the objective of fighting crime which must also be defined as ‘serious’. By contrast, when the interference that such access entails is not serious, that access is capable of being justified by the objective of preventing, investigating, detecting and prosecuting ‘criminal offences’ generally.”
222. It did not consider access to the data which were the subject of the request to be a particularly serious interference because it:
“only enables the SIM card or cards activated with the stolen mobile telephone to be linked, during a specific period, with the identity of the owners of those SIM cards. Without those data being cross-referenced with the data pertaining to the communications with those SIM cards and the location data, those data do not make it possible to ascertain the date, time, duration and recipients of the communications made with the SIM card or cards in question, nor the locations where those communications took place or the frequency of those communications with specific people during a given period. Those data do not therefore allow precise conclusions to be drawn concerning the private lives of the persons whose data is concerned.”
Maximillian Schrems v. Data Protection Commissioner (Case C‑362/14; ECLI:EU:C:2015:650)
223. This request for a preliminary ruling arose from a complaint against Facebook Ireland Ltd which was made to the Irish Data Protection Commissioner by Mr. Schrems, an Austrian privacy advocate. Mr. Schrems challenged the transfer of his data by Facebook Ireland to the United States and the retention of his data on servers located in that country. The Data Protection Commissioner rejected the complaint since, in a decision of 26 July 2000, the European Commission had considered that the United States ensured an adequate level of protection of the personal data transferred (“the Safe Harbour Decision”). 224. In its ruling of 6 October 2015, the CJEU held that the existence of a Commission decision finding that a third country ensured an adequate level of protection of the personal data transferred could not eliminate or even reduce the powers available to the national supervisory authorities under the Charter or the Data Protection Directive. Therefore, even if the Commission had adopted a decision, the national supervisory authorities had to be able to examine, with complete independence, whether the transfer of a person’s data to a third country complied with the requirements laid down by the Directive. 225. However, only the CJEU could declare a decision of the Commission invalid. In this regard, it noted that the safe harbour scheme was applicable solely to the United States’ undertakings which adhered to it, and United States’ public authorities were not themselves subject to it. Furthermore, national security, public interest and law enforcement requirements of the United States prevailed over the safe harbour scheme, so that United States’ undertakings were bound to disregard, without limitation, the protective rules laid down by the scheme where they conflicted with such requirements. The safe harbour scheme therefore enabled interference by United States’ public authorities with the fundamental rights of individuals, and the Commission had not, in the Safe Harbour Decision, referred either to the existence, in the United States, of rules intended to limit any such interference, or to the existence of effective legal protection against the interference. 226. As to whether the level of protection in the United States was essentially equivalent to the fundamental rights and freedoms guaranteed within the European Union, the CJEU found that legislation was not limited to what was strictly necessary where it authorised, on a generalised basis, storage of all the personal data of all the persons whose data were transferred from the European Union to the United States without any differentiation, limitation or exception being made in the light of the objective pursued and without an objective criterion being laid down for determining the limits of the access of the public authorities to the data and of their subsequent use. Therefore, under European Union law legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications had to be regarded as compromising the essence of the fundamental right to respect for private life. Likewise, legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, compromised the essence of the fundamental right to effective judicial protection. 227. Finally, the Court found that the Safe Harbour Decision denied the national supervisory authorities their powers where a person called into question whether the decision was compatible with the protection of the privacy and of the fundamental rights and freedoms of individuals. The Commission had not had competence to restrict the national supervisory authorities’ powers in that way and, consequently, the CJEU held the Safe Harbour Decision to be invalid
Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems Case (C-311/18; ECLI:EU:C:2020:559)
228. Following the judgment of the CJEU of 6 October 2015, the referring court annulled the rejection of Mr Schrems’ complaint and referred that decision back to the Commissioner. In the course of the Commissioner’s investigation, Facebook Ireland explained that a large part of personal data were transferred to Facebook Inc. pursuant to the standard data protection clauses set out in the annex to Commission Decision 2010/87/EU, as amended. 229. Mr Schrems reformulated his complaint, claiming, inter alia, that the United States’ law required Facebook Inc. to make the personal data transferred to it available to certain United States’ authorities, such as the NSA and the Federal Bureau of Investigation. Since those data were used in the context of various monitoring programmes in a manner incompatible with Articles 7, 8 and 47 of the Charter, Decision 2010/87/EU could not justify the transfer of those data to the United States. On this basis, he asked the Commissioner to prohibit or suspend the transfer of his personal data to Facebook Inc. 230. In a draft decision published on 24 May 2016, the Commissioner took the provisional view that the personal data of European Union citizens transferred to the United States were likely to be consulted and processed by the United States’ authorities in a manner incompatible with Articles 7 and 8 of the Charter and that United States’ law did not provide those citizens with legal remedies compatible with Article 47 of the Charter. The Commissioner found that the standard data protection clauses in the annex to Decision 2010/87/EU were not capable of remedying that defect, since they did not bind the United States’ authorities. 231. Having considered the United States’ intelligence activities under section 702 of FISA and Executive Order 12333, the High Court concluded that the United States carried out mass processing of personal data without ensuring a level of protection essentially equivalent to that guaranteed by Articles 7 and 8 of the Charter; and that European Union citizens did not have available to them the same remedies as citizens of the United States, with the consequence that United States’ law did not afford European Union citizens a level of protection essentially equivalent to that guaranteed by Article 47 of the Charter. It stayed the proceedings and referred a number of questions to the CJEU for a preliminary ruling. It asked, inter alia, whether European Union law applied to the transfer of data from a private company in the European Union to a private company in a third country; if so, how the level of protection in the third country should be assessed; and whether the level of protection afforded by the United States respected the essence of the rights guaranteed by Article 47 of the Charter. 232. In a judgment of 16 July 2020, the CJEU held that the General Data Protection Regulation (“GDPR”) applied to the transfer of personal data for commercial purposes by an economic operator established in a Member State to another economic operator established in a third country, irrespective of whether, at the time of that transfer or thereafter, those data were liable to be processed by the authorities of the third country in question for the purposes of public security, defence and State security. Moreover, the appropriate safeguards, enforceable rights and effective legal remedies required by the GDPR had to ensure that data subjects whose personal data were transferred to a third country pursuant to standard data protection clauses were afforded a level of protection essentially equivalent to that guaranteed within the European Union. To that end, the assessment of the level of protection afforded in the context of such a transfer had to take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the personal data transferred, the relevant aspects of the legal system of that third country. 233. Furthermore, unless there was a valid Commission adequacy decision, the competent supervisory authority was required to suspend or prohibit a transfer of data to a third country if, in the view of that supervisory authority and in the light of all the circumstances of that transfer, the standard data protection clauses adopted by the Commission were not or could not be complied with in that third country and the protection of the data transferred (as required by European Union law) could not be ensured by other means. 234. In order for the Commission to adopt an adequacy decision, it had to find, duly stating reasons, that the third country concerned ensured, by reason of its domestic law or its international commitments, a level of protection of fundamental rights essentially equivalent to that guaranteed in the European Union legal order. In the CJEU’s view, the Safe Harbour decision was invalid. Section 702 of the Foreign Intelligence Security Act (“FISA”) did not indicate any limitations on the power it conferred to implement surveillance programmes for the purposes of foreign intelligence or the existence of guarantees for non-US persons potentially targeted by those programmes. In those circumstances, it could not ensure a level of protection essentially equivalent to that guaranteed by the Charter. Furthermore, as regards the monitoring programmes based on Executive Order 12333, it was clear that that order also did not confer rights which were enforceable against the United States’ authorities in the courts. Privacy International v. Secretary of State for Foreign and Commonwealth Affairs and Others (Case C-623/17; ECLI:EU:C:2020:790) and La Quadrature du Net and Others, French Data Network and Others and Ordre des barreaux francophones et germanophone and Others (Cases C‑511/18, C‑512/18 and C-520/18; ECLI:EU:C:2020:791)
235. On 8 September 2017, the IPT gave judgment in the case of Privacy International, which concerned the acquisition by the intelligence services of bulk communications data under section 94 of the Telecommunications Act 1984 and bulk personal data. The IPT found that, following their avowal, the regimes were compliant with Article 8 of the Convention. However, it identified the following four requirements which appeared to flow from the CJEU judgment in Watson and Others and which seemed to go beyond the requirements of Article 8 of the Convention: a restriction on non-targeted access to bulk data; a need for prior authorisation (save in cases of validly established emergency) before data could be accessed; provision for subsequent notification of those affected; and the retention of all data within the European Union. 236. On 30 October 2017, the IPT made a request to the CJEU for a preliminary ruling clarifying the extent to which the Watson requirements could apply where the bulk acquisition and automated processing techniques were necessary to protect national security. In doing so, it expressed serious concern that if the Watson requirements were to apply to measures taken to safeguard national security, they would frustrate them and put the national security of Member States at risk. In particular, it noted the benefits of bulk acquisition in the context of national security; the risk that the need for prior authorisation could undermine the intelligence services’ ability to tackle the threat to national security; the danger and impracticality of implementing a requirement to give notice in respect of the acquisition or use of a bulk database, especially where national security was at stake; and the impact an absolute bar on the transfer of data outside the European Union could have on Member States’ treaty obligations. 237. A public hearing took place on 9 September 2019. The Privacy International case was heard together with cases C‑511/18 and C‑512/18, La Quadrature du Net and Others, and C‑520/18, Ordre des barreaux francophones et germanophone and Others, which also concerned the application of Directive 2002/58 to activities related to national security and the combating of terrorism. Thirteen States intervened in support of the States concerned. 238. Two separate judgments were handed down on 6 October 2020. In Privacy International the CJEU found that national legislation enabling a State authority to require providers of electronic communications services to forward traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security fell within the scope of the Directive on privacy and electronic communications. The interpretation of that Directive had to take account of the right to privacy, guaranteed by Article 7 of the Charter, the right to protection of personal data, guaranteed by Article 8, and the right to freedom of expression, guaranteed by Article 11. Limitations on the exercise of those rights had to be provided for by law, respect the essence of the rights, and be proportionate, necessary, and genuinely meet the objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. Furthermore, limitations on the protection of personal data must apply only in so far as is strictly necessary; and in order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose personal data are affected have sufficient guarantees that data will be protected effectively against the risk of abuse. 239. In the opinion of the CJEU, national legislation requiring providers of electronic communications services to disclose traffic data and location data to the security and intelligence agencies by means of general and indiscriminate transmission – which affected all persons using electronic communications services – exceeded the limits of what was strictly necessary and could not be considered to be justified as required by the Directive on privacy and electronic communications read in light of the Charter. 240. However, in La Quadrature du Net and Others the CJEU confirmed that while the Directive on privacy and electronic communications, read in light of the Charter, precluded legislative measures which provided for the general and indiscriminate retention of traffic and location data, where a Member State was facing a serious threat to national security that proved to be genuine and present or foreseeable, it did not preclude legislative measures requiring service providers to retain, generally and indiscriminately, traffic and location data for a period limited to what was strictly necessary, but which could be extended if the threat persisted. For the purposes of combating serious crime and preventing serious threats to public security, a Member State could also provide – if it was limited in time to what was strictly necessary – for the targeted retention of traffic and location data, on the basis of objective and non-discriminatory factors according to the categories of person concerned or using a geographical criterion, or of IP addresses assigned to the source of an Internet connection. It was also open to a Member State to carry out a general and indiscriminate retention of data relating to the civil identity of users of means of electronic communication, without the retention being subject to a specific time limit. 241. Furthermore, the Directive on privacy and electronic communications, read in light of the Charter, did not preclude national rules which required providers of electronic communications services to have recourse, first, to the automated analysis and real-time collection of traffic and location data, and secondly, to the real-time collection of technical data concerning the location of the terminal equipment used, where it was limited to situations in which a Member State was facing a serious threat to national security that was genuine and present or foreseeable, and where recourse to such analysis may be the subject of an effective review by a court or independent administrative body whose decision was binding; and where recourse to the real-time collection of traffic and location data was limited to persons in respect of whom there was a valid reason to suspect that they were involved in terrorist activities and was subject to a prior review carried out either by a court or by an independent administrative body whose decision was binding. RELEVANT COMPARATIVE LAW AND PRACTICEContracting States

242. At least seven Contracting States (being Finland, France, Germany, the Netherlands, Sweden, Switzerland and the United Kingdom) officially operate bulk interception regimes over cables and/or the airways. 243. In one additional State (Norway) a draft law is being debated: if adopted, it will also authorise bulk interception. 244. Details of the Swedish system can be found in the judgment in the case of Centrum för rättvisa v. Sweden (application no. 35252/08); and details of the German system are set out at paragraphs 247-252 below. 245. As regards intelligence sharing agreements, at least thirty-nine Contracting States have either concluded intelligence sharing agreements with other States, or have the possibility for such agreements. Two expressly prohibit and two expressly permit the State to ask a foreign power to intercept material on their behalf. In the remaining States, the position on this issue is not clear. 246. Finally, in most States the applicable safeguards are broadly the same as for domestic operations, with various restrictions on the use of the received data and in some cases an obligation to destroy them if they became irrelevant. Judgment of the German Federal Constitutional Court of 19 May 2020 (1 BvR 2835/17)
247. In this judgment, the Constitutional Court considered whether the Federal Intelligence Service’s powers to conduct strategic (or “signals”) intelligence on foreign telecommunications were in breach of the fundamental rights contained in the Basic Law (Grundgesetz). 248. The regime in question involved the interception of both content and related communications data and aimed only to monitor foreign telecommunications outside of German territory. Such surveillance could be carried out for the purpose of gaining information about topics determined by the Federal Government’s mandate to be significant for the State’s foreign and security policy. It could, however, also be used to target specific individuals. The admissibility and necessity of the orders to conduct such surveillance was controlled by an Independent Panel. According to the Constitutional Court’s judgment, interception was followed by a multi-stage, fully automated filtering and evaluation process. For this purpose, the Federal Intelligence Service used a six-digit number of search terms which were subject to control by an internal sub-unit responsible for ensuring that the link between the search terms employed and the purpose of the data request was explained in a reasonable and comprehensive manner. After the application of the automated filtering process, intercepted material was either deleted or stored and sent for evaluation by an analyst. 249. The sharing of intercept material with foreign intelligence services was accompanied by a cooperation agreement which had to include usage restrictions and assurances to ensure that data were handled and deleted in accordance with the rule of law. 250. The Constitutional Court held that the regime in question was not compliant with the Basic Law. While it acknowledged the overriding public interest in effective foreign intelligence gathering, it nevertheless considered, inter alia, that the regime was not restricted to sufficiently specific purposes; it was not structured in a way that allowed for adequate oversight and control; and various safeguards were lacking, particularly with respect to the protection of journalists, lawyers and other persons whose communications required special confidentiality protection. 251. Regarding the sharing of intelligence obtained through foreign surveillance, the court again found the safeguards to be lacking. In particular, it was not specified with sufficient clarity when weighty interests might justify data transfers. In addition, while the court did not consider it necessary for a recipient State to have comparable rules on the processing of personal data, it nevertheless considered that data could only be transferred abroad if there was an adequate level of data protection and there was no reason to fear that the information would be used to violate fundamental principles of the rule of law. More generally, in the context of intelligence sharing, the court considered that cooperation with foreign States should not be used to undermine domestic safeguards and if the Federal Intelligence Service wished to use search terms provided to it by a foreign intelligence service it should first confirm the existence of the necessary link between the search terms and the purpose of the data request and that the resulting data did not disclose a particular need for confidentiality (for example, because they concerned whistle-blowers or dissidents). Although the court did not exclude the possibility of the bulk transfer of data to foreign intelligence services, it found that this could not be a continuous process based on a single purpose. 252. Finally, the court found that the surveillance powers under review also lacked an extensive independent and continual oversight serving to ensure that the law was observed and compensating for the virtual absence of safeguards commonly guaranteed under the rule of law. The legislator had to provide for two different types of oversight, which had also to be reflected in the organisational framework: firstly, a body resembling a court, tasked with conducting oversight and deciding in a formal procedure providing ex ante or ex post legal protection; and secondly, an oversight that was administrative in nature and could, on its own initiative, randomly scrutinise the entire process of strategic surveillance as to its lawfulness. In the Constitutional Court´s view, certain key procedural steps would, in principle, require ex ante authorisation by a body resembling a court, namely: the formal determination of the various surveillance measures (exemptions in cases of urgency were not ruled out); the use of search terms, in so far as these directly targeted individuals who might pose a danger and were thus of direct interest to the Federal Intelligence Service; the use of search terms that directly targeted individuals whose communications required special confidentiality protection; and sharing the data of journalists, lawyers and other professions meriting special confidentiality protection with foreign intelligence services. Judgment of the Court of Appeal of The Hague of 14 March 2017
253. A number of individuals and associations argued that the Dutch intelligence and security services were acting unlawfully by receiving data from foreign intelligence and security services, in particular the NSA and GCHQ, which in their view either had obtained or may have obtained the data in an “unauthorised” or “illegal” manner. The plaintiffs did not contend that the activities of the NSA and GCHQ  were “unlawful” or “illegal” under domestic law, but rather that the NSA had acted in violation of the International Covenant on Civil and Political Rights (“the ICCPR”) and GCHQ had acted in violation of the Convention. The plaintiffs relied, inter alia, on the “Snowden revelations” (see paragraph 12 above). 254. The plaintiffs’ claims were dismissed by the Court of The Hague on 23 July 2014 (ECLI:NL:RBDHA:2014:8966). Their appeal against this judgment was dismissed by the Court of Appeal of The Hague on 14 March 2017 (ECLI:NL:GHDHA:2017:535). 255. The Court of Appeal held that in principle one had to trust that the United States and the United Kingdom would comply with their obligations under these treaties. That trust only needed to give way if sufficiently concrete circumstances had come to light for it to be assumed that it was not justified. 256. With respect to the collection of telecommunications data by the NSA, there were no clear indications that the NSA had acted in violation of the ICCPR. In so far as the plaintiffs had sought to argue that the statutory powers underpinning the collection of data were broader than permissible under the ICCPR, they had insufficiently explained in what respect the relevant laws and regulations were inadequate. 257. With respect to the collection of data by GCHQ, the plaintiffs had not in any way substantiated their claim that GCHQ was acting in breach of the Convention. 258. The plaintiffs had therefore failed to demonstrate that the manner in which the NSA and GCHQ operated was, at least in principle, in conflict with the ICCPR and the Convention. While it could not be excluded that in a specific case the NSA or GCHQ, or any other foreign intelligence service, may have collected data in a way that violated the ICCPR or the Convention, the principle of trust prevented this mere possibility from implying that the Dutch intelligence services could not receive data from foreign intelligence services without verifying in each individual case that these data had been obtained without violating the relevant treaty obligations. 259. Finally, the Court of Appeal admitted that, even if the foreign intelligence services acted within the limits of their statutory powers and treaty obligations, the fact that these statutory powers might be broader than those of the Dutch intelligence services could under certain circumstances raise concerns. For example, it was conceivable that the Dutch intelligence services would be acting contrary to the Intelligence and Security Services Act 2002 (or the spirit of it) if they were systematically or knowingly to receive data from foreign intelligence agencies about Dutch residents, while they could not have gathered these data by virtue of their own powers. In that case, the restrictions imposed on the intelligence services by the 2002 Act could become a dead letter. However, the plaintiffs had not substantiated or offered proof that the Dutch intelligence services systematically or consciously exploited such a discrepancy between Dutch law and foreign law. 260. An appeal on points of law, primarily based on alleged errors in the interpretation of the plaintiffs’ claim by the Court of Appeal and on the extent of the burden of substantiation put on them, was dismissed by the “Hoge Raad” (Supreme Court) on 7 September 2018 (ECLI:NL:HR:2018:1434). The United States of America
261. The United States’ intelligence services operate the Upstream programme pursuant to section 702 of FISA. 262. The Attorney General and Director of National Intelligence make annual certifications authorising surveillance targeting non-U.S. persons reasonably believed to be located outside the United States of America. They do not have to specify to the FISC the particular non-U.S. persons to be targeted, and there is no requirement to demonstrate probable cause to believe that an individual targeted is an agent of a foreign power. Instead, the section 702 certifications identify categories of information to be collected, which have to meet the statutory definition of foreign intelligence information. Authorised certifications have included information concerning international terrorism, and the acquisition of weapons of mass destruction. 263. Pursuant to the authorisation, the NSA, with the compelled assistance of service providers, copies and searches streams of Internet traffic as data flows across the Internet. Both telephone calls and Internet communications are collected. Prior to April 2017 the NSA acquired Internet transactions that were “to”, “from”, or “about” a tasked selector. A “to” or “from” communication was a communication for which the sender or a recipient was a user of a section 702 tasked selector. An “about” communication was one in which the tasked selector was referenced within the acquired Internet transaction, but the target was not necessarily a participant in the communication. Collection of “about” communications therefore involved searching the content of communications traversing the Internet. However, from April 2017 onwards the NSA have not been acquiring or collecting communications that are merely “about” a target. In addition the NSA stated that, as part of this curtailment, it would delete the vast majority of previously acquired Upstream Internet communications as soon as practicable. 264. Section 702 requires the Government to develop targeting and minimization procedures which are kept under review by the FISC. 265. Executive Order 12333, which was signed in 1981, authorises the collection, retention and dissemination of information obtained in the course of a lawful foreign intelligence, counterintelligence, international narcotics or international terrorism investigation. Surveillance of foreign nationals under Executive Order 12333 is not subject to domestic regulation under FISA. It is not known how much data are collected under Executive Order 12333, relative to those collected under section 702. THE LAW
266. Cumulatively, the applicants in the three joined cases complained about the Article 8 and Article 10 compatibility of three discrete regimes: the regime for the bulk interception of communications under section 8(4) of the Regulation of Investigatory Powers Act 2000 (“RIPA”); the regime for the receipt of intelligence from foreign intelligence services; and the regime for the acquisition of communications data from communications service providers (“CSPs”). 267. Before considering each of these regimes in turn, the Grand Chamber will first address a preliminary issue. PRELIMINARY ISSUE BEFORE THE GRAND CHAMBER
268. According to the Court’s settled case-law, the “case” referred to the Grand Chamber necessarily embraces all aspects of the application previously examined by the Chamber in its judgment. The “case” referred to the Grand Chamber is the application as it has been declared admissible, as well as the complaints that have not been declared inadmissible (see S.M. v. Croatia [GC], no. 60561/14, § 216, 25 June 2020, and the authorities cited therein). 269. The applicants in the present case lodged their complaints in 2013, 2014 and 2015 respectively. Those complaints mostly concerned the State’s surveillance activities under RIPA and the related Codes of Practice. The Codes of Practice were subsequently amended. More significantly, the Investigatory Powers Act 2016 (“IPA”) received royal assent on 29 November 2016 and its provisions began to enter into force from December 2016 onwards. The new surveillance regimes set out in the IPA were mostly operational by the summer of 2018. The provisions of Chapter I of Part I of RIPA were repealed in the course of 2018. 270. The Chamber reviewed the Convention compliance of the law in force on the date it examined the admissibility of the applicants’ complaints; that is, it considered the law as is stood on 7 November 2017. As this is the “application as it has been declared admissible”, the Grand Chamber must similarly limit its examination to the legislative regime as is stood on 7 November 2017. This is apposite, since the legal regimes phased in following the entry into force of the IPA are currently subject to challenge before the domestic courts and it would not be open to the Grand Chamber to examine the new legislation before those courts have first had the opportunity to do so. 271. The applicants have not challenged the Chamber’s finding that the Investigatory Powers Tribunal (“IPT”) is now an effective remedy for both individual complaints and general complaints concerning the Convention compliance of a surveillance regime, and the Government have not challenged its finding that in the circumstances of the case the applicants had exhausted domestic remedies within the meaning of Article 35 § 1 of the Convention. Neither issue therefore falls to be considered by the Grand Chamber. THE BULK INTERCEPTION OF COMMUNICATIONSTerritorial jurisdiction

272. In respect of the section 8(4) regime, the Government raised no objection under Article 1 of the Convention, nor did they suggest that the interception of communications was taking place outside the State’s territorial jurisdiction. Moreover, during the hearing before the Grand Chamber the Government expressly confirmed that they had raised no objection on this ground as at least some of the applicants were clearly within the State’s territorial jurisdiction. Therefore, for the purposes of the present case, the Court will proceed on the assumption that, in so far as the applicants complain about the section 8(4) regime, the matters complained of fell within the jurisdictional competence of the United Kingdom. The alleged violation of Article 8 of the Convention
273. The applicants in all three of the joined cases complained that the regime for the bulk interception of communications was incompatible with Article 8 of the Convention, which reads:
“1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
The Chamber judgment
274. The Chamber expressly recognised that States enjoyed a wide margin of appreciation in deciding what type of interception regime was necessary to protect national security, but considered that the discretion afforded to States in operating an interception regime would necessarily be narrower. In this regard, it observed that the Court had identified six “minimum safeguards” which should be set out in law to avoid abuses of power: the nature of offences which may give rise to an interception order, a definition of the categories of people liable to have their communications intercepted, a limit on the duration of interception, the procedure to be followed for examining, using and storing the data obtained, the precautions to be taken when communicating the data to other parties, and the circumstances in which intercepted data may or must be erased or destroyed. These safeguards, which were first set out in Huvig v. France, 24 April 1990, § 34, Series A no. 176 B and Kruslin v. France, 24 April 1990, § 35, Series A no. 176‑A, had been applied routinely by the Court in its case-law on the interception of communications and in two cases specifically concerning the bulk interception of communications (see Weber and Saravia v. Germany (dec.), no. 54934/00, ECHR 2006‑XI and Liberty and Others v. the United Kingdom, no. 58243/00, 1 July 2008). 275. In the Chamber’s view, the decision to operate a bulk interception regime fell within the margin of appreciation afforded to Contracting States. It assessed the operation of the United Kingdom’s bulk interception regime by reference to the six minimum safeguards set out in the preceding paragraph. As the first two safeguards did not readily apply to bulk interception, the Chamber reframed these safeguards, considering first, whether the grounds upon which a warrant could be issued were sufficiently clear; secondly, whether domestic law gave citizens an adequate indication of the circumstances in which their communications might be intercepted; and thirdly, whether domestic law gave citizens an adequate indication of the circumstances in which their communications might be selected for examination. In addition, in light of recent case-law (including Roman Zakharov v. Russia [GC], no. 47143/06, ECHR 2015) the Chamber also had regard to the arrangements for supervising the implementation of secret surveillance measures, the existence of notification mechanisms and any remedies provided for by national law. 276. It identified the following two areas of concern in the section 8(4) regime: first, the lack of oversight of the selection of bearers for interception, the selectors used for filtering intercepted communications, and the process by which analysts selected intercepted communications for examination; and secondly, the absence of any real safeguards applicable to the searching and selection for examination of related communications data. In view of the independent oversight provided by the Interception of Communications Commissioner (“the IC Commissioner”) and the IPT, and the extensive independent investigations which followed the Edward Snowden revelations, the Chamber was satisfied that the United Kingdom was not abusing its bulk interception powers. Nevertheless, in view of the above-mentioned shortcomings, it held, by a majority, that the bulk interception regime did not meet the “quality of law” requirement and was incapable of keeping the “interference” to what was “necessary in a democratic society”. The parties’ submissions
(a)   The applicants
277. The applicants contended that bulk interception was in principle neither necessary nor proportionate within the meaning of Article 8 of the Convention and, as such, did not fall within a State’s margin of appreciation. Szabó and Vissy v. Hungary, no. 37138/14, 12 January 2016 suggested that a secret surveillance measure had to be “strictly necessary” for safeguarding democratic institutions and obtaining vital intelligence, and it had not been demonstrated that bulk interception satisfied this test. While it was undoubtedly a useful capability, it was clear from the Court’s case-law that not everything that was useful to the intelligence services was permissible in a democratic society (see S. and Marper v. the United Kingdom [GC], nos. 30562/04 and 30566/04, ECHR 2008). 278. According to the applicants, separate interferences with the Article 8 right to respect for private life and correspondence occurred with the interception of a communication (content and/or related communications data); its storage; its automated processing; and its examination. While they agreed that a “substantial” interference occurred when intercepted communications were examined, they believed it was wrong to suggest that no “meaningful” interference occurred before this point. On the contrary, the Court’s case-law indicated that even the storage of personal information by the State amounted to a serious interference with an individual’s rights under Article 8 of the Convention (see, for example, Rotaru v. Romania [GC], no. 28341/95, ECHR 2000 V and S. and Marper, cited above). This was especially so when the data were subject to automated processing. In fact, as processing power and machine learning advanced rapidly, the storage and electronic processing of data could by itself be highly intrusive, without any underlying content or related communications data being viewed by an individual. In this regard, the applicants contended that, contrary to the “amorphous soup” relied on by the Government (see paragraph 288 below), the collected data were more akin to a “well organised and indexed library in which you can rapidly find anything you want”. The availability of automatic processing raised particularly severe privacy concerns and did not, as the Government contended, minimise any intrusion. 279. Should the Grand Chamber consider that the operation of a bulk interception regime was within the State’s margin of appreciation, the applicants argued that the section 8(4) regime was not in accordance with the law. First of all, RIPA was unnecessarily complex, a fact acknowledged by all the independent reviewers; so much so, in fact, that the true nature and scope of the surveillance being undertaken had only become clear following the Edward Snowden revelations. Moreover the “below the waterline” arrangements had been established by GCHQ itself; were neither accessible to nor approved by Parliament; were, as a matter of internal policy, subject to change at the executive’s will; and were not binding. The applicants therefore argued that they should play no part in the Court’s analysis. 280. In assessing foreseeability, the applicants argued that changes in both society and technology had resulted in a need for the Court to update its existing approach – and enhance the necessary safeguards – to ensure that Convention rights remained practical and effective. The Court’s existing jurisprudence on bulk interception derived from the decision in Weber and Saravia (cited above), but that decision dated back to 2006, when the world was a different place. Smartphones were basic and had limited functionality; Facebook was used mainly by university students; and Twitter was in its infancy. Today people lived major parts of their lives online, using the Internet to communicate, impart ideas, conduct research, conduct relationships, seek medical advice, keep diaries, arrange travel, listen to music, find their way around and conduct financial transactions. Furthermore, modern technology generated an enormous amount of communications data, which were highly revealing even if the related content was not examined, and which were structured in such a way that computers could process them and search for patterns in them faster and more effectively than similar searches over content. For example, mobile phones constantly generated communications data as they contacted the mobile network, producing a record of the location of the phone, allowing the user’s movements to be tracked, and revealing his or her Internet usage. 281. In the applicants’ view, the updated and enhanced safeguards should include prior independent judicial authorisation of warrants, the choice of selectors and the selection of intercepted material for examination. In addition, where selectors or search terms referred to a specified individual, there should be objective evidence of reasonable suspicion in relation to that person. Finally, there should also be subsequent notification of any clearly defined surveillance target, where it would not cause substantial harm to the public interest. 282. The applicants identified a number of elements of the United Kingdom’s bulk interception regime which they considered to be inadequate. First of all, there was an absence of independent, let alone judicial, authorisation of surveillance. While judicial authorisation might not in itself be a sufficient safeguard against abuse, this did not support the conclusion that it was not a necessary one. In addition, the applicants believed that there should also be independent, if not judicial, approval of the selectors and search terms used by GCHQ. However, neither the bearers to be intercepted nor the strong selectors were listed in the warrant. 283. Secondly, the distinction between internal and external communications was not only poorly defined but also meaningless, with most communications likely to be swept up in the “external” category. In the applicants’ opinion, it would have been possible to have provided more meaningful protection to internal communications. For example, in Sweden all internal communications had to be destroyed immediately if they were discovered. 284. Thirdly, there were limited safeguards for the content of communications of persons known to be in the British Islands, and there were virtually no safeguards for their related communications data. GCHQ was able to retain the entirety of related communications data obtained under the bulk interception regime, subject only to limits on its storage capacity and the maximum retention period. These data – which were extremely intrusive – could be searched according to a factor referable to an individual known to be in the British Islands, without any requirement that the Secretary of State first certify that the search was necessary and proportionate. 285. Fourthly, the regime did not specify, in law and in detail, the purpose for which material could be examined and, according to the Intelligence and Security Committee of Parliament (“the ISC”), the description of material in the Secretary of State’s certificate was “generic”. 286. Finally, the applicants submitted that the IC Commissioner only provided part-time oversight and, with limited resources, had been insufficient to guarantee meaningful and robust oversight. The effectiveness of the IPT was similarly limited as it could not provide a remedy for the absence of prior judicial authorisation and, in any case, persons had to have some basis for believing that they had been subject to secret surveillance before the IPT would accept their complaint. (b)   The Government
287. The Government submitted that the information obtained under the bulk interception regime was critical to the protection of the United Kingdom from national security threats. Not only did it enable them to uncover hitherto unknown threats, but it also allowed them to conduct surveillance on known targets outside their territorial jurisdiction. The unpredictability of the route by which electronic communications were transmitted (and the fact that those communications were broken down into packets which could be transmitted via different routes) meant that in order to obtain even a small proportion of the communications of known targets overseas, it was necessary to intercept all the communications flowing over a selection of bearers. The bulk interception power had been the subject of detailed and repeated consideration by a series of independent bodies in recent years and there was a unanimity of view that there was not “any alternative” ... “or combination of alternatives sufficient to substitute for the bulk interception power”. According to the Government, States should rightly be afforded a broad margin of appreciation in judging what systems were necessary to protect the general community from such threats, and in subjecting those systems to scrutiny the Court should take care not to undermine the effectiveness of a means of obtaining life-saving intelligence which could not be gathered in any other way. 288. The Government contended that the interception of communications under the bulk interception regime would only have resulted in a meaningful interference with a person’s Article 8 rights if his or her communications were either selected for examination (that is, included on an index of communications from which an analyst could potentially choose items to inspect) or actually examined by an analyst. His or her rights could not be said to have been infringed to any more than the most minimal degree if a copy of a communication was either discarded in near-real time or held for a few days at most in a general “amorphous soup” of data; in other words, if it was searched using selectors and queries but it was not examined or used. The overwhelming bulk of communications flowing over each intercepted cable could not be “selected for examination”, and would therefore have to be discarded. 289. With regard to the necessary safeguards, the Government agreed with the Chamber that it was appropriate to assess a bulk interception regime by reference to the same standards that had been developed by the Court in cases concerning the targeted interception of communications. The Government also largely agreed with the Chamber’s assessment of the section 8(4) regime by reference to those standards. They reiterated that there was no possibility of any communications being viewed by an analyst unless and until they had been selected for examination following the automated sifting process; selection and any ensuing examination were very carefully controlled; no intelligence report could be made of any communications or communications data unless they had been viewed by an analyst; section 16(2) of RIPA required the Secretary of State to certify the necessity and proportionality of searching the content of communications according to a factor referable to an individual known to be in the British Islands; and the combined oversight functions of the ISC, the IC Commissioner and the IPT satisfied the requirements of the Convention. At all stages of the bulk interception process, the applicable safeguards were built around the Convention concepts of necessity and proportionality. Those fundamental principles governed the obtaining of the material in the first place, its examination, handling, storage, disclosure, retention and deletion. 290. In respect of those aspects of the regime which, according to the Chamber, had not provided adequate safeguards against abuse, the Government provided further clarification. First of all, although they acknowledged that the warrant did not specify the individual bearers to be targeted, as there would be serious impracticalities and difficulties with including this information in the warrant, it nevertheless contained a description of what the interception was going to involve and a description of the sorts of bearers that would be intercepted. The IC Commissioner was briefed regularly by GCHQ about the basis on which bearers were selected for interception. 291. Secondly, they clarified that the choice of selectors was in fact carefully controlled. Whenever a new selector was added to the system, the analyst adding it had to complete a written record, explaining why it was necessary and proportionate to apply the selector for the purposes within the Secretary of State’s certificate. This was done by the selection of text from a drop down menu, followed by the addition, by the analyst, of free text explaining why it was necessary and proportionate to make the search. In the case of a “strong selector”, the analyst had to explain, for example, the justification for seeking the communications of a particular target; how the selector related to the target’s method of communicating; and why selection of the relevant communications would not involve an unacceptable degree of collateral intrusion into privacy. In the case of a new “complex query”, the analyst had to develop selection criteria most likely to identify communications bearing intelligence of value; and similarly had to explain why the criteria were justified, and why their use would be necessary and proportionate for the purposes within the Secretary of State’s certificate. Selectors used for target development or target discovery could remain in use for a maximum of three months before a review was necessary. 292. Any selector had to be as specific as possible in order to select the minimum material necessary for the intelligence purpose, and be proportionate. If, through analysis, it was established that selectors were not being used by their intended target, prompt action had to be taken to remove them from relevant systems. The use of selectors had to be recorded in an approved location that enabled them to be audited; created a searchable record of selectors in use; and enabled oversight by the IC Commissioner. Robust independent oversight of selectors and search criteria was therefore within the IC Commissioner’s powers: by the time of his 2014 report he had specifically put in place systems and processes to make sure that actually occurred, and, following the Chamber judgment, the Government had been working with the IC Commissioner’s Office to ensure that there would be enhanced oversight of selectors and search criteria under IPA. However, the Government asserted that prior judicial authorisation would not have been possible for each selector without fundamentally altering their ability to discover and repel threats. GCHQ systems were necessarily tasked with many thousands of selectors which sometimes had to change rapidly in order to keep pace with fast moving investigations and threat discoveries. 293. Communications to which only the “strong selector” process was applied were discarded immediately unless they matched the strong selector. Communications to which the “complex query” process was also applied were retained for a few days, in order to allow the process to be carried out, and were then automatically deleted, unless they had been selected for examination. Communications which had been selected for examination could be retained only where it was necessary and proportionate to do so. The default position was that the retention period for selected communications was no longer than a few months, after which they were automatically deleted (although if the material had been cited in intelligence reporting, the report was retained). In exceptional circumstances a case could be made to retain selected communications for longer, as provided for in the Interception of Communications Code of Practice (“the IC Code”). 294. The Government reiterated that any analysts who examined selected material had to be specially authorised to do so, and received mandatory regular training, including training on the requirements of necessity and proportionality. They were also vetted. Before they examined the material, they had to create a record setting out why access to the material was required, why it was consistent with the Secretary of State’s certificate and the requirements of RIPA; and why it was proportionate (including considerations of any circumstances likely to give rise to a degree of collateral infringement of privacy). Unless such a record had been created, GCHQ’s systems did not permit access to material. 295. As to the safeguards in respect of related communications data, the Government argued that examining the content of the most sensitive and private communications always involved a greater degree of intrusion than examining related communications data, irrespective of whether those data were aggregated to provide a detailed picture of where an individual was located, what websites he or she visited, or with whom he or she chose to communicate. On that basis, it remained appropriate for the rules governing content to be more exacting than those governing related communications data. Nevertheless, the Government accepted that the Secretary of State should be required to certify the necessity of examining related communications data under a bulk warrant pursuant to a regime analogous (though not identical) to the certification regime in place for the content of communications under section 16 of RIPA. The new Code of Practice was to be amended to this effect. 296. Until then, however, communications data were subject to the same initial filtering process as content, by which GCHQ’s processing systems automatically discarded certain types of communications in near-real time. They were then subjected by automated means to simple or complex queries. However, there were two main differences between the treatment of content and the treatment of related communications data. First of all, the safeguards in section 16 – which provided that, in order to be examined, material had to fall within the Secretary of State’s certificate and could not be selected according to a factor referable to an individual known for the time being to be in the British Islands and the purpose of which was to identify his or her communications – only applied to content. According to the Government, it would not be practicable to apply this safeguard to related communications data. Significantly more queries were made against communications data (as many as several thousand in one week), and in a large number of cases the identity of the person to whom the data might relate was unknown. In addition, related communications data often had a temporal quality, and having to delay conducting searches of such data pending the acquisition of an individual authority would seriously risk undermining their utility in intelligence terms. Requiring the Secretary of State to certify necessity and proportionality in each individual case, in advance of the searches being undertaken, could not possibly be done. 297. Secondly, related communications data which were not selected for examination were not immediately discarded. The principal reason for this was that communications data were to a large extent used to discover threats or targets of which GCHQ might previously have been unaware. They therefore required more analytical work, over a lengthy period, to discover “unknown unknowns”. That discovery could very often involve an exercise of piecing together disparate small items of communications data to form a “jigsaw” revealing a threat; and would include the possible examination of items that initially appeared to be of no intelligence interest. Discarding unselected communications data immediately, or after a few days only, would render that exercise impossible. 298. Nevertheless, the Government confirmed that before any analyst could examine any communications data at all, they had to complete a record explaining why it was necessary and proportionate to do so, in pursuit of GCHQ’s statutory functions. An auditable record was therefore produced, setting out the justification for examination, and these records were available for inspection. Moreover, no intelligence reporting could be made on the basis of communications data unless and until they had been examined. Finally, related communications could be retained only where it was necessary and proportionate to do so, for a maximum period of several months, unless an exceptional case to retain for longer was made. Otherwise related communications data were automatically deleted once the maximum period had expired. 299. Finally, in light of the Chamber judgment the Government confirmed that it was taking steps to ensure that where non-content data were to be selected for examination by reference to a person believed to be in the British Islands, the selection had to be certified by the Secretary of State as necessary and proportionate on a specific thematic basis. Pending the introduction of a “thematic” certification regime, by means of changes to the code governing the interception of communications under IPA, GCHQ had been working with the IC Commissioner’s office to generate management information that could be used by the IC Commissioner to enhance ex post facto oversight of related communications data. In particular, GCHQ had made changes to its systems so that in any case where an analyst intended to select secondary data for examination relating to a person believed to be in the British Islands by reference to a factor relating to that person, that case would be flagged along with the supporting justification for selecting the relevant data. Third party submissions
(a)   The Government of France
300. The French Government submitted that in the face of threats such as international and cross-border crime, and in view of the increasing sophistication of communication technologies, the strategic bulk surveillance of communications was of vital importance to States in protecting democratic society. Moreover, it was wrong to assume that bulk interception constituted a greater intrusion into the private life of an individual than targeted interception, which by its nature was more likely to result in the acquisition and examination of a large volume of the subject’s communications. In their view, there was no reason why the criteria set out by the Court in Weber and Saravia (cited above) could not be considered equally relevant to the effective supervision of data interception and processing under a bulk interception regime. These criteria should, however, be applied in the context of an overall assessment, weighing any shortcomings against existing guarantees and the effectiveness of the safeguards against abuse. 301. There was no justification for adding the need for “reasonable suspicion” to these criteria. The authorities were generally not in a position to know in advance whose electronic communications it might be useful for them to monitor in the interests of law and order or national security, and such a requirement would deprive the surveillance measure of all operational interest. Moreover, in the Government’s view there was no need for a judicial authority to be involved in the authorisation of such intelligence operations, or to carry out ex post facto control, provided that the authorising authority was independent of the executive, the supervisory body was vested with sufficient powers and competence to exercise effective and continuous control, and the two bodies were independent of one another. 302. Finally, the intervening Government submitted that metadata were by their nature less intrusive than content, as they clearly contained less sensitive information about the behaviour and the private life of the person concerned. This view was supported by the report of the Venice Commission (see paragraphs 196‑201 above) and the CJEU in Digital Rights Ireland (see paragraphs 209-213 above). (b)   The Government of the Kingdom of the Netherlands
303. The Government of the Kingdom of the Netherlands also submitted that bulk interception was necessary to identify hitherto unknown threats to national security. In order to protect national security, intelligence services needed the tools to investigate emerging threats in a timely and effective manner. For this they needed the powers necessary to enable them to detect and/or prevent not only terrorist activities (such as attack planning, recruitment, propaganda and funding), but also intrusive State or non-State actors’ cyber activities aimed at disrupting democracy (for example, by influencing national elections or obstructing investigations by national and international organisations. An example of this was the attempted hacking of the investigation of the use of chemical weapons in Syria by the Organisation for the Prohibition of Chemical Weapons in The Hague). Moreover, the increasing dependency of vital sectors on digital infrastructures meant that such sectors, including water management, energy, telecoms, transport, logistics, harbours and airports, were increasingly vulnerable to cyber-attacks. The consequences of disruption in such sectors would have a deep impact on society, far beyond the substantial monetary damage. 304. A complicating factor in all of this was the development of new means of digital communication and the exponential increase of data that were transmitted and stored globally. In many instances the nature and origin of a particular threat was unknown and the use of targeted interception was not feasible. However, while bulk interception was not as tightly defined as targeted interception, it was never completely untargeted. Rather, it was applied for specific aims. 305. In the intervening Government’s view, there was no need for additional or updated minimum safeguards; those previously identified by the Court were sufficiently robust and “future proof”. The additional requirements proposed by the applicants before the Chamber – in particular, the requirement to demonstrate “reasonable suspicion” – would unacceptably reduce the effectiveness of the intelligence services without providing any meaningful additional protection of individuals’ fundamental rights. 306. Furthermore, according to the intervening Government, it was still relevant to distinguish between content and communications data, as the content of communications was likely to be more sensitive than communications data. The intervening Government also agreed with the Chamber that it was wrong automatically to assume that bulk interception constituted a greater intrusion into the private life of an individual than targeted interception, since with targeted interception it was likely that all, or nearly all, of the intercepted communications would be analysed. This was not true of bulk interception, where restrictions on the examination and use of data determined the intrusiveness of the interception on the individuals’ fundamental rights. 307. Finally, the intervening Government submitted that any requirement to explain or substantiate selectors or search criteria in the authorisation would seriously restrict the effectiveness of bulk interception in view of the high degree of uncertainty regarding the source of a threat. Ex post oversight provided sufficient safeguards. (c)   The Government of the Kingdom of Norway
308. The Norwegian Government submitted that with regard to the decision of States to introduce and operate some form of bulk interception regime for national security purposes, the margin of appreciation had to be wide. This was because intelligence services had to keep pace with the rapid advances in information and communications technology. Hostile actors changed their devices and digital identities at a pace which made it difficult to track them over time. It was also difficult to discover and counteract hostile cyber operations in a timely manner without tools capable of discovering anomalies and relevant signatures. It was therefore without doubt that modern capacities like bulk interception were needed in order to find unknown threats operating in the digital domain, and to enable the services to discover and follow relevant intelligence threats. 309. In the view of the Norwegian Government, the Court’s oversight should be based on an overall assessment of whether the procedural safeguards against abuse were adequate and sufficient. It should avoid absolute requirements. It should also not apply criteria that would undermine indirectly the wide margin of appreciation afforded to States in deciding to operate a bulk interception regime for national security reasons. A “reasonable suspicion” or “subsequent notification” requirement would have this effect. 310. Finally, the intervening Government encouraged the Court to refrain from importing concepts and criteria from the CJEU. First of all, at the relevant time nineteen Council of Europe Contracting States were not members of the European Union. Secondly, while the Convention and the Charter of Fundamental Rights had many features in common, there were also differences, most notably Article 8 of the Charter which contained a right to the protection of personal data. The CJEU also formulated “proportionality” differently, using a “strict necessity” method which did not compare to that used by the Court. (d)   The United Nations’ Special Rapporteur on the promotion of the right to freedom of opinion and expression
311. The Special Rapporteur argued that surveillance cast a shadow over communications, such that individuals might refrain from engaging in activities protected under international human rights law. That was not to say that all surveillance operations constituted a violation of human rights law; some might be tolerable when the conditions of legality, necessity and legitimacy were met. However, all types of surveillance required a rigorous evaluation of whether they were consistent with the norms of international human rights law. 312. In the Special Rapporteur’s view, the right to privacy had to be protected not only as a fundamental right independent of all others, but also in order to protect other rights, such as freedom of opinion and expression, which depended on a zone of privacy for their enjoyment. As the Special Rapporteur had indicated in his 2015 report, surveillance systems might undermine the right to form an opinion as the fear of unwilling disclosure of online activity could deter individuals from accessing information. 313. The UN High Commissioner’s report counselled against distinguishing metadata from content when examining the severity of the interference with rights protected under the International Covenant on Civil and Political Rights (“ICCPR”). Her 2014 report indicated that the aggregation of metadata by way of Government surveillance might reveal more private detail about an individual than perhaps even a private communication would. The Special Rapporteur further indicated that the distinction between internal and external communications might run counter to the ICCPR. The ICCPR placed States under a duty to respect and ensure all the rights therein to all within their jurisdiction, and in its latest General Comment the Human Rights Committee interpreted this standard as including State activities that directly impacted rights outside its own territory. 314. Finally, the Special Rapporteur emphasised the importance of safeguards to protect against abuse, in particular, the need for a court, tribunal or other adjudicatory body to supervise the application of an interference measure; subsequent notification of surveillance subjects; publication of information on the scope of surveillance techniques and powers; and the right to effective remedies in case of abuse. (e)   Access Now
315. Access Now submitted that the mass surveillance at issue in the present case failed to comply with the ICCPR and the International Principles on the Application of Human Rights to Communications Surveillance since the United Kingdom had not demonstrated that such surveillance was strictly necessary or proportionate. They further contended that surveillance programmes should not be considered independently but should instead be viewed in relation to the entirety of a nation’s surveillance activities as machine learning, through which mathematical algorithms could draw inferences from collections of data, had increased the invasiveness of big data sets and data mining. (f)     Article 19
316. Article 19 submitted that the indiscriminate and suspicionless collection, analysis and retention of individuals’ communications was inherently disproportionate. In Article 19’s opinion, only targeted surveillance based on reasonable suspicion and authorised by a judge would constitute a legitimate restriction on privacy rights. (g)   European Digital Rights (“EDRi”) and other organisations active in the field of human rights in the information society
317. EDRi and others argued that the present case offered the Court a crucial opportunity to revise its framework for the protection of metadata. Governments had built their surveillance programmes based on the distinction drawn between content and metadata in Malone v. the United Kingdom, 2 August 1984, Series A no. 82, but at the time that case was decided neither the Internet nor mobile phones existed. Today, metadata could paint a detailed and intimate picture of a person: they allowed for mapping of social networks, location tracking, Internet browsing tracking, mapping of communication patterns, and insight into who a person interacted with. Moreover, the level of detail that could be gleaned was magnified when analysed on a large scale. Indeed, Stewart Baker, general counsel of the NSA, had indicated that metadata could disclose everything about someone’s life, and that if you had enough metadata, you would not need content. As a result, different degrees of protection should not be afforded to personal data based on the arbitrary and irrelevant distinction between content and metadata, but rather on the inferences that could be drawn from the data. (h)   Open Society Justice Initiative (“OSJI”)
318. OSJI submitted that both the amount of data available for interception today and governments’ appetite for data far exceeded what was possible in the past. Consequently, bulk interception was a particularly serious interference with privacy which could, through its “chilling effect”, potentially interfere with other rights such as freedom of expression and freedom of association. To be lawful, bulk interception should therefore satisfy several preconditions: the governing law had to be sufficiently precise; the scope of the information gathered had to be limited by time and geography; and information should only be gathered based on “reasonable suspicion”. (i)     The Helsinki Foundation for Human Rights (“HFHR”)
319. The HFHR described their experience challenging the surveillance of communications by public authorities in Poland, which culminated in the Constitutional Tribunal finding certain aspects of the relevant legislation to be unconstitutional. The legislation was subsequently amended. (j)     The International Commission of Jurists (“ICJ”)
320. The ICJ submitted that in light of the scale and scope of the interference with privacy entailed in mass surveillance, the distinction between metadata and content had become out-dated. Furthermore, the fact that, in a mass surveillance operation, elements of the interference with rights might take place outside a State’s territorial jurisdiction did not preclude that State’s responsibility, since its control over the information was sufficient to establish jurisdiction. (k)   The Law Society of England and Wales
321. The Law Society expressed deep concern about the implications of the section 8(4) regime for the principle of legal professional privilege. In its view, the regime permitted the interception of legally privileged and confidential communications between lawyers and clients, even when both were in the United Kingdom. It also permitted the routine collection of metadata attaching to such communications. Furthermore, once intercepted these legally privileged communications could be used, provided that the primary purpose and object of the warrant was the collection of external communications. This arrangement – and the absence of adequate constraints on the use of such material – was apt to have a potentially severe chilling effect on the frankness and openness of lawyer-client communications.

Outcome for Article 10: violation