On 25 May 2021 the Grand Chamber of the European Court of Human Rights (ECtHR) delivered its long awaited judgment on bulk interception of personal data and mass surveillance by security and intelligence services in the case of Big Brother Watch and others v. the United Kingdom  ECHR 439.
The Grand Chamber judgment elaborates a general framework of principles regarding bulk interception and confirms that the UK regime of interception of communications not only violated the privacy rights under Article 8 of the European Convention on Human Rights (ECHR) but also the journalists’ right to protect their sources, as guaranteed under Article 10 ECHR.
In the meantime the UK has updated its surveillance rules under new legislation, the Investigatory Powers Act 2016 (IPA 2016), which came into force in 2018. The ECtHR did not examine the new legislation in its judgment. The new legal regimes are currently subject to challenge before the domestic courts in the UK and it would not be open to the Grand Chamber to examine the new legislation before those courts have first had the opportunity to do so.
The judgment in the case of Big Brother Watch and Others v. The United Kingdom deals with a complex set of statutory laws, codes of conduct, procedures and monitoring instruments on the bulk interception of communications, intelligence sharing and requesting data from communications service providers (CSPs). The applications with the Strasbourg Court were lodged by organisations and individuals active in campaigning in civil liberties issues, by a newsgathering organisation and by a journalist, complaining about the scope and magnitude of the electronic surveillance programmes operated by the Government of the UK. The applications were lodged after Edward Snowden revealed the existence of surveillance and intelligence sharing programmes operated by the intelligence services of the United States and the UK. The applicants believed that the nature of their activities meant that their electronic communications and/or communications data were likely to have been intercepted or obtained by the UK intelligence services.
The ECtHR is in no doubt that bulk interception is of vital importance for the states in identifying threats to their national security and that, in present-day conditions, no alternative or combination of alternatives would be sufficient to substitute for the bulk interception power.
However, in view of the risk that a system of secret surveillance set up to protect national security and other essential national interests may undermine or even destroy the proper functioning of democratic processes under the cloak of defending them, there must be adequate and effective guarantees against abuse. This assessment depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law.
The Grand Chamber views bulk interception as a gradual process in which the degree of interference with individuals’ Article 8 rights increases as the process progresses. In order to minimise the risk of the bulk interception being abused, the ECtHR considers that the process must be subject to “end-to-end safeguards”. This means that, at the domestic level, an assessment should be made at each stage of the process of the necessity and proportionality of the measures being taken; that bulk interception should be subject to independent authorisation at the outset, when the object and scope of the bulk operation are being defined; and that the operation should be subject to supervision and independent ex post facto review. In the Court’s view, these are fundamental safeguards which are the cornerstone of any Article 8 compliant bulk interception regime. Therefore the ECtHR examines whether the domestic legal framework clearly defines
- The grounds on which bulk interception may be authorised;
- The circumstances in which an individual’s communications may be intercepted;
- The procedure to be followed for granting authorisation;
- The procedures to be followed for selecting, examining and using intercept material;
- The precautions to be taken when communicating the material to other parties;
- The limits on the duration of interception, the storage of intercept material and the circumstances in which such material must be erased and destroyed;
- The procedures and modalities for supervision by an independent authority of compliance with the above safeguards and its powers to address non-compliance;
- The procedures for independent ex post facto review of such compliance and the powers vested in the competent body in addressing instances of non-compliance.
After evaluating each of the eight requirements, the Grand Chamber reaches the conclusion that the legal framework on bulk interception in the UK viewed as a whole, did not contain sufficient “end-to-end” safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse. Accordingly it found a violation of Article 8 ECHR.
In particular it identifies several fundamental deficiencies in the regime, such as the absence of independent authorisation, the failure to include the categories of selectors in the application for a warrant, and the failure to subject selectors linked to an individual to prior internal authorisation. These weaknesses concern not only the interception of the contents of communications but also the interception of related communications data. Therefore the Grand Chamber found that the legal basis of the bulk interception regime did not meet the “quality of law” requirement and was therefore incapable of keeping the “interference” to what was “necessary in a democratic society”.
With regard to the complaint of a journalist and a newsgathering organisation that the bulk interception regime in the UK also violated the right of journalists to protect their sources as guaranteed under Article 10 ECHR, the Grand Chamber confirms the finding of the Chamber judgment of 2018. The ECtHR reiterates that the protection of journalistic sources is one of the cornerstones of freedom of the press, and that an interference cannot be compatible with Article 10 ECHR unless it is justified by an overriding requirement in the public interest.
A crucial safeguard is the guarantee of ex ante review by a judge or other independent and impartial decision-making body with the power to determine whether a requirement in the public interest overriding the principle of protection of journalistic sources exists prior to the handing over of such material. The decision to be taken should be governed by clear criteria, including whether a less intrusive measure can suffice to serve the overriding public interests established.
Applying these principles in the bulk interception context the Court found that under the UK regime confidential journalistic material could have been accessed by the intelligence services either intentionally, through the deliberate use of selectors or search terms connected to a journalist or news organisation, or unintentionally, as a “bycatch” of the bulk interception operation. Where the intention of the intelligence services is to access confidential journalistic material, for example, through the deliberate use of a strong selector connected to a journalist, or where, as a result of the choice of such strong selectors, there is a high probability that such material will be selected for examination, the ECtHR considers that the interference will be commensurate with that occasioned by the search of a journalist’s home or workplace.
Therefore the Grand Chamber requires that before the intelligence services use selectors or search terms known to be connected to a journalist, or which would make the selection of confidential journalistic material for examination highly probable, the selectors or search terms must have been authorised by a judge or other independent and impartial decision-making body invested with the power to determine whether they were “justified by an overriding requirement in the public interest” and, in particular, whether a less intrusive measure might have sufficed to serve the overriding public interest. The UK bulk interception regime did not guarantee such an ex ante review by a judge or other independent and impartial decision-making body. On the contrary, where the intention was to access confidential journalistic material, or that was highly probable in view of the use of selectors connected to a journalist, all that was required was that the reasons for doing so, and the necessity and proportionality of doing so, be documented clearly.
The Grand Chamber also found that there were insufficient safeguards in place to ensure that once it became apparent that a communication which had not been selected for examination through the deliberate use of a selector or search term known to be connected to a journalist nevertheless contained confidential journalistic material, it could only continue to be stored and examined by an analyst if authorised by a judge or other independent and impartial decision‑making body invested with the power to determine whether its continued storage and examination was “justified by an overriding requirement in the public interest”. Instead, all that was required was that “particular consideration” should be given to any interception which might have involved the interception of confidential journalistic material, including consideration of any possible mitigation steps. In view of these weaknesses, and those identified by the ECtHR in its considerations of the complaint under Article 8 of the Convention, it found that there has been a breach of Article 10 ECHR, specifically with regard to the protection of journalistic sources.
Finally the Grand Chamber also found a violation of Article 8 and 10 with regard the regime permitting the acquisition of retained data from communication service providers, as the practices in this domain were in breach with EU Law. As the access to retained data from CSPs was not limited to the purpose of combating “serious crime” and as there was also a lack to prior review by a court or an independent administrative body, this part of the operation of the UK regime is found as not being in accordance with the law within the meaning of Article 8 and 10 ECHR.
However, the legal framework and practices related to the receipt of intelligence from foreign intelligence services, including the receipt of material intercepted by the NSA under PRISM and Upstream, was found in accordance with Article 8 and 10 ECHR. The Grand Chamber found that the United Kingdom had in place adequate safeguards for the examination, use and storage of the content and communications data received from intelligence partners, as well as for the onward transmission of this material and for its erasure and destruction.
The Grand Chamber judgment contains in annex some very interesting (partly) concurring opinions and partly dissenting opinions, arguing that the Grand Chamber judgment should go considerably further in upholding the importance of the protection of private life and correspondence, in particular by introducing stricter minimum safeguards, but also by applying those safeguards more rigorously to the impugned bulk interception regime, including in the initial stage of mass surveillance practices and the receipt of intelligence from foreign intelligence services. One of the opinions expresses the hope that in future cases the ECtHR “will interpret and further develop the principles in a way which will properly uphold democratic society and the values it stands for”.
On the same day the Grand Chamber also delivered its judgment in the case of Centrum för Rättvisa v. Sweden  ECHR 440. The Grand Chamber was satisfied that the main features of the Swedish bulk interception regime, on the basis of Swedish Signals Intelligence Act, meet the ECHR requirements on quality of the law and considers that the operation of this regime kept within the limits of what is “necessary in a democratic society”. In contrast however with the judgment of 19 June 2018 of the third section chamber of the ECtHR, the Grand Chamber found that the bulk interception of electronic signals in Sweden for foreign intelligence purposes ultimately violates the right to privacy and correspondence under Article 8 ECHR, because the Swedish bulk interception regime contains some shortcomings. Especially the lack of guarantees when making a decision to transmit intelligence material to foreign partners and the absence of an effective ex post facto review violate the right to privacy.