Judgment on the Compatibility of Bulk Communications Data Acquisition with EU Law, Study notes of Law

Download Judgment on the Compatibility of Bulk Communications Data Acquisition with EU Law and more Study notes Law in PDF only on Docsity! Neutral Citation Number: [2021] UKIPTrib IPT_15_110_CH Case No: IPT/15/110/CH IN THE INVESTIGATORY POWERS TRIBUNAL Date: 22 July 2021 Before: LORD JUSTICE SINGH, PRESIDENT LORD JUSTICE EDIS And MRS JUSTICE LIEVEN - - - - - - - - - - - - - - - - - - - - - Between: PRIVACY INTERNATIONAL Claimant - v - (1) SECRETARY OF STATE FOR FOREIGN AND COMMONWEALTH AFFAIRS (2) SECRETARY OF STATE FOR THE HOME DEPARTMENT (3) GOVERNMENT COMMUNICATIONS HEADQUARTERS (4) SECURITY SERVICE (5) SECRET INTELLIGENCE SERVICE Respondents - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Tom de la Mare QC, Ben Jaffey QC and Daniel Cashman (instructed by Bhatt Murphy) for the Claimant Robert Palmer QC, Richard O’Brien and John Bethell (instructed by Treasury Solicitor) for the Respondents Mr J Glasson QC and Ms Sarah Hannett QC (instructed by Treasury Solicitor) appeared as Counsel to the Tribunal Hearing date: 21 July 2021 - - - - - - - - - - - - - - - - - - - - - JUDGMENT Investigatory Powers Tribunal Judgment: Privacy International v SSFCA & Ors Page 2 Lord Justice Singh: Introduction 1. This is the judgment of the Tribunal. 2. This matter arises out of a larger set of proceedings which were commenced by the Claimant in 2015. The particular issue is the compatibility of the legislative scheme under section 94 of the Telecommunications Act 1984 (“the 1984 Act”) for directions to be given by the Secretary of State for the acquisition of bulk communications data (“BCD”) with European Union (“EU”) law. 3. The background was set out in this Tribunal’s first judgment in these proceedings: [2016] UKIPTrib 15_110-CH; [2016] HRLR 21, which was given by Burton J (President). As he said at para. 3, the proceedings were initially brought on 5 June 2015 and were amended in September 2015 to add claims in relation to use of section 94 of the 1984 Act. Subsequently, the Tribunal gave two further judgments. For present purposes it is only necessary to refer to the second judgment: [2017] UKIPTrib IPT_15_110CH, which was given on 8 September 2017. The Tribunal decided to make a reference for the preliminary ruling of the Court of Justice of the European Union (“CJEU”) on two questions, under Article 267 of the Treaty on the Functioning of the European Union. 4. It is common ground before us that, although the United Kingdom has left the EU, for present purposes the judgment of the CJEU, which was given during the transition period, is binding on this Tribunal. This is the effect of section 7A of the European Union (Withdrawal) Act 2018, as amended by the European Union (Withdrawal Agreement) Act 2020. In treating the judgment of the CJEU Investigatory Powers Tribunal Judgment: Privacy International v SSFCA & Ors Page 5 ii. In particular, a fundamental feature of the SIAs’ use of BCD is to discover previously unknown threats to national security by means of non-targeted bulk techniques which are reliant upon the aggregation of the BCD in one place. Its principal utility lies in swift identification and development, as well as providing a basis for action in the face of imminent threat; iii. The provider of an electronic communications network does not retain the BCD (beyond the period of their ordinary business requirements). The BCD is retained by the State (the SIAs) alone; iv. The use of BCD and automated processing produces less intrusion than other means of obtaining information, and the degree of intrusion as a result of electronic searching of BCD should not be overstated; v. The safeguards surrounding the use of BCD by the SIAs are now, subject to the reserved issues, consistent with the requirements of the ECHR, and are sufficient to prevent abuse; vi. The imposition of the Watson Requirements if applicable, would critically undermine the ability of the SIAs to safeguard national security, and thereby put the national security of the United Kingdom at risk.” 9. The two questions which were referred to the CJEU were framed as follows: “In circumstances where: a. the SIAs’ capabilities to use BCD supplied to them are essential to the protection of the national security of the United Kingdom, including in the fields of counter- terrorism, counter-espionage and counter-nuclear proliferation; b. a fundamental feature of the SIA’s use of the BCD is to discover previously unknown threats to national security by means of non-targeted bulk techniques which are reliant upon the aggregation of the BCD in one place. Its principal utility lies in swift target identification and development, as well as providing a basis for action in the face of imminent threat; Investigatory Powers Tribunal Judgment: Privacy International v SSFCA & Ors Page 6 c. the provider of an electronic communications network is not thereafter required to retain the BCD (beyond the period of their ordinary business requirements), which is retained by the State (the SIAs) alone; d. the national court has found (subject to certain reserved issues) that the safeguards surround the use of BCD by the SIAs are consistent with the requirements of the ECHR; and e. the national court has found that the imposition of the requirements specified in §§119-125 of the judgment of the Grand Chamber in joined cases C-203/15 and C- 698/15 Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v Watson and Others (ECLI:EU:C:2016:970) (‘the Watson Requirements’), if applicable, would frustrate the measures taken to safeguard national security by the SIAs, and thereby put the national security of the United Kingdom at risk; 1. Having regard to Article 4 TEU and Article 1(3) of Directive 2002/58/EC on privacy and electronic communications (the ‘e-Privacy Directive’), does a requirement in a direction by a Secretary of State to a provider of an electronic communications network that it must provide bulk communications data to the Security and Intelligence Agencies (‘SIAs’) of a Member State fall within the scope of Union law and of the e-Privacy Directive? 2. If the answer to Question (1) is ‘yes’, do any of the Watson Requirements, or any other requirements in addition to those imposed by the ECHR, apply to such a direction by a Secretary of State? And, if so, how and to what extent do those requirements apply, taking into account the essential necessity of the SIAs to use bulk acquisition and automated processing techniques to protect national security and the extent to which such capabilities, if otherwise compliant with the ECHR, may be critically impeded by the imposition of such requirements?” Judgment of the CJEU 10. On 6 October 2020 the Grand Chamber of the CJEU gave its judgment in the request for a preliminary ruling: C/623/17. Investigatory Powers Tribunal Judgment: Privacy International v SSFCA & Ors Page 7 11. It addressed question 1 at paras. 30-49 and answered that question as follows, at para. 49: “Having regard to the foregoing considerations, the answer to the first question is that Article 1(3), Article 3 and Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU, must be interpreted as meaning that national legislation enabling a State authority to require providers of electronic communications services to forward traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security falls within the scope of that directive.” 12. The CJEU addressed question 2 at paras. 50-82 and answered that question as follows at para. 82: “In the light of all the foregoing considerations, the answer to the second question is that Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation enabling a State authority to require providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security.” The Claimant’s submissions 13. On behalf of the Claimant it is submitted that the CJEU has left no room for doubt that the BCD regime falls within the scope of EU law. The BCD regime imposed a processing obligation on telecommunications providers to provide communications data in circumstances which therefore required justification under Article 15(1) of the e-Privacy Directive. Investigatory Powers Tribunal Judgment: Privacy International v SSFCA & Ors Page 10 achieved thereby. It is accepted that these were inadequate for the purposes of EU law. 20. Secondly, the legislative scheme did not provide for any limit to the duration of any directions. Although there were internal handling arrangements requiring a review at intervals of no less than six months, the direction did not automatically expire by virtue of a legislative limit. 21. Thirdly, the legislative scheme did not require that any direction should be subject to review by a court or an independent administrative authority whose decision was binding. 22. However, the Respondents submit that there are three important caveats. First, the CJEU did not consider whether any data acquired had in fact exceeded the bounds of what might properly have been authorised under a statutory scheme that did comply with the requirements of EU law. The national court (in other words this Tribunal) alone is responsible for determination of factual matters. 23. Secondly, still less did the CJEU express any general view about the lawfulness of bulk acquisition as a national security technique in the abstract. “Bulk” powers should not be conflated with “general and indiscriminate” powers. 24. Thirdly, in the related case of La Quadrature, the CJEU rejected the suggestion that there was an absolute requirement to disregard traffic and location data obtained in breach of EU law, even in the context of a criminal prosecution: see paras. 221-227. 25. Further, the Respondents note that the issue of remedies has already been stayed pursuant to the Tribunal’s earlier orders until other matters have been resolved Investigatory Powers Tribunal Judgment: Privacy International v SSFCA & Ors Page 11 in these proceedings. That said, the Respondents are content for the Tribunal to state in its judgment, or grant a declaration, that section 94 of the 1984 Act was incompatible with EU law in the respects set out at para. 16 of their Skeleton Argument for this hearing, which we have sought to summarise above. 26. On behalf of the Claimant, it was accepted at the hearing before us by Mr de la Mare QC that the incompatibility in the legislation did indeed arise in substance from the features set out at para. 16 of the Respondents’ Skeleton Argument. 27. At the hearing a point was also raised by Mr de la Mare about the consequences for sharing arrangements with foreign agencies and others. This was a topic which was dealt with by the Tribunal in its third judgement: [2018] UKIPTrib IPT_15_110_CH, at paras. 61ff. In his reply, however, Mr de la Mare accepted that this is one of those topics which will have to be considered at a later stage in these proceedings. Conclusion 28. In the circumstances, we endorse what is in substance the agreed position of the parties. In the light of the judgment of the CJEU, which is binding on this Tribunal, it is now clear that section 94 of the 1984 Act was incompatible with EU law. We will grant a declaration to that effect. Anyone wishing to know the reasons for that incompatibility will find them in this judgment, which has summarised earlier what is said at para. 16 of the Respondents’ Skeleton Argument. Investigatory Powers Tribunal Judgment: Privacy International v SSFCA & Ors Page 12 29. We would stress that we have not today decided what the consequences of that declaration are. That remains a matter of dispute between the parties and will be considered at a later stage, when the more general issue of remedies in this case is considered by the Tribunal. 30. Pursuant to section 67A of RIPA there is a right to apply for leave to appeal this decision. The Tribunal hereby specifies, in accordance with s.67A(2) of RIPA that, in the event of an appeal, the relevant appellate court in this case is the Court of Appeal of England and Wales. 31. An appeal is possible only in respect of a point of law that raises an important point of principle or practice (or for other compelling reasons) and is not a decision on a procedural matter. An appeal requires permission so an application must first be made to the Tribunal for leave to appeal. 32. The Rules contain detailed provisions in relation to making an application for leave to appeal which are contained in Rule 16 of the Rules. The Rules are available from the Tribunal’s website https://www.ipt-uk.com/