UK Metadata Collection Violates Human Rights (ECtHR)
On 13 September 2018, the European Court of Human Rights issued its ruling in the case of Big Brother Watch v UK (App. Nos.: 58170/13, 62322/14 & 24960/15) concerning 3 types of British surveillance programmes:
(1) The collection of metadata by the Government Communications Headquarters (GCHQ) under the programme codenamed ‘TEMPORA’ under Section 8 of the Regulation of Investigatory Powers Act 2000 (RIPA);
(2) The accessing of communication data retained by Communications Service Providers (CSPs) by various public authorities under Chapter II of RIPA and Part 4 of the Investigatory Powers Act 2016 (IPA);
(3) The accessing of metadata collected by the American National Security Agency (NSA) under the programmes codenamed ‘PRISM’ and ‘UPSTREAM’ by GCHQ.
The existence of all those programmes was revealed by Edward Snoweden in 2013 and immediately prompted litigation both in the United States as well as in the United States (see e.g. American Civil Liberties Union v. James Clapper, No. 13-3994 (S.D. New York December 28, 2013) & Klayman v. Obama (13-cv-881)).
In its 212-page-long opinion, the European Court of Human Rights held that the collection of metadata by the GCHQ under the programme codenamed ‘TEMPORA’ under Section 8 of RIPA violated Articles 8 and 10 of the European Convention on Human Rights:
“387 . In light of the foregoing considerations, the Court considers that the decision to operate a bulk interception regime was one which fell within the wide margin of appreciation afforded to the Contracting State. Furthermore, in view of the independent oversight provided by the Interception of Communications Commissioner and the IPT, and the extensive independent investigations which followed the Edward Snowden revelations, it is satisfied that the intelligence services of the United Kingdom take their Convention obligations seriously and are not abusing their powers under section 8(4) of RIPA. Nevertheless, an examination of those powers has identified two principal areas of concern; first, the lack of oversight of the entire selection process, including the selection of bearers for interception, the selectors and search criteria for filtering intercepted communications, and the selection of material for examination by an analyst; and secondly, the absence of any real safeguards applicable to the selection of related communications data for examination.
388. In view of these shortcomings and to the extent just outlined, the Court finds that the section 8(4) regime does not meet the “quality of law” requirement and is incapable of keeping the “interference” to what is “necessary in a democratic society”. There has accordingly been a violation of Article 8 of the Convention.
495. Nevertheless, in view of the potential chilling effect that any perceived interference with the confidentiality of their communications and, in particular, their sources might have on the freedom of the press and, in the absence of any “above the waterline” arrangements limiting the intelligence services’ ability to search and examine such material other than where “it is justified by an overriding requirement in the public interest”, the Court finds that there has also been a violation of Article 10 of the Convention.”
Furthermore, the European Court of Human Rights ruled that the accessing of communication data retained by Communications Service Providers (CSPs) by various public authorities under Chapter II of RIPA and Part IV of IPA also violated Articles 8 and 10 of the Convention as it constituted an interference which was not ‘in accordance with law’. This part of the judgment reflects an earlier finding of the High Court in the case of Liberty v Secretary of State for the Home Department  EWHC 975 (Admin) and the Court of Justice of the European Union:
“463 . The Court of Justice of the European Union has also addressed this issue. In Digital Rights Ireland v. Minister for Communications, Marine and Natural Resources and Others and Settinger and Others (Cases C-293/12 and C-594/12), the CJEU considered the validity of the Data Retention Directive, and in Secretary of State for the Home Department v. Watson and Others (C-698/15), the validity of domestic legislation containing the same provisions as that directive (see paragraphs 224 – 234 above). While its focus was on the retention of data by CSPs, it also considered the question of access to retained data by the national authorities. In doing so, it indicated that access should be limited to what was strictly necessary for the objective pursued and, where that objective was fighting crime, it should be restricted to fighting serious crime. It further suggested that access should be subject to prior review by a court or independent administrative authority, and that there should be a requirement that the data concerned be retained within the European Union. In light of the CJEU’s findings, Liberty sought to challenge Part 4 of the IPA, which included a power to issue “retention notices” to telecommunications operators requiring the retention of data. In response, the Government conceded that Part 4 was incompatible with fundamental rights in EU law since access to retained data was not limited to the purpose of combating “serious crime”; and access to retained data was not subject to prior review by a court or an independent administrative body. The High Court held that the legislation had to be amended by 1 November 2018 (see paragraph 196 above).”
At the same time, the European Court of Human Rights held that the accessing of metadata originally collected by the American NSA under the programmes codenamed PRISM and UPSTREAM by the GCHQ did not violate any Convention rights:
“447. In light of the foregoing considerations, the Court considers that the domestic law, together with the clarifications brought by the amendment of the IC Code, indicate with sufficient clarity the procedure for requesting either interception or the conveyance of intercept material from foreign intelligence agencies. In this regard, it observes that the high threshold recommended by the Venice Commission -� namely, that the material transferred should only be able to be searched if all the material requirements of a national search were fulfilled and this was duly authorised in the same way as a search of bulk material obtained by the signals intelligence agency using its own techniques -� is met by the respondent State’s regime. The Court further observes that there is no evidence of any significant shortcomings in the application and operation of the regime. On the contrary, following an investigation the ISC found no evidence whatsoever of abuse.”
In any event, it must be noted that the ruling was concerned with the surveillance scheme under the Regulation of Investigatory Powers Act 2000 which has since been replaced to a large degree by a different scheme under the Investigatory Powers Act 2016. According to the Government, the new scheme “includes the introduction of a ‘double lock’ which requires warrants for the use of these powers to be authorised by a secretary of state and approved by a judge. An investigatory powers commissioner has also been created to ensure robust independent oversight of how these powers are used. The government will give careful consideration to the court’s findings.” (GOV.UK). However, as mentioned earlier, the 2016 Act itself had already been declared unlawful in part (Liberty v Secretary of State for the Home Department  EWHC 975 (Admin)) thereby leaving the question of its overall legality open.