Privacy International v Secretary of State for Foreign & Commonwealth Affairs & ors

The SIAs’ regime for BCD relates to the collection of the “who, when, where and how” of both telephone and internet use and the subsequent use of this data. In an earlier judgment, the Tribunal declared that, prior to 4 November 2015, the regime for the collection of BCD under s.94 of the Telecommunications Act 1984 was not compliant with the law for the purposes of Article 8 ECHR.

The first issue before the Tribunal was whether, in respect of GCHQ, that illegality extended beyond 4 November 2015 by virtue of unlawful delegation by the Foreign Secretary of the power under s.94.

The Tribunal recognised that GCHQ had instituted certain safeguards from 2010, and that “in general it appears from at least 2014 onwards great care was taken to ensure that the Foreign Secretary was made aware of and approved the scope of the requirements being imposed on CSPs [Communication Service Providers]”. But the Tribunal held that

“the existence of those controls is not an answer to the point of principle that the form of general directions employed, if otherwise valid under the provisions of s.94, did purport to give unfettered discretion to the agency as to the type of communications which should be treated as covered by the direction. The lack of legal control on the discretion of the agency is compounded in those cases where the specific requirement was not communicated in writing to the CSP. The CSP would not be in any position to question the scope of the requirement communicated, because the CSP would have no knowledge of the limited basis upon which the direction had been made, and on the face of the general direction (if provided) the CSP was required to produce any data which GCHQ requested. In those targeted requirement/general direction cases …, the form of the general direction made by the Foreign Secretary did not comply with the requirement under Article 8 that measures taken by the state should be in accordance with the law.

For those reasons we conclude that most of the relevant directions made between 29 November 2001 and 7 November 2012 were not lawfully made under s.94.”

However, the Tribunal held that it would not grant relief in respect of BCD obtained by GCHQ under those Directions which were unlawfully made.

The second issue before the Tribunal concerned the sharing, by the SIAs, of BCD and BPD with foreign agencies (assessed on the assumption that such sharing has taken place). The Tribunal held, by a majority, that the safeguards in place rendered such sharing complaint with Article 8 ECHR. Two members of the Tribunal dissented, for reasons provided in a CLOSED annex to the judgment.

The Tribunal additionally held that, on the evidence of safeguards before it, the SIAs’ regime of sharing BPD and BCD with law enforcement agencies and industry partners complied with Article 8 ECHR. Moreover, in the Tribunal’s first judgment, it held over the question of proportionality – in this judgment, it concluded that SIAs’ regimes for collection of BPD and BCD were proportionate under ECHR and EU law.

A preliminary reference to the Court of Justice of the European Union remains outstanding.

Tom de la Mare QC, Ben Jaffey QC and Daniel Cashman acted for the Claimant.

Sir James Eadie QC acted for the Respondents.