The ECHR ruling of May 25, 2021 in the case "Big Brother Watch and Others v. the United Kingdom" (aplication No. 58170/13 and two other complaints).
In 2013, the applicant companies were assisted in the preparation of aplications. Subsequently, the aplications were consolidated and communicated to the United Kingdom.
Aplications about compliance with the Convention of the covert surveillance regime, including mass interception of negotiations and the exchange of intelligence, were successfully considered in the case. The case involved a violation of the requirements of article 8 of the Convention in relation to mass interception of negotiations. There was no violation of the requirements of article 8 of the Convention in relation to the exchange of intelligence in the case.
CIRCUMSTANCES OF THE CASE
In the case "Big Brother Watch and Others v. United Kingdom" (Big Brother Watch and Others v. United Kingdom), the applicants, legal entities and individuals, appealed the limits and scope of the use of electronic tracking programs used by the authorities of the United Kingdom. In the Resolution of September 13 , 2018 The Chamber of the European Court concluded that the regime of mass interception of negotiations provided for in part 4 of Article 8 of the Law on Regulation of Investigative Activities (RIPA) and the procedure for obtaining data from communication service providers provided for in Chapter II of the said Law violated Articles 8 and 10 of the Convention. The Chamber of the European Court decided that there was no violation of Article 8 of the Convention in relation to the regime of intelligence exchange.
In the case "Center of Justice v. Sweden" (Centrum fcr rdttvisa v. Sweden) the applicant organization, a non-governmental organization, believed that there was a risk that the communications of its employees on mobile phones or a wireless modem were intercepted or would be intercepted and studied using electronic intelligence. In Sweden, the National Center for Electronic Intelligence (FRA) has the right to conduct electronic intelligence using mass interception of negotiations. In the Resolution of June 19 , 2018 The Chamber of the European Court unanimously concluded that there was no violation of Article 8 of the Convention in the case.
Both cases were referred to the Grand Chamber of the European Court of Justice at the request of the applicants.
LEGAL ISSUES
- Mass interception of negotiations (both cases). Regarding compliance with article 8 of the Convention.
(a) Intervention. Article 8 of the Convention applies at every stage of the process of mass interception of negotiations, and the degree of interference with privacy rights increases as the process goes through each subsequent stage, namely: (i) interception and initial retention of negotiation data and related communication data; (ii) application of special selection criteria to the data negotiations and related communication data; (iii) analysts' study of negotiation data and related communication data; (iv) continued retention of data and use of the "final product", including data exchange with third parties.
(b) Whether there was a need to develop case law. In the Decision in the case "Weber and Saravia v. Germany" (Weber and Saravia v. Germany) (See: The Decision of the European Court in the case "Weber and Saravia v. Germany" (Weber and Saravia v. Germany) of June 29, 2006, complaint No. 5493/00.) and in the Judgment in the case "Liberty and Others v. United Kingdom" (Liberty and Others v. United Kingdom) (See: Judgment of the European Court of Justice in the case "Liberty and Others v. United Kingdom" (Liberty and Others v. United Kingdom) of July 1, 2008, complaint No. 58243/00.) The European Court applied the minimum guarantees developed in its case-law on the issue of targeted interception of communications. However, considered in the light of developing data interception technologies, the limits of observational activity analyzed in the mentioned cases would be much the same. More importantly, the European Court did not directly address the fact that targeted and mass interception of negotiations differed in a number of significant points. Unlike targeted interception, mass interception of data is usually aimed at international negotiations and is primarily used to collect external intelligence and identify new threats from known or unknown actors. If the "target" is specific individuals, then it is not their means of communication that are put under control, rather, strict data filters are applied to negotiations massively intercepted during intelligence activities.
(c) The rule that should have been applied to the bulk data interception mode. Although the guarantees already worked out by the European Court regarding the regime of targeted data interception provided an appropriate basis, they should have been changed to adapt to the specifics of mass data interception, the purpose of which is in principle preventive, and not intended for investigation with a specific task or a specific criminal act. For example, the requirement to clearly define in domestic legislation the categories of persons whose negotiations can be tapped and the nature of crimes that may lead to the use of this measure are not always applicable to the regime of mass interception of negotiations, the same applies to the requirement of "reasonable suspicion". Nevertheless, it is necessary that domestic legislation lists in sufficient detail the grounds for authorizing mass interception of data, as well as the reasons for intercepting the negotiations of a particular person. In addition, in the context of mass interception of data, control and revision are of increased importance due to the inherent risk of abuse and the legitimate need to maintain secrecy. It is also necessary to take into account the increase in the degree of interference with the rights of persons guaranteed by article 8 of the Convention as the procedure of mass interception of negotiations at the above stages passes. This means that the need for guarantees will be highest at the end of the process, when information about a particular person will be analyzed or the content of negotiations will be investigated by an analyst. Therefore, the process under consideration should be subject to the rule of "guarantees from beginning to end", that is, at the domestic level, the necessity and proportionality of the measures taken should be assessed at each stage of the process; mass interception of negotiations should be authorized by independent authorities from the very beginning, when the object and scope of the relevant operation are determined, which should be independently evaluated ex post facto. These are fundamental guarantees that should be the cornerstone of any procedure for mass interception of negotiations in accordance with article 8 of the Convention.
The European Court was not convinced that obtaining the accompanying communication data by mass interception of negotiations was necessarily less intrusive than obtaining the content of this data. Therefore, interception, retention and search of related communication data should be analyzed with reference to the same guarantees that apply to the content of the data.
In carrying out a general assessment of the functioning of the regime in question, the European Court focused mainly on whether the domestic legislation contained sufficient guarantees against abuse and whether "guarantees from beginning to end" were applied to the process. In doing so, the European Court took into account the actual functioning of the data interception system, including checks and balances in the exercise of powers, as well as the presence or absence of any evidence of real abuse. In assessing whether the authorities of the respondent States acted within a narrower margin of discretion, the European Court had to take into account broader criteria than the six guarantees from the above-mentioned Decision of the European Court of Justice in the case "Weber and Saravia v. Germany" (Weber and Saravia v. Germany). Considering jointly the principles of "compliance with the law" and "necessity", the European Court analyzed the question of whether the following aspects were clearly defined in domestic legislation.
(i) Grounds for authorizing mass interception of data. In principle, the broader the grounds for data interception, the greater the potential for abuse. At the same time, narrower and/or more carefully formulated grounds will only provide an effective guarantee against abuse if there are other sufficient guarantees that mass interception of negotiations will be authorized only on permitted grounds and that interception will be necessary and proportionate for this purpose. Thus, closely related to the previous reasoning, the question of whether there were sufficient guarantees that the interception was necessary or justified was as important as the degree of accuracy with which the grounds for issuing the sanction were determined. Consequently, in the opinion of the European Court, a procedure that allowed authorizing the use of mass interception of negotiations on relatively broad grounds could still comply with Article 8 of the Convention if, from a general point of view, sufficient safeguards against abuse were provided in the system to compensate for the mentioned disadvantage.
(ii) The circumstances under which it is possible to intercept the negotiations of a particular person.
(iii) Procedure for obtaining authorization to intercept negotiations. Mass interception of negotiations must be authorized by a public authority independent of the executive power system, but not necessarily by a court. This body must be informed both about the purpose of the interception and about the media or communication paths that will be intercepted. This will allow us to assess the necessity and proportionality of mass interception and the choice of media.
The use of filters, in particular strict ones, is one of the most important measures in the process of mass data interception, since it is at this moment that the negotiations of a particular person who has become the target of intelligence services can be intercepted. The European Court agreed that the inclusion of all filters in the process of obtaining a sanction is not feasible in practice. Nevertheless, when authorizing interception, at least the types or categories of filters used must be defined. Moreover, extended safeguards should be applied if intelligence services apply strict filters related to specific identified individuals. The use of each such filter must be justified - in relation to the principles of necessity and proportionality - by intelligence services, and this justification must be carefully recorded and undergo a procedure for obtaining preliminary internal authorization, providing for separate and objective verification.
(iv) Procedures for the selection, research and use of intercepted data.
(v) Precautions when transmitting intercepted data to third parties. The transfer by States parties to the Convention to other States or international organizations of materials obtained in the process of mass interception of negotiations should be limited to data collected and stored in accordance with the Convention by means and should be accompanied by additional special guarantees relating to the data transfer procedure itself, namely: (i) the circumstances under which such data transfer is possible, should be clearly stated in the legislation of the relevant State; (ii) the transmitting State should ensure that the receiving State provides, when processing data, guarantees capable of preventing abuse or disproportionate interference (in particular, there should be guarantees for the safe storage of data and restrictions on the further dissemination of such information). This circumstance does not necessarily mean that the receiving State must provide guarantees comparable to those of the transmitting State, and also requires that appropriate guarantees be provided at each data transfer; (iii) enhanced safeguards are necessary if it is obvious that data requiring special confidentiality, such as confidential journalistic data, is being transmitted; (iv) the transfer of materials to foreign intelligence services should also be under independent control.
(vi) The limits of the duration of interception, the storage of intercepted data and the circumstances under which such materials may be deleted or destroyed. In the case "Center of Justice v. Sweden" (Centrum fcr rdttvisa v. Sweden), although there should have been clear grounds for the existence of special requirements for the destruction of materials containing personal data, there should also have been a general rule provided by law governing the destruction of other materials obtained during mass interception of negotiations, when the storage of these materials could affect, for example, the right to respect provided for in article 8 of the Convention correspondence, including also its application to legal entities. At a minimum, there should have been a statutory requirement to delete intercepted data that has become irrelevant for intelligence purposes.
(vii) Procedures and conditions for the implementation of control by an independent public authority over the implementation of the above-mentioned guarantees and the authority of this authority to apply sanctions for non-compliance with the relevant requirements. Each stage of the procedure for mass interception of negotiations had to be accompanied by sufficiently careful monitoring by an independent public authority with the ability to assess the necessity and proportionality of the actions being carried out, taking into account the concomitant degree of interference with the convention rights of persons who are likely to be affected by data interception. To facilitate this control, detailed records should be kept at each stage of the intelligence service procedure.
(viii) Procedures for independent ex post facto review of compliance with the above-mentioned requirements and the powers of the public authority reviewing cases of non-fulfillment of duties. Anyone who suspects that his or her communications are being intercepted by intelligence services should have an effective remedy available to appeal either the illegality of the alleged interception or the non-compliance of the interception procedure with the requirements of the Convention. As in the case of targeted data interception, a remedy that does not depend on notifying the subject of interception can also be effective in the context of mass data interception. In the absence of a notification requirement, it is required that the remedy be associated with a public authority, not necessarily judicial, independent of executive authorities and ensuring the fairness of the proceedings in the case, as well as ensuring, as far as possible, an adversarial process. The decisions of such a public authority must be justified and binding in accordance with the law.
(d) Evaluation of the present cases.
(i) The case "Center of Justice v. Sweden" (Centrum fcr rdttvisa v. Sweden). The system of mass interception of negotiations in Sweden was based on detailed legal norms, had clearly defined limits and provided for a number of guarantees. The grounds for authorizing the mass interception of negotiations were clearly described, the circumstances of the interception of negotiations and the study of the data obtained were set out clearly enough, the duration of the interception was regulated by law and controlled, and the procedures for selecting, researching and using the intercepted data were accompanied by appropriate safeguards against abuse of rights. The same level of protection was applied to the content of intercepted messages and communication data. It is especially important that the preliminary judicial authorization and supervision carried out by an independent public authority, in principle, ensured the application in practice of the provisions of Swedish legislation and convention standards and limited the risks of disproportionate consequences negatively affecting the rights guaranteed by article 8 of the Convention. Namely, it was necessary to take into account the fact that in Sweden the limits for the implementation of mass interception of negotiations, as well as the legality and proportionality of this event as a whole, were the subject of a preliminary (before the issuance of a sanction for the procedure) consideration in the Foreign Intelligence Court, which sat in the presence of a privacy representative who defended public interests.
At the same time, the European Court noted three shortcomings in Swedish legislation related to the regime of mass interception of negotiations. As for the first drawback - the absence of a clear rule on the destruction of intercepted material that did not contain personal data - its potential ability to violate the rights guaranteed by article 8 of the Convention was limited by the fact that Swedish legislation established clear rules for the destruction of intercepted data in certain circumstances and, above all, if they contained personal data.
However, the second drawback - the absence of a legal requirement to take into account the private interests of individuals when deciding on the transfer of intercepted intelligence to foreign partners - could potentially lead to very serious negative consequences for the relevant individuals or organizations. He could allow information to be mechanically transmitted abroad that seriously compromises the personal rights of citizens or the right to respect for correspondence, even if the intelligence value of such data was very low. Consequently, such transfers could create clearly disproportionate risks to the rights guaranteed by article 8 of the Convention. In addition, the Swedish National Radio Intelligence Center (FRA) was not legally required to analyze and determine whether foreign recipients of intelligence provided an acceptable minimum level of guarantees.
In conclusion, the third drawback was the lack of effective ex post facto consideration. Namely, the dual role of the Foreign Intelligence Service and the lack of an opportunity for members of the public to obtain a reasoned decision in some form in response to requests or complaints related to mass interception of negotiations weakened the ex post facto control mechanism to such an extent that it created risks for the observance of fundamental human rights affected by the situation. Moreover, the lack of effective consideration at the final stage of the interception of information did not correspond to the position of the European Court that the level of interference with the rights guaranteed by Article 8 of the Convention increases with the expansion of the data interception procedure.
The above shortcomings were not compensated by the existing guarantees. Thus, the regime of mass interception of negotiations in Sweden went beyond the discretion granted to the authorities of the respondent State in this regard and, considered as a whole, did not contain sufficient "guarantees from beginning to end" to provide adequate and effective protection against arbitrariness and the risk of abuse.
RESOLUTION
The case involved a violation of the requirements of article 8 of the Convention (adopted by 15 votes in favor, with two against).
(ii) The case "Big Brother Watch and Others v. United Kingdom" (Big Brother Watch and Others v. United Kingdom). The data interception regime considered as a whole, despite the existing guarantees, including a number of reliable ones, did not contain sufficient guarantees "from beginning to end" to provide appropriate and effective guarantees against arbitrariness and the risk of abuse of rights. In particular, the following significant violations were revealed in the data interception mode: the absence of a sanction from an independent public authority, the absence of a list of data filters in the application for permission for the procedure, and the absence of a preliminary internal sanction for the use of filters against a specific person. These shortcomings concerned not only the interception of the content of negotiations, but also related communication data. Although the Interception Commissioner provided independent and effective oversight of the procedure in question, and the Investigative Powers Court provided a reliable remedy to anyone who suspected that his or her negotiations were intercepted by intelligence services, these important guarantees were not enough to counterbalance the shortcomings mentioned. The regime of mass interception of negotiations carried out in accordance with part 4 of Article 8 of the Law on Regulation of Investigative Activities (RIPA) did not meet the requirement of "the quality of the law" and therefore could not make "interference" "necessary in a democratic society."
RESOLUTION
The case involved a violation of the requirements of article 8 of the Convention (adopted unanimously).
Regarding compliance with article 10 of the Convention. The case "Big Brother Watch and Others v. the United Kingdom" (Big Brother Watch and Others v. United Kingdom).
(a) Required guarantees. Under the regime of mass interception of negotiations, intelligence services could intentionally receive confidential journalistic materials using deliberately selected filters or search queries related to a journalist or news organization. Since such a situation is very likely to lead to the receipt of significant amounts of confidential journalistic materials, it may call into question the principle of protecting data sources to an even greater extent than the decision to disclose the data source, and such interference would be proportionate to that which would take place during a search of a journalist's home or workplace. Therefore, before intelligence services use filters or search queries related to a specific journalist, which will make the selection of confidential journalistic materials for research highly likely, filters and search queries must be authorized by a judge or other independent and impartial decision-making body with the authority to determine whether the requested measures were "justified by the prevailing requirement of compliance with public of interest" and, in particular, could less intrusive measures have been applied, to serve the public interest in the first place.
Confidential journalistic materials could also have been obtained unintentionally, as a "side effect" of mass interception of negotiations. In such cases, the degree of interference in journalistic negotiations and/or journalistic sources cannot be predicted in advance. In the above-mentioned Decision in the case "Weber and Saravia v. Germany" (Weber and Saravia v. Germany), the European Court agreed that the initial interception of data without examining the content of the intercepted information was not a serious violation of Article 10 of the Convention. Nevertheless, considering that due to the development of technologies, surveillance not directed at a specific person was indeed able to collect an extremely wide range of data, it was imperative that domestic legislation provide reliable guarantees with regard to the storage, research, use, transfer and further destruction of such confidential information. Moreover, if and when it became obvious that the collected information or related communication data contained confidential journalistic information, further storage and study of this data by analytical specialists could be carried out only if there was a sanction from a judge or other independent and impartial public authority making decisions and having the authority to determine whether long-term storage and the study of information by "prevailing requirements of public interest".
(b) Application to the facts of the present case. Some of the applicants were a news organization and a journalist, and the contested data interception regime, which was an interference with the right of these applicants to freedom of expression, did not meet the above requirements. Additional guarantees related to the storage, further transfer and destruction of confidential journalistic materials did not eliminate the shortcomings identified by the European Court when analyzing the regime in question for compliance with Article 8 of the Convention.
RESOLUTION
The case involved a violation of the requirements of article 10 of the Convention (adopted unanimously).
- Obtaining intelligence from foreign intelligence services (the case "Big Brother Watch and Others v. United Kingdom" (Big Brother Watch and Others v. United Kingdom)).
Regarding compliance with article 8 of the Convention. If a request for intercepted data is received from a State that is not a party to the Convention, then this request should have been based on the provisions of domestic legislation, and this legislation should be accessible to interested persons and predictable regarding its consequences (see the Ruling of the Grand Chamber of the European Court in the case "Roman Zakharov v. the Russian Federation" (Roman Zakharov v.. Russia) (See: The Ruling of the Grand Chamber of the European Court in the case "Roman Zakharov v. Russia" (Roman Zakharov v. Russia) of December 4, 2015, complaint No. 47143/06 // Bulletin of the European Court of Human Rights. 2016. N 6.)). There must also be clear detailed rules that give individuals the opportunity to form a proper understanding of the circumstances and conditions under which the authorities have the right to make such a request, and which effectively guarantee that these powers will not be used to circumvent the requirements of domestic legislation and/or convention obligations of the State. Upon receipt of the materials, the receiving State should have adequate guarantees for the study of this information, its use and storage, its further transfer, removal and destruction. These guarantees, first developed by the European Court of Justice in its case-law on the issue of interception of negotiations by Contracting States, are also applicable to the receipt by it of the requested intercepted data from foreign intelligence services. If States do not always know whether the received material is the result of interception of negotiations, then the same standards should apply to all received materials that may be the result of data interception. In conclusion, any regime that allows intelligence services to request either data interception or intercepted data from a State that is not a party to the Convention, or to directly review such material, should be under independent control, and there should also be the possibility of independent ex post facto review.
The European Court, having limited its consideration to the complaint about the receipt of the requested intercepted data from the United Nations National Security Agency (NSA), was convinced that these requirements were
met in the present case and that the modes of requesting and receiving intercepted data, therefore, were in accordance with Article 8 of the Convention.
RESOLUTION
There was no violation of the requirements of article 8 of the Convention in the case (adopted by 12 votes in favor, with five against).
The European Court also ruled by 12 votes in favor, with five against, that there was no violation of Article 10 of the Convention in relation to obtaining intelligence from foreign intelligence services, since this complaint does not address an issue separate from the issue of violation of Article 8 of the Convention.
- Obtaining communication data from communication service providers (the case "Big Brother Watch and Others v. United Kingdom" (Big Brother Watch and Others v. United Kingdom)). The European Court ruled unanimously that there had been violations of Articles 8 and 10 of the Convention, since the operation of the data interception regime on the basis of Chapter II of the Law on Regulation of Investigative Activities "did not comply with the law".
COMPENSATION
In the application of article 41 of the Convention. The European Court has not awarded any fair compensation in any of the cases under consideration.