Liberty from snooping

Liberty, the civil rights campaigning group, plans to launch a judicial review of the Investigatory Powers Act 2016, otherwise known as the ‘Snooper’s Charter’, and has turned to crowdfunding to raise financial support for its action.

This is the next chapter in a long-running dispute about surveillance powers. Back in 2014, MPs David Davis and Tom Watson challenged the legality of powers to retain certain types of ‘communications data’ contained in the Data Retention and Investigatory Powers Act 2014 (DRIPA). They asserted the Act’s provisions were contrary to European law.

The concerns centered on powers to require communications service providers to retain electronic communications data about their service users for up to 12 months. The applicants won a victory in the Divisional Court in July 2015, but the Court of Appeal expressed doubts about the lower court’s reasoning and referred the key issues to European Court of Justice in Luxembourg for resolution. In December 2016, the CJEU handed down its verdict, holding the European directive, and national legislation under it, was unlawful.

However, the CJEU held it was for the national courts to decide whether the domestic legislation was unlawful, so the UK litigation has not concluded.

In the meantime DRIPA has been repealed and replaced by the Investigatory Powers Act 2016. Liberty argues that the IPA is not only wider than DRIPA, but also that it does not rectify the flaws identified by the CJEU. For example, the IPA contains powers to enable the ‘bulk interception’ of information or ‘bulk personal datasets’ to be gathered and accessed by the security and intelligence agencies.

Liberty speaks of the government having the power ‘to monitor everybody’s web history and email, text, and phone records, and hack computers, phones, and tablets on an industrial scale’. Furthermore, there are arguments about the strength of the authorisation safeguards introduced.

Any challenge against the IPA will need to get going soon. Royal assent was given to Act on 29 November 2016, and there is authority to suggest that any challenge should be made within three months of that date, even if the Act has not yet come into force.

Liberty is using crowdfunding to finance the litigation. At the date of writing, the campaign group had reached its initial target of £50,000, enabling it to fund the permission stage.

The underlying issues are difficult and complex, involving the balance between privacy rights and the ability to fight crime and threats to national security by the most effective means. In its publicity, Liberty has set out its concerns, both about the retention of personal data on an ‘indiscriminate’ basis, and the argument that the access regime does not contain sufficient safeguards.

In the Watson challenge, the CJEU accepted that the retention powers are able to build up ‘a profile of the individuals concerned, [storing] information that is no less sensitive, having regard to the right to privacy, than the actual content of communications’. These powers are ‘likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance’.

But the breadth of the CJEU’s attack on retention regimes has its critics. The value of information-gathering powers to the police was accepted by David Anderson QC, the independent reviewer of terrorism legislation. He noted its value, not only in the investigation of serious crime, but also in matters such as reported disappearances where examination of the phone records of a missing person may offer clues to help locate them. His work has further endorsed the operational value of the bulk interception, bulk acquisition, bulk equipment interference, and bulk personal datasets powers in the IPA. For many, the issue should not be the existence of the retention powers, but the strength of the safeguards governing access to them.

Across the whole debate lies the shadow of Brexit. Would Brexit bring an end to arguments based on the legality of a European directive, as well as ending references by the British courts to the CJEU? There are two years or more before any Brexit deal is likely, and there is a strong justification for maintaining data protection rules that are consistent with those applied across Europe to guarantee data can flow from states within the EU to the UK, without legal obstacles.

There are also privacy rights contained in the European Convention on Human Rights, even if one strand of commentary maintains that the CJEU has now gone further than the Strasbourg judges who interpret the requirements of the ECHR. These debates look no closer to resolution, and the achievement of a consensus about the proper use of surveillance powers seems remote.

Eleanor Grey QC is a barrister at 39 Essex Chambers

@39EssexChambers www.39essex.com