In a high profile win for civil liberties in the U.K., surveillance legislation rushed through the national parliament in a matter of days last year has today been declared unlawful under European Human Rights law.
Two MPs, Tom Watson (Labour) and David Davis (Conservative), along with civil rights campaign group Liberty, took the government to the High Court last month, challenging the Data Retention and Investigatory Powers Act (DRIPA) on privacy and data protection grounds. Today the High Court agreed with their challenge.
The government can appeal the judgement — and does not have to instantly halt data retention practices taking place under DRIPA, with the court allowing those portions of the law it deems unlawful to remain in force until March 2016 “to allow time for the government to legislate properly”.
But the ruling fires a clear warning shot across the bows of a government that is among the most hawkish in Europe on surveillance and interception — with the U.K. Prime Minister at times appearing to suggest encryption should be outlawed, and a Home Secretary who has consistently banged the drum to ramp up investigatory powers.
DRIPA as a whole has a sunset clause of the end-of-2016. So the government is already working to replace it with permanent and potentially more expansive surveillance legislation (it has talked of plugging “capability gaps”) via the forthcoming Investigatory Powers Bill (IPB) — the latter due in draft form this fall.
Today’s High Court ruling will feed into the debate as MPs seek consensus on where the line should be drawn to balance state surveillance capabilities with individual privacy rights. And indicates that the government’s current thinking is out of step with EU law. (NB: the government’s election manifesto included a pledge to replace the European Convention on Human Rights with a British Bill of Rights — although it has not announced any legislative timetable for doing so yet).
One area where there is cross-party — and wider — consensus is the need for clarity in the oversight legislation which governs state surveillance, interception and data retention powers in the U.K. The existing Regulation of Investigatory Powers Act is roundly condemned as unfit for purpose. And legislating to provide for “appropriate oversight” is one of the government’s stated intentions with the forthcoming IPB.
DRIPA, meanwhile, is anything but clear or appropriate. The legislation was criticized last year for being overly vague and draconian, as well as for going against the wider regional trajectory by effectively reversing the European Court of Justice ruling that had, months earlier, struck down EU data retention powers as disproportionate.
Discussing DRIPA with TechCrunch last year former Pinsent Mason lawyer Danvers Baillieu noted how few limits it afforded on the scope of retention notices that the Home Secretary could issue.
“Basically clause 1 says the Secretary of State may issue a retention notice and it may require just about anything — including ‘the retention notice may make different provision for different purposes’, that’s what it says in the bill. So a retention notice can pretty much tell you to do anything — other than hold anything longer than 12 months,” he said.
The High Court evidently agrees with Baillieu’s assessment, ruling that section 1 is unlawful on the grounds that it fails to provide “clear and precise rules” to ensure data is only accessed for the purpose of preventing, detecting or conducting criminal prosecutions of serious offences. The court also ruled section 2 unlawful because it does not build in limits to accessing this data by requiring access be authorized by a court or independent body.
The latter point is interesting because two government commissioned independent reviews of surveillance legislation, which have both published their findings this summer, have called for intercept warrants to be signed off by the judiciary, rather than being sanctioned by ministers — as is the case now.
The government has so far said it has not yet made a decision on that point, although some of the noises coming out of Downing Street appear to suggest Cameron is not keen on the idea. Today’s High Court ruling piles more pressure on the government to bend to a growing number of calls that warrants be authorized by judges, not senior politicians.
On the independent approval point, the High Court notes in its ruling: “The need for that approval to be by a judge or official wholly independent of the force or body making the application should not, provided the person responsible is properly trained or experienced, be particularly cumbersome.”
Another criticism of DRIPA is the government’s unseemly haste in railroading the bill through parliament, bypassing the normal lengthy legislative scrutiny process by gaining the support of the opposition Labour party to ensure a majority, and by using a tactic of putting the law through as parliament was about to go on summer recess. All of which was widely condemned at the time as un-democractic.
With the High Court slamming DRIPA as unlawful now the government will also be under pressure to avoid any such unseemly haste in future surveillance debates as it works to reshape legislation in this area.
That said, DRIPA’s sunset clause already puts in place a fairly short window for detailed parliamentary scrutiny of such a technologically complex area (not to mention the moral and ethic complexities arising at the intersection of individual rights and state responsibilities). The High Court ruling now squeezes the government’s timetable further by sunsetting some of DRIPA’s powers several months earlier.
Albeit, to spin all that another way…
The Home Secretary has previously said the government is committing to having a IBP by “early next year” to allow time for it to pass into law before the DRIPA sunset clause comes into effect at the end of 2016. “In order to meet that timetable and allow thorough parliamentary scrutiny we intend to bring forward a draft bill for consideration in the autumn, which will be subject to pre-legislative scrutiny, including by a joint committee of both Houses,” she said last month.
Responding to today’s High Court judgement, David Anderson, the QC who penned one of the two independent reviews of government surveillance legislation, notes it may affect the timing of the government’s plans for “wide-ranging reform in this area” should the government decide it needs “remedial legislation” before March 2016. Which suggests the IPB’s timetable could be set back if the government focuses on another stop-gap legislative patch.
The prospect of the government rushing through more hasty surveillance legislation is not good. Nor is the prospect of truncated parliamentary scrutiny of new surveillance oversight law when the overwhelming requirement here is for “clear and precise” guidance. Problematically vague existing legislation has undoubtedly contributed to serious privacy and civil liberties breaches by state operators for years. We don’t need any more RIPAs.
Anderson dubs today’s court ruling a “decision of great potential importance”, noting that it echoes decisions already made by national courts in the Netherlands, Belgium, Austria, Slovenia and Romania — falling in line with EU law.
He writes:
If not successfully appealed, the judgment will require change to existing practices for accessing communications data (which I had already recommended should be subject in some categories of case to a higher degree of independent authorisation: see A Question of Trust, Recommendations 65, 67-71). Indeed it may point to broader-reaching change than I had recommended, speaking of the need for approval in all cases by “a judge or official wholly independent of the force or body making the application” (Judgment, para 98). This throws into doubt the adequacy of the existing system for approval and authorisation by a designated person within the police force or public authority which seeks communications data. Some of the practical constraints in this area are illustrated at 9.24(a)(b) of A Question of Trust.
The judgment may also be of relevance to the current debate over whether there should be judicial or ministerial authorisation of interception warrants (which were not the subject of the Davis/Watson case, but which relate to the content of communications and may thus be considered more intrusive than the communications data at stake in that case). Change in this respect was recommended both in A Question of Trust (Recommendation 22), and in this week’s RUSI report, A Democratic Licence to Operate. My reflections on this point in A Question of Trust, 5.79, were reproduced by the Divisional Court at para 72 of its judgment.
He also adds that the ruling is “of no direct relevance” to the so-called Snooper’s Charter — another piece of surveillance legislation which the government tried and failed to pass last year, and which would have expanded the categories of data retained by ISPs — but he reiterates, in line with recommendations from his recent surveillance review report, that it “underline[s] the need for a legally sound and evidence-based case, if this idea is to be pursued in the future”.
With the Snowden revelations of 2013 unmasking the huge scale and scope of state digital surveillance apparatus, creating an imperative for reform and clearer oversight, it’s to be hoped that a U.K. law as opaque and problematic as RIPA could no longer be passed — and that domestic politicians heed growing calls for “legally sound and evidence-based” investigatory powers that do not infringe human rights.
Or, as Eduardo Ustaran, Partner at law firm Hogan Lovells writes, today’s High Court ruling is “a sign of the need for democratic diligence in the political decision-making process” — and signals the need for “an open and public debate that leads to a thorough legislative process without hyperbole and paranoia in order to deliver a legal framework that stands up to the courts’ scrutiny”.