Yet another defeat in the courts for the UK government’s use of mass surveillance as an indiscriminate and, as it frequently turns out, unlawful investigatory tool.
Today the UK’s Court of Appeal handed down its ruling in a long running challenge to the 2014 Data Retention and Investigatory Powers Act (DRIPA) — judging that the regime’s bulk collection and retention of citizens’ Internet activity and phone records was unlawful.
The UK High Court also ruled the regime unlawful, back in 2015.
The emergency legislation sunsetted at the end of 2016 but the legal fight is not just an academic footnote as DRIPA has since been replaced with another controversial UK law that’s also been branded a ‘Snooper’s charter’ (aka: The Investigatory Powers Act).
This means today’s ruling cranks up the pressure on the government to amend its existing surveillance regime to avoid falling foul of the legal system yet again in future.
“Yet again a UK court has ruled the government’s extreme mass surveillance regime unlawful,” said civil rights group Liberty director, Martha Spurrier, in a statement. “This judgment tells ministers in crystal clear terms that they are breaching the public’s human rights. The latest incarnation of the Snoopers’ Charter, the Investigatory Powers Act, must be changed.
“No politician is above the law. When will the government stop bartering with judges and start drawing up a surveillance law that upholds our democratic freedoms?”
When DRIPA was rushed through parliament in July 2014 its passage was accompanied by howls of ‘surveillance stitch-up’ from digital and civil rights groups.
Even legal minds which weren’t instantly describing it as out and out illegal were plenty critical — describing it as overly broad, vague and draconian. Turns out they were right.
Today, Labour MP Tom Watson, who originally brought the challenge against DRIPA, also called for the IP Act to be amended in the wake of the Appeal Court ruling. “The government must now bring forward changes to the Investigatory Powers Act to ensure that hundreds of thousands of people, many of whom are innocent victims or witnesses to crime, are protected by a system of independent approval for access to communications data,” he said in a statement.
In its response, the government claimed its previously announced amendments to the IP Act are sufficient to ensure the regime is lawful.
“We had already announced that we would be amending the Investigatory Powers Act to address the two areas in which the Court of Appeal has found against the previous data retention regime. We welcome the fact that the Court of Appeal ruling does not undermine the regime and we will continue to defend these vital powers, which Parliament agreed were necessary in 2016, in ongoing litigation,” said security minister Ben Wallace in a statement.
“This judgment relates to legislation which is no longer in force and, crucially, today’s judgement does not change the way in which law enforcement agencies can detect and disrupt crimes,” he added.
He also defended the state’s data capture regime generally — arguing it’s a necessary crime-fighting tool. “Communications data is used in the vast majority of serious and organized crime prosecutions and has been used in every major Security Service counter-terrorism investigation over the last decade,” he claimed. “It is often the only way to identify paedophiles involved in online child abuse as it can be used to find where and when these horrendous crimes have taken place.”
Last November, under mounting pressure over its broadly drafted surveillance regime — including a landmark judgment by Europe’s top court, at the end of 2016, which stated that “general and indiscriminate” state data retention regimes contravene EU law — a Home Office consultation paper revealed plans to amend the legislation to try to squeeze its powers into a more lawful shape.
Among the proposals is a plan to restrict the power for senior police officers to self-authorise access to people’s phone and web browsing records to investigations of crimes that carry a prison sentence of at least six months; and the creation of a new body to authorize requests for communications data, i.e. rather than letting police officers or senior civil servants sign off on such requests.
Liberty argues these changes don’t go nearly far enough — saying they don’t even fully comply with past court rulings requiring mandatory safeguards, and pointing out they continue to allow public bodies to indiscriminately retain and access personal data.
Critics have also suggested the government is effectively trying to redraw the definition of serious crime to still be able to afford state agencies’ indiscriminate bulk data access.
Last September, the oversight court for the UK’s spy agencies refused to rule on another ongoing challenge to the bulk powers contained in the IP Act — referring the matter to Europe’s top court, the CJEU, to determine legality when bulk powers are used in a national security context.
In today’s Court of Appeals judgment, the judges also stepped back from making a wider ruling against state mass surveillance where the powers being used are justified on the grounds of national security — leaving that point to be settled by the CJEU.
And apparently doing so after a late-stage government intervention…
The Appeals Court judges restricted their ruling to finding that DRIPA was unlawful because it was not restricted to solely fighting serious crime; and because access to the data was not subject to a review by a court or independent administrative authority. Both of which are areas where the government has said it will make concessions via the aforementioned amendments to the IP Act.
However its strategy of publicly consulting on amendments to surveillance law to try to workaround the CJEU’s ruling against indiscriminate data retention regimes has drawn withering criticism from privacy groups.
Earlier this month Big Brother Watch wrote: “Compliance with the law is not a matter for public deliberation. It is additionally concerning that the government is consulting the public on proposed amendments that clearly seek to reject or evade significant requirements of the CJEU’s judgment. Any amendments that fail to meet the standards required by law will be illegitimate, regardless of whether they follow a public engagement exercise.
“In our response we cite the CJEU’s judgment, which makes clear the express mandatory standards for the communications data regime. Government must respect these standards to uphold fundamental rights and liberties in the UK, as well as to ensure the UK’s adequacy with EU law. “