The UK government breached human rights rules by failing to ensure proper oversight of its mass surveillance programmes, according to the European Court of Human Rights.
In a judgment handed down today, the court said the safeguards within the government's system for bulk interception of communication were not robust enough to provide guarantees against abuse.
The court said this violated the right to privacy under the European convention – as did the way in which GCHQ obtained communications data from service providers.
However, the court said the sharing of information with foreign government was not in breach of the rules.
The case, brought by a number of human rights and journalism organisations, is one of many challenges launched after the US whistleblower, former NSA sysadmin Edward Snowden's 2013 revelations that GCHQ was secretly intercepting communications traffic via fibre-optic undersea cables.
It is the first time the court has considered these UK regimes, and the first time it has ever considered intelligence-sharing programmes.
The court did not say that carrying out bulk interception was unlawful in and of itself – but rather that the oversight of that apparatus was insufficient.
Although the case considered procedures governing bulk cable-tapping that are no longer in force – since replaced by the Investigatory Powers Act – campaigners have hailed it as a further nail in the coffin of state surveillance.
"The Court has put down a marker that the UK government does not have a free hand with the public's communications and that in several key respects the UK's laws and surveillance practices have failed," said Dan Carey of Deighton Pierce Glynn solicitors, which acted for some of the parties.
"The pressure of this litigation has already contributed to some reforms in the UK and this judgment will require the UK government to look again at its practices in this most critical of areas."
Critics argue that the new law has simply made a lot of what was previously going on under the radar more transparent, and does not change the material concerns about the lawfulness of the activities themselves.
"Many of the legal flaws slammed in today's decision are baked into that law," said Corey Stoughton of Liberty, one of the organisations that brought the case. "The wind is in our sails today."
'Incapable of keeping interference to what is necessary'
The case – which joined together three separate challenges – considered three aspects of the UK's spying laws: the regime for bulk interception of communications (under section 8(4) of RIPA); the system for collection communications data (under Chapter II of RIPA); and the intelligence sharing programme.
The first two were found to breach the convention, while the latter did not.
The court said the system governing the bulk interception of communications was "incapable" of keeping interference to what is "necessary in a democratic society" for two reasons.
"First, the lack of oversight of the entire selection process, including the selection of bearers for interception, the selectors and search criteria for filtering intercepted communications, and the selection of material for examination by an analyst.
"Secondly, the absence of any real safeguards applicable to the selection of related communications data for examination."
On the second point, the court noted particular concern about the way in which the government could search and examine this related data – the who, when and where of a communication – "apparently without restriction".
It said it was not persuaded that the collection of this information was less intrusive than the acquisition of content, pointing out that content might be encrypted or, if decrypted, might reveal nothing of note.
In contrast, related communications data is capable "of painting an intimate picture of a person" through mapping social networks, location tracking and insight of who they interacted with.
The court had also been asked to consider whether there had been violations of other parts of the convention, but found that the arguments put forward for a number of these challenges were inadmissible.
It did, however, rule that there had been a violation of Article 10, the right to freedom of expression for two of the parties, as there were insufficient safeguards in respect of confidential journalist material.
The court has been ordered to pay the first group of applicants, led by Big Brother Watch, €150,000 of their claimed costs and the second group (the Bureau and Ross) €35,000. The third group, of 10 human rights organisations, made no claims.
'New regime poses an ever greater threat to civil liberties'
Today's ruling is the latest in a long line that have found against the government's former snooping law, which has since been superseded by the Investigatory Powers Act.
The court did not consider the newer law, as it was not in force at the time of its examination of the case – and so the ruling refers to the system as it was.
The former system of data collection has previously been ruled unlawful by the UK's own Investigatory Powers Tribunal, which found that the spy agencies engaged in indiscriminate and illegal bulk surveillance for 15 years, up to October 2016.
However, the Investigatory Powers Act is also being challenged, based on a 2016 judgment from the Court of Justice of the European Union that ruled indiscriminate data retention illegal.
That said access to retained data must only be granted for cases of serious crime, and that authorisation should come from an independent body, not public authorities.
It was followed by similar decisions in the Court of Appeal and High Court, which said the Snooper’s Charter did not comply with the EU ruling. The High Court, whose ruling applied to Part 4 of the Act, gave the government until 1 November to change the law.
The government has since proposed changes to the law that it says will bring it in line with the CJEU’s decision – but campaigners are eyeing up fresh challenges.
"Under the guise of counter-terrorism, the UK has adopted the most authoritarian surveillance regime of any Western state, corroding democracy itself and the rights of the British public," said Silkie Carlo, director of Big Brother Watch.
"This judgment is a vital step towards protecting millions of law-abiding citizens from unjustified intrusion. However, since the new Investigatory Powers Act arguably poses an ever greater threat to civil liberties, our work is far from over." ®