In another major development on the surveillance/privacy front, on Tuesday the UK specialized surveillance court, the Investigatory Powers Tribunal, ruled that persons not present within the United Kingdom are not within the jurisdiction of the UK in the sense of Article 1 of the European Convention on Human Rights, and accordingly do not have any of the rights under that Convention (para. 49 et seq). In other words, a person in say France or the United States subjected to surveillance by GCHQ does not have an ECHR right to privacy vis-a-vis the UK, which accordingly has no Convention claim to answer. This is I think the first time that a British court has expressly dealt with extraterritoriality in the surveillance context. The IPT’s reasoning essentially rests on a Bankovic analogy – if you are in say Serbia and the UK drops a bomb on you, the Strasbourg Court has said that you don’t have the right to life. How could you then have the right to privacy if all the UK did was to simply read your email while you were in Serbia?
I have extensively argued elsewhere why that analogy is wrong (as is Bankovic itself), so I won’t belabour that point further (see here and here). It was entirely predictable that the IPT would adopt this restrictive position, which is perfectly plausible under Strasbourg case law (even if fundamentally mistaken). The IPT was correct in ruling, however, that distinctions as to the Convention’s applicability can’t really be made on the basis of whether the person is present is some other Council of Europe state, or is outside the ECHR’s espace juridique altogether. Anyway, the issue of the Convention’s extraterritorial applicability to mass electronic surveillance abroad is one for Strasbourg to decide and (hopefully) fix, and it will have the opportunity to do so in these cases and others. What the Court will do is of course anyone’s guess, because its decision will inevitable have ripple effects on other scenarios, such as extraterritorial uses of lethal force, e.g. drone strikes.
I have also argued, however, that there is particular scenario in which the applicability of the Convention becomes more attractive (or less dangerous as a matter of policy) – when the surveillance actually takes place within the surveilling state’s territory, even if the affected individual is outside it. Imagine, for example, if the UK police searched my flat in Nottingham while I was visiting family in Serbia – surely I would have Article 8 rights, even though I would not be on UK territory when the search took place. Why then should I not have these rights if an email I send while I am in Serbia is routed through my university server in Nottingham and intercepted by GCHQ there? In both cases the intrusion into privacy happens on the UK’s territory, even if I am outside it. In fact, in its judgment the IPT briefly addresses this scenario, if all too briefly and less than convincingly, although I’m not sure that the point was extensively argued.
In any case, the main paragraphs on the jurisdiction issue are below the fold. The judgment also deals with the very important question of standing/victim status, finding that all but six of the 600+ claimants lacked locus standi even under a very low threshold of showing that they are ‘potentially at risk’ from surveillance measures (applying the European Court’s recent Zakharov judgment, para. 171).