Intelligence Sharing and the Right to Privacy after the European Court Judgment in Big Brother Watch v. UK

On 13 September 2018, the European Court of Human Rights ruled in three consolidated cases brought by 14 human rights organisations and 2 individuals against the UK government’s mass interception program and its access to the intelligence gathered by other governments, including the United States (Big Brother Watch v. UK, nos. 58170/13, 62322/14, 24960/15.)

As noted already by Marko Milanovic, these cases are nuanced, complex, and long. I intend to focus here on one aspect, namely the way the Court assessed the intelligence sharing claim brought by the applicants (paras 416-449.) This assessment is noteworthy as that claim presents an issue of first impression for the Court. As the judgment itself notes, “this is the first time that the Court has been asked to consider the Convention compliance of an intelligence sharing regime” (para 416). (It is worth noting, however, that the recent judgment in Centrum för Rättvisa v. Sweden no. 35252/08 also touches upon this issue.)

The applicants’ intelligence sharing claim centred on the revelations, contained in disclosures by Edward Snowden, that the UK government has access to information collected by other foreign intelligence agencies, and most notably the U.S. National Security Agency (NSA). In particular, these revelations suggest that the UK government has direct and unfettered access to raw data intercepted by other governments, which it can then filter, store, analyse and further disseminate. They further suggest that the UK government has similarly broad access to information stored in databases by other governments.

From a human rights law perspective, the fundamental question raised in this case is the nature of the interference and therefore the applicable test to apply to such interference.

The Court indicates that the interference to privacy resulting from obtaining information through intelligence sharing is equivalent to the interference resulting from if it had obtained that information through its direct surveillance. And accordingly, it found that the analytical approach to assessing such interference should, “[a]s with any regime which provides for the acquisition of surveillance material”, consider whether:

“the regime for the obtaining of such material from foreign Governments [is] ‘in accordance with the law’…, [is] proportionate to the legitimate aim pursued, and [includes] adequate and effective safeguards against abuse.”

The Court added that:

“[i]n particular, the procedures for supervising the ordering and implementation of the measures in question must be such as to keep the ‘interference’ to what is ‘necessary in a democratic society'”. (para 422)

This is an important finding and it means that:

“as the material obtained [though an intelligence sharing arrangement] is nevertheless the product of intercept, those requirements which relate to its storage, examination, use, onward dissemination, erasure and destruction must be present.” (para 423.)

Significantly, the Court explains the reasoning behind this finding of equivalence. In particular, it recognises that:

“if Contracting States were to enjoy an unfettered discretion to request either the interception of communications or the conveyance of intercepted communications from non-Contracting States, they could easily circumvent their obligations under the Convention. Consequently, the circumstances in which intercept material can be requested from foreign intelligence services must also be set out in domestic law in order to avoid abuses of power. […] they [the circumstances] must nevertheless be circumscribed sufficiently to prevent – insofar as possible – States from using this power to circumvent either domestic law or their Convention obligations.” (para 424)

These important findings are tempered by the way the Court applies them when considering the way the UK regulates its intelligence sharing regime. Without going into the details of the applicants’ arguments on the inadequacy of the UK law, two aspects of the judgments raise concerns.

Firstly, in analysing the UK’s intelligence sharing program, the Court relies on the concept of the UK government “requesting” information. Focussing on “requests” by the UK to foreign authorities for particular intelligence ignores the reality of modern intelligence sharing programs. Intelligence sharing is not confined to the handover of discrete information, but it can encompass direct and unfettered access to “raw” (i.e. unanalysed) data as it transits the internet or is held in databases. This is clearly the case in relation to the UK/US sharing arrangements, but it is also increasingly the case in relation to other intelligence sharing programs, including within the European Union.

Secondly, there seems to be an internal contradiction in the judgment when comparing the Court’s findings with respect to the mass interception and intelligence sharing frameworks. While the Court holds that the safeguards for the selection of intercepted materials under the UK’s mass interception legal framework (RIPA section 8(4)) are non-compliant with Article 8 (para 347), it found those same safeguards to be acceptable when they apply to selection of intercepted material obtained via intelligence sharing (paras 433-434). This flaw in reasoning may rest, in part, on the Court’s fundamental misunderstanding about the nature of modern intelligence sharing, which permits access to large amounts of raw data.

Irrespective of these shortcomings, the Court’s judgment remains significant. Importantly, it clarifies that states’ intelligence sharing laws and practices interfere with fundamental human rights and therefore requires them to assess whether those laws and practices are human rights compliant with human rights. It further provides general guidance on how states should approach such assessments.

The Court’s findings are sorely overdue. Intelligence sharing is one of the most pervasive, and least regulated, surveillance practices in the modern world. Such sharing is facilitated by rapidly changing technology that has allowed for the storage and transfer of vast amounts of data within and between countries.

As noted by the UN Special Rapporteur on counter-terrorism and human rights, “efforts to counter terrorism are evolving to encompassing broader transnational dimensions as terrorism-related incidents frequently comprise trans-border elements”.

UN Security Council resolutions have emphasized the need for international cooperation in information-sharing, both for the purposes of collecting intelligence and judicial assistance. And in Europe, information sharing is gaining prominence, particularly in light of the need to coordinate counter-terrorism activities. As noted by the President of the European Commission last week: “We need to be able to prosecute terrorists in a more coordinated way, across our Union. Terrorists know no borders. We cannot allow ourselves to become unwitting accomplices because of our inability to cooperate.”

Intelligence sharing does not per se violate international human rights law. When done appropriately, sharing of intelligence can enhance human rights protections by helping authorities to identify and curtail threats to the security of its population. As this judgment says:

“due to the nature of global terrorism, and in particular the complexity of global terror networks, the Court accepts that taking such a stand – and thus preventing the perpetration of violent acts endangering the lives of innocent people – requires a flow of information between the security services of many countries in all parts of the world.” (para 446.)

But unregulated intelligence sharing poses substantive risks to human rights and to the democratic rule of law. The risk is that information sharing is done without adequate guarantees for human rights and robust independent oversight. In August 2018, the UN High Commissioner on Human Rights confirmed, in his report on the right to privacy in the digital age, that:

“with very few exceptions, legislation has failed to place intelligence-sharing on a proper statutory footing, compliant with the principle of legality under international human rights law.”

As the European Court of Human Rights has now explicitly found, intelligence sharing activities must meet the fundamental principles of legality, necessity and proportionality to be lawful under international human rights law.

The views expressed in this post are the author’s own and made in his individual capacity and not in his capacity as an employee of Privacy International.