UK Investigatory Powers Tribunal Rules that Non-UK Residents Have No Right to Privacy under the ECHR

In another major development on the surveillance/privacy front, on Tuesday the UK specialized surveillance court, the Investigatory Powers Tribunal, ruled that persons not present within the United Kingdom are not within the jurisdiction of the UK in the sense of Article 1 of the European Convention on Human Rights, and accordingly do not have any of the rights under that Convention (para. 49 et seq). In other words, a person in say France or the United States subjected to surveillance by GCHQ does not have an ECHR right to privacy vis-a-vis the UK, which accordingly has no Convention claim to answer. This is I think the first time that a British court has expressly dealt with extraterritoriality in the surveillance context. The IPT’s reasoning essentially rests on a Bankovic analogy – if you are in say Serbia and the UK drops a bomb on you, the Strasbourg Court has said that you don’t have the right to life. How could you then have the right to privacy if all the UK did was to simply read your email while you were in Serbia?

I have extensively argued elsewhere why that analogy is wrong (as is Bankovic itself), so I won’t belabour that point further (see here and here). It was entirely predictable that the IPT would adopt this restrictive position, which is perfectly plausible under Strasbourg case law (even if fundamentally mistaken). The IPT was correct in ruling, however, that distinctions as to the Convention’s applicability can’t really be made on the basis of whether the person is present is some other Council of Europe state, or is outside the ECHR’s espace juridique altogether. Anyway, the issue of the Convention’s extraterritorial applicability to mass electronic surveillance abroad is one for Strasbourg to decide and (hopefully) fix, and it will have the opportunity to do so in these cases and others. What the Court will do is of course anyone’s guess, because its decision will inevitable have ripple effects on other scenarios, such as extraterritorial uses of lethal force, e.g. drone strikes.

I have also argued, however, that there is particular scenario in which the applicability of the Convention becomes more attractive (or less dangerous as a matter of policy) – when the surveillance actually takes place within the surveilling state’s territory, even if the affected individual is outside it. Imagine, for example, if the UK police searched my flat in Nottingham while I was visiting family in Serbia – surely I would have Article 8 rights, even though I would not be on UK territory when the search took place. Why then should I not have these rights if an email I send while I am in Serbia is routed through my university server in Nottingham and intercepted by GCHQ there? In both cases the intrusion into privacy happens on the UK’s territory, even if I am outside it. In fact, in its judgment the IPT briefly addresses this scenario, if all too briefly and less than convincingly, although I’m not sure that the point was extensively argued.

In any case, the main paragraphs on the jurisdiction issue are below the fold. The judgment also deals with the very important question of standing/victim status, finding that all but six of the 600+ claimants lacked locus standi even under a very low threshold of showing that they are ‘potentially at risk’ from surveillance measures (applying the European Court’s recent Zakharov judgment, para. 171).

56. Mr Jaffey’s core submission is that, on a true analysis, the impugned acts have both occurred in the territory of the United Kingdom. Therefore, it does not matter that the person whose Article 8 rights may have been infringed was at all material times abroad. He relies on Bosphorus v Ireland (2005) 42 EHRR 1 and Markovic v Italy (2007) 44 EHRR 52. In Bosphorus, an aircraft owned by an entity in the former Republic of Yugoslavia and leased by a Turkish company was seized in Dublin pursuant to UN and EU sanctions measures. The Turkish lessors had no connection with Ireland other than the maintenance contract with an Irish company pursuant to which the aircraft had been flown to Dublin. Neither the Irish Government nor other intervening parties, including the European Commission, submitted that Article 1 ECHR excluded the application because the Turkish lessors were not within the jurisdiction of Ireland when the aircraft was seized. (The submissions under Article 1 which were made were that the application was outside the Convention for other reasons). Nevertheless, the Court addressed the issue in paragraph 137 of its Judgment:

“In the present case it is not disputed that the act about which the applicant complained, the detention of the aircraft leased by it for a period of time, was implemented by the authorities of the respondent state on its territory following a decision to impound of the Irish Minister for Transport. In such circumstances the applicant company, as the addressee of the impugned act, fell within the “jurisdiction” of the Irish state…”

In Markovic, the claimants were relatives of people killed on 23 April 1999 when the RTS building in Belgrade was struck by a missile launched from a NATO aircraft. They claimed damages in the Rome District Court. On 8 February 2002 the Court of Cassation ruled that the Italian Courts had no jurisdiction to hear the claim. The applicants contended that their rights under Article 6 ECHR had been infringed. In answer to a preliminary question raised by the ECtHR of the parties, the Italian Government conceded that the applicants had brought themselves within the ambit of the State’s jurisdiction by lodging a claim: paragraph 38 of the Judgment. In the light of that concession, it is unsurprising that the Court held that if civil proceedings are brought in domestic courts, the state is required by Article 1 ECHR to secure in those proceedings respect for the right protected by Article 6, so that “there indisputably exists…a “jurisdictional link”” for the purposes of Article 1: paragraphs 54 and 55 of the Judgment.

57. Although the Court did not spell out its reasoning in either case for its conclusion that the contracting state owed the relevant convention obligation to the applicants, the outcome was not unprincipled. In Bosphorus the aircraft’s lessors had submitted their property to the territorial jurisdiction of the Irish State when they caused it to be flown to Dublin. Accordingly, although they were not physically present in Ireland at the time of the impugned act, their property was within its territorial jurisdiction. In Markovic, the applicants had submitted to the jurisdiction of the Italian Courts when they brought their civil claims there. Like the aircraft lessors, they had voluntarily submitted to the jurisdiction of a contracting state and were entitled to the benefit of the only relevant article of the Convention, Article 6, in the determination of their civil claim.

58. Neither case assists the two Claimants. In so far as their claim is founded on belief that their right to respect for their private life has been infringed, neither of them allege that, at any material time, they enjoyed a private life in the United Kingdom. Accordingly, under Article 1, the United Kingdom was under no obligation to respect it. The analogy with Bankovic is close. Further, information about a person is not property: OBG Limited v Allan [2008] 1 AC 1 at paragraph 275 per Lord Walker. Even in the autonomous Convention meaning, it has never been held to amount to a “possession”, for the purposes of Article 1 of Protocol 1. Accordingly, the retention by GCHQ of information shared with it by the NSA, even in circumstances which do not comply with UK law, could not amount to a breach of the two Claimants’ right to respect for their private life.

59. Mr Jaffey focussed on the Article 8 right to respect for “correspondence”. The interception of telephone calls and the interception and seizure of electronic mail amount to an interference with “correspondence”: Lüdi v Switzerland (1993) 15 EHRR 173 paragraph 39 and Wieser and Bicos Betiligungen v Austria (2008) 46 EHRR 54 at paragraph 45. Whether or not interception of electronic mail or telephone calls which happen to pass by cable or airwave through the territory of a contracting state sent or made to and received by persons outside the United Kingdom are within the scope of Article 1 is a moot point. It was raised as an objection by the German Government in Weber. The Court did not consider it necessary to rule on the issue: paragraph 72 of its Judgment. In Liberty v UK two of the claimants were Irish NGO’s and the point was not taken or addressed.

60. Our view is that a contracting state owes no obligation under Article 8 to persons both of whom are situated outside its territory in respect of electronic communications between them which pass through that state. Further, and in any event, as a UK tribunal we are obliged by domestic law not to do more than to keep pace with the Strasbourg jurisprudence: R (Ullah) v Special Adjudicator [2004] 2 AC 323 at paragraph 20 per Lord Bingham and Smith v Ministry of Defence [2014] AC 52 at paragraph 44 per Lord Hope. We are also not persuaded that a privacy right is, as Mr Jaffey contended, a right of action present in the jurisdiction, and that too would similarly be extending the bounds of the UK Courts’ jurisdiction under Article 8.

61. For those reasons, we are satisfied that the two Claimants’ human rights claims cannot succeed, because they are claims about matters which are outside the scope of the ECHR, alternatively, because it has not been established by the jurisprudence of the ECtHR that they clearly are within it.