The Investigatory Powers Tribunal handed down a ruling which found that UK intelligence agencies had been violating the privacy rights of British citizens for 17 years, from 1998 to 2015. The case was brought to the tribunal after the human rights group Privacy International filed a lawsuit against the British government over its surveillance programs.
The tribunal considered two different types of data that were being collected by the agencies, Bulk Communications Data(BCD) and Bulk Personal Datasets(BPD). BCD is a collection of metadata about communications, such as who the message is to and from and when it was sent, but does not contain the actual content of communications. BPD contains in depth biographical data, and could include details about a person's health, financial activities, and electoral information. The GCHQ, MI5 and MI6 collected and used BCD, while only the GCHQ and MI5 collected BPD.
The tribunal found that the regimes under with both types of data were collected violated Article 8 of the European Convention on Human Rights(ECHR), which guarantees the right to privacy. The ruling states that the agencies had inadequate external oversight to supervise their collection of data. Due to new oversight mechanisms that were implemented in 2015, the tribunal found that the current data collection programs by government agencies were lawful.
For a long time, the British government had argued that bulk data collection cannot itself be a violation of privacy, and only if a human actually looks at the data can it be a violation. The tribunal rejected this argument and stated that the privacy protections in the ECHR are "engaged by the transfer and storage of communications data even if it is not accessed."
Following the ruling, Millie Graham Wood, legal officer at Privacy International, issued the following statement:
Today’s judgment is a long overdue indictment of U.K. surveillance agencies riding roughshod over our democracy and secretly spying on a massive scale. It is unacceptable that it is only through litigation by a charity that we have learnt the extent of these powers and how they are used. The public and Parliament deserve an explanation as to why everyone’s data was collected for over a decade without oversight in place and confirmation that unlawfully obtained personal data will be destroyed.A representative of the UK government made this statement:
The powers available to the security and intelligence agencies play a vital role in protecting the U.K. and its citizens. We are therefore pleased the tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes.Is bulk data collection by intelligence agencies acceptable with external oversight, or is it still a privacy violation? Leave your comments below.