Euro Rights Blog: If One Wants Something Badly Enough…in Defiance of…International Law, Find a Lawyer to Say that it Is Perfectly Lawful – by Matthew White
Matthew White is a PhD candidate at Sheffield Hallam University, UK
On 7 July 2016, the Interception of Communications Commissioner Office (IoCCO) released their report on s.94 of the Telecommunications Act 1984 (TA 1984). Section 94 concerns the power of the Secretary of State (after consultation with a public electronic communications network (PECN)) to give directions of a general character in the interests of national security or relations with a foreign government. This post concerns the argument surrounding the necessary interference required to attract the application of the European Convention on Human Rights (ECHR). This is of great importance as it determines when a state should abide by the ECHR. If a state (wrongly) feels that the threshold for interference has not been met, it renders the ECHR ‘theoretical and illusory.’
Direction under s.94 had been used to acquire communications data in bulk (para 2.4). The IoCCO’s report asked (page 25) the important question as to why s.94 had been utilised instead of Chapter 2, Part 1 of the Regulation of Investigatory Powers Act 2000 (RIPA 2000) which concerns the lawful acquisition of communications data. The IoCCO’s report highlighted a series of 12-year old correspondence between Home Office and GCHQ lawyers and a former Commissioner (from 2004) which had been disclosed as part of the aforementioned IPT case between Privacy International and a series of government departments and intelligence services (para 8.18).
On 14 May 2004, the Home Office Legal Advisor Branch (HOLAB) wanted to seek the views of the then IoCCO on their analysis of the appropriate legal framework regarding the ECHR in relation to the transfer of data from communication service providers (CSPs) to a database and the subsequent use of the said data (paras 1-3). The HOLAB were of the opinion that the transfer of data did not engage Article 1 Protocol 1 (A1P1) (para 5).
Article 1 Protocol 1(1) entitles every natural and legal person to the peaceful enjoyment of their possessions, and deprivation of such entitlement could only be justified in the public interest, subject to condition laid down law and general principles of international law. Moreover, the second limb of A1P1 maintains this does not in any way impair the right of a state to enforce such laws that it deems necessary to control the use of property in accordance with the general interest or to secure the payment of taxes or other contributions or penalties. The HOLAB suggested that it was questionable whether ownership of data constituted a property right within the ambit of A1P1. They continued that even if it did, s.94 did not interfere with the peaceful enjoyment of this right because the CSPs were not being dispossessed of such data, they were only required to make a copy, thus A1P1 was not engaged.
Further, HOLAB argued that Article 8 ECHR, which governs the right to respect for privacy and correspondence, which can only be interfered with when in accordance with the law and necessary in a democratic society, was not engaged (para 5). HOLAB notably explained that the data in question was not personal data, i.e. enabling a link to a particular individual to be established (para 6). Moreover, the HOLAB felt that the transfer and storage of data to the database did not engage Article 8. It was argued that this was so because the said data was not personal data and therefore could not be linked to an identifiable individual (para 7). Regarding the retrieval of information from the database, it was argued that this was the first point in at which Article 8 had been engaged (para 8). The HOLAB referred to the case of Malone v United Kingdom (Application No 8691/79, 2 August 1984), where the European Court of Human Rights (ECtHR) considered the practice of ‘metering.’ Metering involves the use of a device called a meter check printer which registers the numbers dialled on a particular telephone and the time and duration of each call, a process designed by the Post Office (para 56). The HOLAB referred to the judgment where the ECtHR highlighted that the release of this information to the police without the consent of the subscriber also amounted to an interference with Article 8. The HOLAB presumed this meant, once in the hands of the police, the information could be linked to an individual, and therefore amount to personal information (para 9). In summary, the HOLAB argued only access to data, and not the transfer and storage amounted to an interference with Article 8.
On 8 June 2004, the former IoCCO, Sir Swinton Thomas responded with some doubts as to whether the transfer of data to the database could survive a legal challenge unless the requirements of Chapter 2, Part 1 of RIPA 2000 were complied with. The former IoCCO also maintained doubts as to whether A1P1 was engaged nor that it mattered because of the restrictions of the right present in A1P1(1) and (2). The former IoCCO’s next point (that Article 8 is not engaged in the transfer of data to the database) seemingly contradicts his earlier reservations. It would appear that the former IoCCO’s main concern was whether the Security Services were acting ultra vires of RIPA 2000 than any possible ECHR issue. It was also felt that Article 8 became engaged at the retrieval stage.
On 22 June 2004, the HOLAB then responds highlighting that whilst Chapter 2, Part 1 may be used, this is not compulsory (para 2) and that the preference is with an s.94 direction (paras 3-5). On 6 July 2004, the former IoCCO responded and conceded that there was a ‘strong case for arguing that the procedure should only apply’ in Chapter 2 cases. Worryingly, the former IoCCO regarded the procedure in Part 2 as an inconvenience and agreed that the s.94 route could still be utilised. On 18 October 2004, GCHQ’s legal advisor responded to the former IoCCO maintaining that the automatic auditing process was sufficient to protect individual’s Article 8 rights because information could not be accessed for improper purposes (para 9). The legal advisor opined that s.94 was operated in such a way to be in accordance with the law. It continues that there was awareness that there was an arguable case of s.94 being insufficiently precise but favoured an interpretation that supported their assertion (para 13). The former IoCCO’s final response dated 17 November was in agreement with the lawfulness of s.94.
In the IoCCO’s report of s.94, they were very critical of the correspondence, first noting that it did not address the wording or genesis of s.94 or take full account of the ECHR, in particular the principle of legal certainty, or legality. The report continued that the Home Office advice did not acknowledge that the transfer and storage of the communications data from the PECN to the agency may constitute an interference with Article 8 ECHR. Moreover, the report maintained that, according to the Home Office advice, Article 8 engagement would begin at access. Yet, the report highlighted that the legal advice failed to provide an analysis as to why this would be in accordance with Article 8 or why bulk communications data was to be considered personal data. The report refers to section 5 of the Council of Europe’s 2002 “Guidelines on Human Rights and the Fight against Terrorism” (page 9) which relate to the collecting processing of personal data by any competent authority in the field of state security (para 8.25).
The IoCCO’s report highlighted that the communications data fell within the scope of personal data which was reflected in a series of government documents (which the report incorrectly describes as the “Consultation on a Code of Practice for the Voluntary Retention of Communications Data” which in actual fact was the Voluntary Code of Practice (paras 5, 6, 29) which predates the legal advice given) (paras 8.4-8.11). This therefore highlighted a disparity with government legal advice and published government policy (despite the many other authorities agreeing with this position).
It is now important to address the issue of the engagement of (or interference with) Article 8. It has been noted that the ECtHR takes the factual circumstances into account based on a non-exhaustive criteria (O Lynskey, The Foundation of EU Data Protection Law (OUP 2015) 108). The advice relied upon by the government was based on authority from Malone (see above), but what the advice failed to declare was the sentence prior noting that ‘Court does not accept, however, that the use of data obtained from metering, whatever the circumstances and purposes, cannot give rise to an issue under Article 8.’ It is therefore argued that if these sentences are read in conjunction (as they should be), any use of that said data obtained by a public authority for whatever purpose or circumstances can engage Article 8. It would be a stretch to suggest that storing this data in a database does not constitute use. Furthermore, Judge Pettiti, in his concurring opinion, acknowledged that that comprehensive metering when done so other than its sole accounting purpose, and without interception, would constitute an interference with Article 8. He further added obtaining this data would enable authorities to deduce information that was not properly meant to be within their knowledge. Most importantly, Judge Pettiti recognised that where data banks (databases) are concerned, the processing of ‘neutral’ data may be as revealing as the processing of sensitive data. To add weight to the storage of data amounting to an interference, one only needs to consider a case a few years after Malone, that of Leander v Sweden (Application No 9248/81, 27 March 1987). Here the ECtHR held that the storing and the release of such information, without allowing the opportunity to refute interfered with Article 8 (para 48). It is true that the ECtHR in that case did not make clear as to which point Article 8 was engaged (storage, release, disallowing a refute), but this was addressed in Amann v Switzerland (Application No 27798/95, 16 February 2000) where the Grand Chamber of the ECtHR concluded that ‘the storing of data relating to the “private life” of an individual falls within the application of Article 8’ (para 65). Therefore from 2000, the ECtHR’s jurisprudence on storage of data engaging Article 8 had been clear, which the government’s lawyers failed to take account of.
For the avoidance of doubt, in applying ECHR principles in the communications data context, in Copland v United Kingdom (Application No 62617/00, 3 April 2000), the ECtHR considered that the collection and storage of personal information relating to one’s telephone, as well as e-mail and internet usage, without their knowledge, amounted to an interference with Article 8 (para 44). And finally, in S and Marper v United Kingdom (Application Nos 30562/04 and 20566/04, 4 December 2008) held that the mere storage of data relating to ones private life, irrespective of subsequent use amounts to an interference with Article 8 (para 67). It is submitted that from this point on, the practice of GCHQ etc would have been untenable (though I would argue this would be the case since Amann) under the ECHR.
Regarding A1P1, even before Malone, the ECtHR had already accepted that A1P1 extended to non-physical possession as elucidated in Marckx v Belgium (Application No 6833/74, 13 June 1979, para 63). Thus the argument that data does not constitute possessions of the CSPs under A1P1 again was an incorrect interpretation of the Convention.
A brief point regarding Article 8 is of importance, because it has been established by ECHR jurisprudence that when storage of data engages Article 8, such engagement must be in accordance with the law. This stipulates that the impugned measure must have some basis in domestic law (MM v United Kingdom (Application No 24029/07, 13 November 2012, para 193)). This relates to the ‘quality of the law’ requiring it ‘to be compatible with the rule of law’ (Stafford v United Kingdom (Application No 46295/99, 28 May 2002, para 63)). The law should be accessible to the person concerned and foreseeable as to its effects (Amann (para 50)). It has been noted that publication of the law would satisfy the accessibility requirement (Leander (paras 52-53)), but in Liberty v United Kingdom (Application No 58243/00, 1 July 2008), the ECtHR maintained that no indication to the public ‘of the procedure to be followed for selecting for examination, sharing, storing and destroying’ of material would not be in accordance with the law (para 69). Therefore the unpublished procedures under a s.94 direction could not be said to be in accordance with the law because there was not even a provision for the Secretary of State to issue any Codes of Practices (para 4.14).
The title of this post derives from a quote from Richard Bacon MP (discussing the Human Rights Act 1998 (Repeal)) who noted that:
The truth is that if one wants to do something badly enough, one can find a way to do it, and to do it legally—that is precisely what one keeps clever lawyers for. Goodness, if one wants something badly enough, it turns out one can even go to war in defiance of both world opinion and international law and find a lawyer to say that it is perfectly lawful.
Although the comment related to the Iraqi war, elements of this disregard for the rule of law can be found within GCHQ’s legal advice. Despite prior ECtHR case law contradicting the advice given, the government (and successive governments) preferred the interpretation which suited GCHQ and the Security Services. Whether this legal advice was deliberate or negligent is a matter of speculation, but it demonstrates that finding a lawyer to rubberstamp an already concluded opinion is not difficult to come by.