GCHQ, MI5 and MI6 "unlawfully" collected data for over a decade

Tribunal rules GCHQ, MI5 and MI6 surveillance breached Article 8 of the ECHR

UK spy agencies broke privacy rules and illegally collected data on UK citizens for over a decade without appropriate safeguards, according to a landmark ruling by the Investigatory Powers Tribunal (IBT) released today.

Complaints were brought forward in July by human rights organisation Privacy International, claiming that GCHQ, MI5 and MI6 had breached Article 8 of the European Convention on Human Rights (ECHR).

Advertisement - Article continues below

The IBT ruling today found that the three agencies (SIAs) had unlawfully collected communications data between 1998 and 2015. This data contains the "who, when, where and how", including telephone, internet, mobile communications and location information.

It also ruled that collections of "bulk personal data", such as "considerable volumes of biographical details, commercial and financial activities, and communications and travel", were unlawfully obtained between 2003 and 2015.

Official legislation on how to lawfully collect personal data came into force in February 2015 under the SIA Bulk Personal Data Policy. Before this however, the tribunal found that the absence of safeguards breached Article 8, making personal data collection "unlawful".

Article 8 of the ECHR guarantees the right to respect for a person's "private and family life, his home, and his correspondence" and that any attempts to breach this right should be "in accordance with law".

Advertisement
Advertisement - Article continues below

Security concerns were raised by the tribunal, including the discovery of an internal memo warning staff to not use the vast data systems to search for "other members of staff, neighbours, friends, acquaintances, family members and public figures".

Advertisement - Article continues below

Given the secretive nature of the data collection, it seems "difficult to conclude that the use of bulk communication data collection was foreseeable by the public when it was not explained to Parliament", according to the IBT.

GCHQ, MI6 and MI6 argued that the use of such powers is "lawful and essential for the protection of national security".

The tribunal has stated that following the additional oversight implemented in February, personal data collection is now lawfully carried out in the UK.

However Privacy International believes safeguards are still inadequate, with a spokesperson responding to the ruling by saying: "There is no requirement for judicial or independent authorization. Supervision by a member of the executive (ie a government minister) does not provide the necessary guarantees that surveillance operations that could impact on millions of people are necessary and proportionate."

Legal representative for Privacy International, Mark Scott of Bhatt Murphy solicitors, said: "This judgment confirms that for over a decade UK security services unlawfully concealed both the extent of their surveillance capabilities and that innocent people across the country have been spied on."

Advertisement - Article continues below

In response to the ruling, the Home Office stated it is "committed" to providing greater transparency and stronger safeguards.

"We are pleased the tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes," said a Home Office spokesperson to the BBC.

The House of Lords is currently debating the final details of the Investigatory Powers Bill, aka the Snooper's Charter, which aims to create a legal framework for mass digital surveillance. This was spurred on by the Edward Snowden leaks in 2013, showing the extent of surveillance in the UK.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement
Advertisement

Recommended

Visit/security/privacy/355048/government-may-trace-covid-19-patients-using-mobile-phone-data
privacy

UK government may trace COVID-19 patients using mobile phone data

20 Mar 2020
Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/policy-legislation/general-data-protection-regulation-gdpr/354842/irish-data-regulator-racks-up
General Data Protection Regulation (GDPR)

Irish data regulator racks up GDPR cases against Big Tech

24 Feb 2020

Most Popular

Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/video-conferencing/355138/zoom-beaming-ios-user-data-to-facebook-for-targeted-ads
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/mobile/mobile-phones/355088/apple-lifts-iphone-purchase-restrictions
Mobile Phones

Apple lifts iPhone purchase restrictions

23 Mar 2020