Court of Appeal rules surveillance data should be restricted

In January 2018, the Court of Appeal delivered judgment in a case regarding the Government’s “Snooper’s Charter” provisions, found in the Data Retention and Investigatory Powers Act 2014, and in the Investigatory Powers Act 2016.

ORG’s role

In 2014, MPs David Davis and Tom Watson brought a legal challenge requesting a judicial review of the Data Retention and Investigatory Powers Act 2014 (DRIPA). In requesting a judicial review, they intended to ask the court to order a judge to review the lawfulness of the provisions of the act.

DRIPA was an act which aimed to give authorisation to much of the surveillance activities of GCHQ and other intelligence services. Up until this act those activities had no legal justification.

Although DRIPA expired at the end of December 2016, much of the wording of DRIPA was incorporated into Part 4 of the Investigatory Powers Act 2016 (IPA), which is currently in force. In particular, DRIPA’s provisions allowing for the mass retention of communications data are very similar to those in the IPA. A court decision ruling such provisions unlawful would apply to the IPA and to future legislation.

Davis and Watson launched their legal challenge in July 2014, and ORG joined the case as interveners along with Privacy International a few months later. Both ORG and PI have been involved in proceedings since then.

Judgment

Initially, the High Court agreed with Davis and Watson, ruling Sections 1 and 2 of the act to be unlawful. The Government immediately appealed against this decision, taking the case to the Court of Appeal.

The Court of Appeal disagreed with the High Court’s ruling and asked the Court of Justice of the European Union (CJEU) to confirm whether the judgment that the CJEU had delivered in a previous case should also be applied to the challenge against DRIPA.

In December 2016, the CJEU delivered a damning blow for the UK Government, ruling that mass surveillance was incompatible with EU law. It outlined a number of steps that the Government would need to take before such a surveillance regime could be considered lawful.

In January 2018, the Court of Appeal handed down their final judgment in the case, with the following notable points:

• Surveillance data retained for the purposes of fighting crime should be restricted to “serious crime”; and
• Access to retained data must be approved by a court or other administrative body.

The court also refused to rule on a number of points which it noted were the subject of ongoing litigation at the time of the judgment. Namely:

• The Court refused to rule on the issue of whether the judgment of the CJEU applied to “national security”, noting that this would be ruled on in an ongoing case brought by Privacy International in the Investigatory Powers Tribunal;
• The Court noted that the issue of whether collected data must be retained within the EU was also to be decided in Privacy International’s Investigatory Powers Tribunal Challenge;
• The Court considered the question of whether people were eligible to be notified that they had been surveilled at a time when notification would no longer pose a risk to ongoing investigations. Again, it concluded that this would be an issue in the ongoing Privacy International case.
• Finally, the Court considered whether it was able to rule on the question of whether data retained for security purposes could only be retained in cases where a specific person or set of people could be linked to serious criminal offences and the data could be reasonably assumed to assist in the prevention of such offences. The Court determined that this issue would be addressed in Liberty’s ongoing challenge against the Investigatory Powers Act.

For more details, please see this wiki page.