R Privacy International v Investigatory Powers Tribunal
| Jurisdiction | England & Wales |
| Judge | Dame Victoria Sharp P |
| Judgment Date | 04 April 2022 |
| Neutral Citation | [2022] EWHC 770 (QB) |
| Docket Number | Case No: CO/4253/2018 |
| Court | Queen's Bench Division |
and
[2022] EWHC 770 (QB)
PRESIDENT OF THE QUEEN'S BENCH DIVISION
Mr Justice Johnson
Case No: CO/4253/2018
IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
DIVISIONAL COURT
Royal Courts of Justice
Strand, London, WC2A 2LL
Tom de la Mare QC, Ben Jaffey QC and Daniel Cashman (instructed by Bhatt Murphy) for the Claimant
Sir James Eadie QC, Andrew O'Connor QC and Richard O'Brien (instructed by Government Legal Department) for the Interested Parties
Angus McCullough QC and Adam Straw QC (instructed by the Special Advocates' Support Office) as Special Advocates
Hearing dates: 9 February 2022 – 10 February 2022
Further written submissions: 3 March 2022, 11 March 2022, 15 March 2022, 16 March 2022
Approved Judgment
This is the judgment of the court.
This claim concerns the regulation of sharing Bulk Personal Datasets (“BPDs”) by MI5, MI6 and GCHQ (“the Agencies”) with foreign intelligence agencies.
In a judgment dated 23 July 2018 (“the 2018 judgment”) the Investigatory Powers Tribunal (“the Tribunal”) concluded by a majority that the regulatory regime was compatible with article 8 of the European Convention of Human Rights (“ECHR”) in the period from 2015 to 2017. In particular, it concluded that adequate safeguards were in place to comply with article 8. The claimant seeks judicial review of that decision. The issue was described by the Tribunal as “a matter of the greatest importance”, in part because BPDs disclosed by the Agencies might be unlawfully used in contexts involving a risk to life (the claimant identified the possibility of rendition operations, or drone strikes).
Part of the reasoning of the Tribunal was given “in closed”: that reasoning was not published or disclosed to the claimant (save by way of an “open” summary), because the Tribunal considered that to do so would be damaging to the interests of national security.
On 8 October 2019 Supperstone J made case management directions for these proceedings. The directions made provision for the appointment of Special Advocates who could examine all of the material that was put before the Tribunal, and the entirety of the Tribunal's reasoning, and then represent the claimant's interests in closed proceedings. The Special Advocates have advanced closed arguments in support of the claimant's claim. So far as was possible, consistent with the interests of national security, extracts from the Special Advocates' closed arguments were disclosed to the claimant. Permission to claim judicial review was granted by Swift J on 22 July 2020.
We heard open submissions from Tom de la Mare QC on behalf of the claimant, and Sir James Eadie QC on behalf of the Agencies. These submissions addressed, primarily, the question of whether the Tribunal had correctly identified the safeguards that are required by article 8 for the sharing of BPDs with foreign agencies. We heard closed submissions from Angus McCullough QC as Special Advocate, and Sir James Eadie QC on behalf of the Agencies. These submissions addressed the detail of the closed evidence and the Tribunal's closed judgments, and, in particular, the Tribunal's assessment that the safeguards in place met the required standards.
In this judgment we deal with all of the arguments that have been raised, both in open and in closed, so far as it is possible to do so without disclosing material that the Tribunal treated as closed. Some of our reasoning is set out in a separate closed judgment.
Mr McCullough QC confirmed, in the course of the closed hearing, that he did not consider that the closed arguments raise any point of legal principle. Nothing in our closed judgment raises any point of legal principle. Rather, our closed judgment addresses the arguments of the Special Advocates as to the application of the legal principles to the facts.
Use of BPDs by the Agencies
Prior to March 2015 there was no public acknowledgement (“avowal”) of the use of BPDs by the Agencies. On 12 March 2015 the Intelligence and Security Committee of Parliament (“the ISC”) published a report, “Privacy and Security: A modern and transparent legal framework.” The report avows, for the first time, that the Agencies acquire and use BPDs. These are datasets that contain personal information about a large number of people. The report expresses concerns about the regulation of the acquisition and use of BPDs by the Agencies.
In a judgment dated 17 October 2016 (“the 2016 judgment”), the Tribunal sets out the following explanation of BPDs:
“(1) A Bulk Personal Dataset… is a dataset that contains personal data about individuals, the majority of whom are unlikely to be of intelligence interest, and that is incorporated into an analytical system and used for intelligence purposes. Typically, such datasets are very large, too large to be processed manually.
(2) The [Agencies] obtain and exploit BPD for several purposes:
— to help identify subjects of interest or unknown people that surface in the course of investigations;
— to establish links between individuals and groups;
— or else to improve understanding of targets' behaviour and connections;
— and to verify information obtained through other sources.
(3) BPD obtained and exploited by the [Agencies] includes a number of broad categories of data. By way of example only these include: biographical and travel (eg passport databases); communications (eg telephone directory); and financial (eg finance related activity of individuals).
(4) While each of these datasets in themselves may be innocuous, intelligence value is added in the interaction between multiple datasets. One consequence of this is that intrusion into privacy can increase.
(5) BPD is operationally essential to the [Agencies] and growing in importance and scale of holdings. Examples of the vital importance of BPD to intelligence operations include… identifying foreign fighters [and] preventing access to firearms.”
We were shown, in the closed proceedings, examples of records extracted from BPDs. We are satisfied that the above explanation is accurate and sufficiently comprehensive to encapsulate the nature of BPDs in a way that enables assessments to be made as to their capacity to impact on privacy rights.
The Tribunal summarises, in its 2016 judgment, the evidence about BPDs that was given by MI5:
“44) MI5 acknowledges that it holds the following categories of BPD:
— [Law Enforcement Agencies]/Intelligence. These datasets primarily contain operationally focussed information from law enforcement or other intelligence agencies.
— Travel. These datasets contain information which enable the identification of individuals' travel activity.
— Communications. The datasets allow the identification of individuals where the basis of information held is primarily related to communications data, eg a telephone directory.
— Finance. These datasets allow the identification of finance related activity of individuals.
— Population. These datasets provide population data or other information which could be used to help identify individuals, eg passport details.
— Commercial. These datasets provide details of corporations/individuals involved in commercial activities.
45) A number of these datasets will be available to the public at large. Some of these publicly available datasets will be sourced from commercial bodies, and we will pay for them (as another public body or a member of the public could do). MI5 also acquired BPD from Government departments, from [MI6] and GCHQ and from law enforcement bodies.
46) MI5's holding of passport information is key to our ability to be able to investigate travel activity. Holding that data in bulk, and being able to cross-match this to other data and other BPD held, is what enables us to find the connection and ‘join the dots.’ That would simply not be possible if we did not hold the bulk data in the first place. Using travel data, for example, to try and establish the travel history of a particular individual will necessarily involve holding, and searching across a range of BPD and other data that we hold, and it is through fusing these that we are able to resolve leads and identify particular individuals, with high reliability, at pace and with minimum intrusion.
47) Holding the data in bulk (and holding data relating to persons not of intelligence interest) is an inevitable and necessary prerequisite to being able to use these types of dataset to make the right connections between disparate pieces of information. Without the haystack one cannot find the needle; and the same result cannot be achieved (without fusion/combination) through carrying out a series of individual searches or queries of a particular dataset (or a number of datasets).
48) It is also relevant to note that as BPDs are searched electronically there was inevitably significantly less intrusion into individuals' privacy, as any data which has not produced a ‘hit’ will not be viewed by the human operator of the system, but only searched electronically.”
The following facts were agreed between the parties in the proceedings before the Tribunal:
“(i) GCHQ, MI5 and MI6 collect and hold BPDs, on their respective analytical systems.
(ii) BPDs consist of large amounts of personal data: The majority of individuals whose personal data is contained in a BPD will be of no intelligence interest.
(iii) Multiple BPDs are analysed together to obtain search results.
(iv) BPD may be acquired through overt and covert channels.
(v) BPD can contain sensitive personal data as...
To continue reading
Request your trial