Before:
LORD JUSTICE SINGH, PRESIDENT LORD JUSTICE EDIS
and
MRS JUSTICE LIEVEN
———————
Between:
PRIVACY INTERNATIONAL
Claimant
-v-
(1) SECRETARY OF STATE FOR FOREIGN AND COMMONWEALTH AFFAIRS
(2) SECRETARY OF STATE FOR THE HOME DEPARTMENT
(3) GOVERNMENT COMMUNICATIONS HEADQUARTERS
(4) SECURITY SERVICE
(5) SECRET INTELLIGENCE SERVICE
Respondents
———————
———————
Tom de la Mare QC, Ben Jaffey QC and Daniel Cashman (instructed by Bhatt Murphy) for the Claimant
Robert Palmer QC, Richard O’Brien and John Bethell (instructed by Treasury Solicitor) for the Respondents
Mr J Glasson QC and Ms Sarah Hannett QC (instructed by Treasury Solicitor) appeared as Counsel to the Tribunal
Hearing date: 21 July 2021
———————
JUDGMENT
Lord Justice Singh:
The 1984 Act
5. Section 94 of the 1984 Act, as it was at the material time (from 2003 to 2019), provided as follows:
“(1) The Secretary of State may, after consultation with a person to whom this section applies, give to that person such directions of a general character as appears to the Secretary of State to be necessary in the interests of national security or relations with the government of a country or territory outside the United Kingdom.
(2) If it appears to the Secretary of State to be necessary to do so in the interests of national security or relations with the government of a country or territory outside the United Kingdom, he may, after consultation with a person to whom this section applies, give to that person a direction requiring him (according to the circumstances of the case) to do, or not to do, a particular thing specified in the direction.
(2A) The Secretary of State shall not give a direction under subsection (1) or (2) unless he believes that the conduct required by the direction is proportionate to what is sought to be achieved by that conduct.
(3) A person to whom this section applies shall give effect to any direction given to him by the Secretary of State under this section notwithstanding any other duty imposed on him by or under Part 1 or Chapter 1 of Part 2 of the Communications Act 2003 and, in the case of a direction to a provider of a public electronic communications network, notwithstanding that it relates to him in a capacity other than as the provider of such a network.
(4) The Secretary of State shall lay before each House of Parliament a copy of every direction given under this section unless he is of [the] opinion that disclosure of the direction is against the interests of national security or relations with the government of a country or territory outside the United Kingdom, or the commercial interests of any person.
(5) A person shall not disclose, or be required by virtue of any enactment or otherwise to disclose, anything done by virtue of this section if the Secretary of State has notified him that the Secretary of State is of the opinion that disclosure of that thing is against the interests of national security or relations with the government of a country or territory outside the United Kingdom, or the commercial interest of some other person.
…
(8) This section applied to [the Office of Communications (OFCOM)] and to providers of public electroniccommunications networks.”
6. The relevant provisions were repealed by the Investigatory Powers Act 2016 with effect from 22 February 2019.
7. Section 21 of the Regulation of Investigatory Powers Act 2000 (“RIPA”) defines “communications data” in subsections (4) and (6). That term includes “traffic data” but does not include the content of communications.
The reference to the CJEU
8. In its request for a preliminary ruling the Tribunal set out the relevant factual context at paras. 6-17. It also made relevant findings of fact as follows at para. 59:
“The relevant findings of fact as determined by this Tribunal are as follows:
i. The SIAs’ capabilities to use BCD supplied to them are essential to the protection of the national security of the United Kingdom, including in the fields of counter- terrorism, counter-espionage and counter-nuclear proliferation. We accept and agree with the evidence described in paragraphs 10 to 16 above;
ii. In particular, a fundamental feature of the SIAs’ use of BCD is to discover previously unknown threats to national security by means of non-targeted bulk techniques which are reliant upon the aggregation of the BCD in one place. Its principal utility lies in swift identification and development, as well as providing a basis for action in the face of imminent threat;
iii.The provider of an electronic communications network does not retain the BCD (beyond the period of their ordinary business requirements). The BCD is retained by the State (the SIAs) alone;
iv. The use of BCD and automated processing produces less intrusion than other means of obtaining information, and the degree of intrusion as a result of electronic searching of BCD should not be overstated;
v. The safeguards surrounding the use of BCD by the SIAs are now, subject to the reserved issues, consistent with the requirements of the ECHR, and are sufficient to prevent abuse;
vi. The imposition of the Watson Requirements if applicable, would critically undermine the ability of the SIAs to safeguard national security, and thereby put the national security of the United Kingdom at risk.”
9. The two questions which were referred to the CJEU were framed as follows:
“In circumstances where:
a. the SIAs’ capabilities to use BCD supplied to them are essential to the protection of the national security of the United Kingdom, including in the fields of counter- terrorism, counter-espionage and counter-nuclear proliferation;
b. a fundamental feature of the SIA’s use of the BCD is to discover previously unknown threats to national security by means of non-targeted bulk techniques which are reliant upon the aggregation of the BCD in one place. Its principal utility lies in swift target identification and development, as well as providing a basis for action in the face of imminent threat;
c. the provider of an electronic communications network is not thereafter required to retain the BCD (beyond the period of their ordinary business requirements), which is retained by the State (the SIAs) alone;
d. the national court has found (subject to certain reserved issues) that the safeguards surround the use of BCD by the SIAs are consistent with the requirements of the ECHR; and
e. the national court has found that the imposition of the requirements specified in §§119-125 of the judgment of the Grand Chamber in joined cases C-203/15 and C- 698/15 Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v Watson and Others (ECLI:EU:C:2016:970) (‘the Watson Requirements’), if applicable, would frustrate the measures taken to safeguard national security by the SIAs, and thereby put the national security of the United Kingdom at risk;
1. Having regard to Article 4 TEU and Article 1(3) of Directive 2002/58/EC on privacy and electronic communications (the ‘e-Privacy Directive’), does a requirement in a direction by a Secretary of State to a provider of an electronic communications network that it must provide bulk communications data to the Security and Intelligence Agencies (‘SIAs’) of a Member State fall within the scope of Union law and of the e-Privacy Directive?
2. If the answer to Question (1) is ‘yes’, do any of the Watson Requirements, or any other requirements in addition to those imposed by the ECHR, apply to such a direction by a Secretary of State? And, if so, how and to what extent do those requirements apply, taking into account the essential necessity of the SIAs to use bulk acquisition and automated processing techniques to protect national security and the extent to which such capabilities, if otherwise compliant with the ECHR, may be critically impeded by the imposition of such requirements?”
Judgment of the CJEU
10. On 6 October 2020 the Grand Chamber of the CJEU gave its judgment in the request for a preliminary ruling: C/623/17.
11. It addressed question 1 at paras. 30-49 and answered that question as follows, at para. 49:
“Having regard to the foregoing considerations, the answer to the first question is that Article 1(3), Article 3 and Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU, must be interpreted as meaning that national legislation enabling a State authority to require providers of electronic communications services to forward traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security falls within the scope of that directive.”
12. The CJEU addressed question 2 at paras. 50-82 and answered that question as follows at para. 82:
“In the light of all the foregoing considerations, the answer to the second question is that Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter, must be interpreted as precluding national legislation enabling a State authority to require providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security.”
The Claimant’s submissions
13. On behalf of the Claimant it is submitted that the CJEU has left no room for doubt that the BCD regime falls within the scope of EU law. The BCD regime imposed a processing obligation on telecommunications providers to provide communications data in circumstances which therefore required justification under Article 15(1) of the e-Privacy Directive.
14. It is submitted that the Tribunal is therefore obliged to revisit the preliminary conclusions which were expressed in its second judgment.
15. It is further submitted on behalf of the Claimant that the CJEU has found that the BCD regime in section 94 of the 1984 Act was incompatible with EU law. The wording of section 94 was exceptionally broad. It permitted directions to be made under which general and indiscriminate transmission of communications data was required. The legislation did not lay down either the substantive or procedural conditions governing the use of BCD. It did not rely on “objective criteria” in order to define the circumstances and conditions under which the security and intelligence agencies were to be granted access to that data. It could not therefore be shown that section 94 was “strictly necessary”. Relying on other cases which were decided on the same date as this case by the CJEU, Joined Cases C-511/18, C-512/18 and C-520/18, La Quadrature & Ors, the Claimant submits that any permissible legislative measure must
(1) be limited to situations where the member State is confronted with a serious threat to national security which is shown to be genuine and present or foreseeable;
(2) provide for the decision imposing such an instruction to be subject to effective review, either by a court or by an independent administrative body whose decision is binding, to verify that such a situation exists and that the conditions and safeguards which must be laid down are observed;
(3) it must be limited in time to what is strictly necessary; and
(4) it must ensure by means of clear and precise rules that there is compliance with the applicable substantive and procedural conditions and that the persons concerned have effective safeguards against the risks of abuse.
16. At the material time the Secretary of State alone could give the relevant authorisation that was required. Clearly she could not be described as independent of the requesting authority.
17. In conclusion therefore it is submitted on behalf of the Claimant that the BCD regime was unquestionably unlawful under EU law and the Tribunal is invited to give judgment to reflect that.
The Respondents’ submissions
18. On behalf of the Respondents it is now accepted that, on the CJEU’s analysis, section 94 directions did fall within the scope of EU law.
19. The Respondents also accept that section 94 was not compliant with EU law in the following ways. First, the legislative scheme did not provide for sufficiently clear and precise rules governing the scope and application of section 94. The legislative scheme was broadly framed and permitted the Secretary of State to give directions of either a general or a specific character. The only pre- conditions set down in the legislation were that (1) the Secretary of State had to consult the providers concerned; (2) the directions appeared to the Secretary of State to be necessary in the interests of national security or relations with the government of a country or territory outside the UK; and (3) the Secretary of State believed the conduct directed to be proportionate to what was sought to be achieved thereby. It is accepted that these were inadequate for the purposes of EU law.
20. Secondly, the legislative scheme did not provide for any limit to the duration of any directions. Although there were internal handling arrangements requiring a review at intervals of no less than six months, the direction did not automatically expire by virtue of a legislative limit.
21. Thirdly, the legislative scheme did not require that any direction should be subject to review by a court or an independent administrative authority whose decision was binding.
22. However, the Respondents submit that there are three important caveats. First, the CJEU did not consider whether any data acquired had in fact exceeded the bounds of what might properly have been authorised under a statutory scheme that did comply with the requirements of EU law. The national court (in other words this Tribunal) alone is responsible for determination of factual matters.
23. Secondly, still less did the CJEU express any general view about the lawfulness of bulk acquisition as a national security technique in the abstract. “Bulk” powers should not be conflated with “general and indiscriminate” powers.
24. Thirdly, in the related case of La Quadrature, the CJEU rejected the suggestion that there was an absolute requirement to disregard traffic and location data obtained in breach of EU law, even in the context of a criminal prosecution: see paras. 221-227.
25. Further, the Respondents note that the issue of remedies has already been stayed pursuant to the Tribunal’s earlier orders until other matters have been resolved in these proceedings. That said, the Respondents are content for the Tribunal to state in its judgment, or grant a declaration, that section 94 of the 1984 Act was incompatible with EU law in the respects set out at para. 16 of their Skeleton Argument for this hearing, which we have sought to summarise above.
26. On behalf of the Claimant, it was accepted at the hearing before us by Mr de la Mare QC that the incompatibility in the legislation did indeed arise in substance from the features set out at para. 16 of the Respondents’ Skeleton Argument.
27. At the hearing a point was also raised by Mr de la Mare about the consequences for sharing arrangements with foreign agencies and others. This was a topic which was dealt with by the Tribunal in its third judgement: [2018] UKIPTrib IPT_15_110_CH, at paras. 61ff. In his reply, however, Mr de la Mare accepted that this is one of those topics which will have to be considered at a later stage in these proceedings.
Conclusion
28. In the circumstances, we endorse what is in substance the agreed position of the parties. In the light of the judgment of the CJEU, which is binding on this Tribunal, it is now clear that section 94 of the 1984 Act was incompatible with EU law. We will grant a declaration to that effect. Anyone wishing to know the reasons for that incompatibility will find them in this judgment, which has summarised earlier what is said at para. 16 of the Respondents’ Skeleton Argument.
29. We would stress that we have not today decided what the consequences of that declaration are. That remains a matter of dispute between the parties and will be considered at a later stage, when the more general issue of remedies in this case is considered by the Tribunal.
30. Pursuant to section 67A of RIPA there is a right to apply for leave to appeal this decision. The Tribunal hereby specifies, in accordance with s.67A(2) of RIPA that, in the event of an appeal, the relevant appellate court in this case is the Court of Appeal of England and Wales.
31. An appeal is possible only in respect of a point of law that raises an important point of principle or practice (or for other compelling reasons) and is not a decision on a procedural matter. An appeal requires permission so an application must first be made to the Tribunal for leave to appeal.
32. The Rules contain detailed provisions in relation to making an application for leave to appeal which are contained in Rule 16 of the Rules. The Rules are available from the Tribunal’s website https://www.ipt-uk.com/