“Article 8 Right to Respect for Private and Family Life 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.” and “Article 10 Freedom of Expression 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.”
“In assessing whether the respondent State acted within its margin of appreciation (see paragraph 347 above), the Court would need to take account of a wider range of criteria than the six Weber safeguards. More specifically, in addressing jointly “in accordance with the law” and “necessity” as is the established approach in this area (see Roman Zakharov, cited above, § 236 and Kennedy, cited above, § 155), the Court will examine whether the domestic legal framework clearly defined: the grounds on which bulk interception may be authorised; the circumstances in which an individual’s communications may be intercepted; the procedure to be followed for granting authorisation; the procedures to be followed for selecting, examining and using intercept material; the precautions to be taken when communicating the material to other parties; the limits on the duration of interception, the storage of intercept material and the circumstances in which such material must be erased and destroyed; the procedures and modalities for supervision by an independent authority of compliance with the above safeguards and its powers to address non-compliance; the procedures for independent ex post facto review of such compliance and the powers vested in the competent body in addressing instances of non-compliance.”
“425. Nonetheless, the Court recalls that there is considerable potential for bulk interception to be abused in a manner adversely affecting the rights of individuals to respect for private life (see paragraph 347 above). Therefore, in a State governed by the rule of law, which is expressly mentioned in the Preamble to the Convention and is inherent in the object and purpose of Article 8 (see Roman Zakharov, cited above, § 228), the Court considers that, when viewed as a whole, the section 8(4) regime, despite its safeguards, including some robust ones as highlighted above (see, for example, paragraphs 412 and 415 above), did not contain sufficient “end-to-end” safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse. In particular, it has identified the following fundamental deficiencies in the regime: the absence of independent authorisation, the failure to include the categories of selectors in the application for a warrant, and the failure to subject selectors linked to an individual to prior internal authorisation (see paragraphs 377-382 above). These weaknesses concerned not only the interception of the contents of communications but also the interception of related communications data (see paragraph 416 above). While the IC Commissioner provided independent and effective oversight of the regime, and the IPT offered a robust judicial remedy to anyone who suspected that his or her communications had been intercepted by the intelligence services, these important safeguards were not sufficient to counterbalance the shortcomings highlighted at paragraphs 377-382 above. 426. In view of the aforementioned shortcomings, the Court finds that section 8(4) did not meet the “quality of law” requirement and was therefore incapable of keeping the “interference” to what was “necessary in a democratic society.” 427. There has accordingly been a violation ofArticle 8 of the Convention .”
“18. The threats to security which the United Kingdom and members of the public face are well known and hardly need evidence, although there is plenty of such evidence which has been placed before this court: see in particular the first witness statement of James Dix, acting Head of the Investigatory Powers Unit in the Office for Security and Counter-terrorism at the Home Office. By way of example, in 2017 there were five terrorist attacks, in London and Manchester, which resulted in 36 deaths. The organisations Daesh (sometimes called "Islamic State" or "ISIL") and Al Qa'ida continue to pose threats to British nationals and others around the world. There is an increasing threat from far-right extremism. Further, this country faces "sustained hostile activity from certain states": see a speech given by the Director General of MI5 (Sir Andrew Parker) in Berlin on14 May 2018 , quoted at para 15 of Mr Dix's first witness statement. 19. In addition, there is an acknowledged need to support the investigation and punishment of serious organised crime, including offences against children. It is also well known that those who would wish to do harm to this country and its inhabitants are increasingly able to make use of encryption and the "dark web", which Mr Dix describes, at para 20 of his first witness statement, as "a space in which information can be exchanged anonymously beyond the reach of law enforcement". 20. Against that background, Mr Dix expresses the following opinion to this court at para 24 of his first witness statement: "The investigatory powers under challenge in this claim make a very significant contribution to tackling the kind of threats set out above: indeed, they are essential for doing so." At para 28 he tells this court that the use of bulk data is among the few effective methods to counter the illicit use of the dark web. Further, as he points out at para 29, in certain parts of the world the United Kingdom has no physical presence, so there are often no initial intelligence leads on emerging threats, whether from terrorists, serious criminals or state-based threats: "Bulk powers allow security and intelligence agencies to identify and map out known and evolving networks, in turn enabling further intelligence gathering on likely threats." 21. Finally, in this context, it is important to note that the situation can often be a "dynamic" one. At para 30 of his first witness statement Mr Dix states that: "Bulk powers also allow the security and intelligence agencies to respond at pace, quickly identifying threats and ruling individuals in or out of investigations. Bulk powers are made more important by the fact that terrorist threats are increasingly diverse in nature and can escalate with increasing speed through the use of the internet to radicalise supporters and plan and execute attacks." 22. The utility of bulk powers is illustrated by the fact that, as Mr Dix says at para 32: "Bulk data analysis has played a significant part in every major counter terrorism investigation over the last decade, including in each of the seven terrorist attack plots disrupted between 2014 and the publication of the Operational Case in 2016." (That is a reference to the Government's operational case for bulk powers, which was published during the passage of the Investigatory Powers Bill.) 23. Mr Dix states at para 33 of his first witness statement that, before the 2016 Act, many similar powers, including bulk powers, could be found in a range of different statutes, in particular the following: (1) Powers to intercept communications, including in bulk, were provided for in Part 1, Chapter I of RIPA . (2) Equipment interference was provided for in powers contained in theIntelligence Services Act 1994 and thePolice Act 1997 . (3) Bulk personal datasets could be acquired using information gathering powers in theIntelligence Services Act 1994 ("ISA") and theSecurity Services Act 1989 ; and processes for their retention and examination were set out in published agency handling arrangements. (4) Retention of communications data was provided for in theData Retention and Investigatory Powers Act 2014 (as amended by theCounter-terrorism and Security Act 2015 ) and theAnti-terrorism, Crime and Security Act 2001 . (5) The targeted acquisition of communications data was primarily provided for in Part 1, Chapter II, of RIPA . (6) Bulk acquisition of communications data was provided for in theTelecommunications Act 1984 . 24. Prior to the Investigatory Powers Bill, Mr Dix states (at para 34) that there were three reviews of investigatory powers undertaken. The first was A Question of Trust (June 2015 by David Anderson QC, who was at that time the Independent Assessor of Terrorism Legislation and is now Lord Anderson of Ipswich QC). In March 2015 there was the Report on Privacy and Security by the Intelligence and Security Committee of Parliament ("ISC"). In July 2015 there was a report by a panel convened by the Royal United Services Institute ("RUSI"). Mr Dix states that all three reviews agreed that the use of the existing complement of investigatory powers remained vital to the UK's national security and other interests. They made 198 recommendations as to the way in which these powers should be overseen. He says, at para 36, that the central recommendation by Lord Anderson in A Question of Trust was that: "A comprehensive and comprehensible new law should be drafted from scratch, replacing the multitude of current powers and providing for clear limits and safeguards on any intrusive powers that it may be necessary for the public authorities to use." (Executive summary, para 10.) 25. During the passage of the 2016 Act through Parliament there was pre-legislative scrutiny by three committees: the House of Commons Science and Technology Committee, which produced a report entitled "Investigatory Powers Bill: Technology Issues" in January 2016; the ISC, which produced a report on the Bill in 2016; and a report by the Joint Committee on the Bill produced in February 2016. The Joint Committee alone took 2,364 pages of written evidence and transcripts of oral evidence from stakeholders across society. The Joint Committee recommended that the Government should publish a fuller justification for each of the bulk powers alongside the Bill (recommendations 23 and 28). This was done in the Operational Case for Bulk Powers. The Government also published an amended operational case for the retention of internet connection records following a recommendation from the Joint Committee. 26. The Investigatory Powers Bill was introduced in Parliament on1 March 2016 , having been previously published in draft form for pre-legislative scrutiny. The Government published its own formal response to that scrutiny. 27. Furthermore, at the same time as the Bill was introduced, draft codes of practice were published so that Parliament would have the opportunity to consider those alongside the Bill. 28. The Government also commissioned the Independent Reviewer of Terrorism Legislation to conduct a detailed review of the operational case for bulk powers, which was published by Lord Anderson as the "Report of the Bulk Powers Review" in August 2016. 29. The Government itself also published an operational case for use of communications data by public authorities. 30. The new regime introduced by the 2016 Act is now largely operational, with the majority of the powers under the Act having been brought into force during the course of 2018. The provisions relating to equipment interference and interception were commenced for the intelligence services on27 June 2018 , with interception for law enforcement commenced on26 September 2018 and equipment interference on5 December 2018 . A commencement order in respect of the bulk communications data and bulk personal dataset provisions was made on18 July 2018 , and the provisions concerning the issuing of warrants came into force on22 August 2018 . The final part of the Act to be commenced was Part 3, which was commenced on5 February 2019 . 31. In the meantime, earlier, in 2017, there had been established the office of the IPC. The 2016 Act requires the IPC to be a person who holds or has held high judicial office. The first and current IPC is Sir Adrian Fulford, who is a serving Lord Justice of Appeal. The current IPC is Sir Brian Leveson, former President of the Queen’s Bench Division and a former Lord Justice of Appeal. His deputy is Sir John Goldring, a former Lord Justice of Appeal. He has a staff of some 50 people, including those with technical expertise. His office includes 15 judicial commissioners ("JCs"), who also have to be persons who hold or have held high judicial office: they include retired members of the High Court, the Court of Appeal and the Supreme Court. The IPC's deputy is Sir John Goldring, a retired member of the Court of Appeal. 32. In addition, in anticipation of the full implementation of Part 3 of the Act, which is expected to occur by the end of 2019, there has been created the Office for Communications Data Authorisations ("OCDA"), which is under the remit of the IPC. 33. In the view of many commentators the most significant and innovative provision in the 2016 Act is the creation of a "double lock" for warrants authorising use of certain intrusive powers. Where this applies the Act requires that an independent JC must approve the decision of the Secretary of State (or, where relevant, Scottish Minister/law enforcement chief). The UN Special Rapporteur on the Right to Privacy (Joseph Cannataci), following a visit to the UK, observed in his "end of mission statement" that this element of judicial review "assisted by a better-resourced team of experienced inspectors and technology experts is one of the most significant safeguards introduced by the IPA ": see his report of June 2018, p 2.”
“1 Overview of Act (1) This Act sets out the extent to which certain investigatory powers may be used to interfere with privacy. (2) This Part imposes certain duties in relation to privacy and contains other protections for privacy. (3) These other protections include offences and penalties in relation to— (a) the unlawful interception of communications, and (b) the unlawful obtaining of communications data. (4) This Part also abolishes and restricts various general powers to obtain communications data and restricts the circumstances in which equipment interference, and certain requests about the interception of communications, can take place. (5) Further protections for privacy— (a) can be found, in particular, in the regimes provided for by Parts 2 to 7 and in the oversight arrangements in Part 8, and (b) also exist— (i) by virtue of theHuman Rights Act 1998 , ….. (vi) elsewhere in the law. (6) The regimes provided for by Parts 2 to 7 are as follows— (a) Part 2 and Chapter 1 of Part 6 set out circumstances (including under a warrant) in which the interception of communications is lawful and make further provision about the interception of communications and the treatment of material obtained in connection with it, (b) Part 3 and Chapter 2 of Part 6 set out circumstances in which the obtaining of communications data is lawful in pursuance of an authorisation or under a warrant and make further provision about the obtaining and treatment of such data, (c) Part 4 makes provision for the retention of certain communications data in pursuance of a notice,” (d) Part 5 and Chapter 3 of Part 6 deal with equipment interference warrants, and (e) Part 7 deals with bulk personal dataset warrants. (7) As to the rest of the Act— (a) Part 8 deals with oversight arrangements for regimes in this Act and elsewhere, and (b) Part 9 contains miscellaneous and general provisions including amendments to sections 3 and 5 of theIntelligence Services Act 1994 and provisions about national security and combined warrants and authorisations.”
“(2) The public authority must have regard to— (a) whether what is sought to be achieved by the warrant, authorisation or notice could reasonably be achieved by other less intrusive means, (b) whether the level of protection to be applied in relation to any obtaining of information by virtue of the warrant, authorisation or notice is higher because of the particular sensitivity of that information, (c) the public interest in the integrity and security of telecommunication systems and postal services, and (d) any other aspects of the public interest in the protection of privacy. (3) The duties under subsection (2)— (a) apply so far as they are relevant in the particular context, and (b) are subject to the need to have regard to other considerations that are also relevant in that context. (4) The other considerations may, in particular, include— (a) the interests of national security or of the economic well-being of the United Kingdom, (b) the public interest in preventing or detecting serious crime, (c) other considerations which are relevant to— (i) whether the conduct authorised or required by the warrant, authorisation or notice is proportionate, or (ii) whether it is necessary to act for a purpose provided for by this Act, (d) the requirements of theHuman Rights Act 1998 , and (e) other requirements of public law. (5) For the purposes of subsection (2)(b), examples of sensitive information include— (a) items subject to legal privilege, (b) any information identifying or confirming a source of journalistic information, and (c) relevant confidential information within the meaning given by paragraph 2(4) of Schedule 7 (certain information held in confidence and consisting of personal records, journalistic material or communications between Members of Parliament and their constituents).”
“140 Approval of warrants by Judicial Commissioners (1) In deciding whether to approve a decision to issue a warrant under section 138, a Judicial Commissioner must review the Secretary of State's conclusions as to the following matters— (a) whether the warrant is necessary as mentioned in subsection (1)(b) of that section, (b) whether the conduct that would be authorised by the warrant is proportionate to what is sought to be achieved by that conduct, (c) whether— (i) each of the specified operational purposes (see section 142) is a purpose for which the examination of intercepted content or secondary data obtained under the warrant is or may be necessary, and (ii) the examination of intercepted content or secondary data for each such purpose is necessary as mentioned in section 138(1)(d)(ii), and (d) any matters taken into account in accordance with section 139. (2) In doing so, the Judicial Commissioner must— (a) apply the same principles as would be applied by a court on an application for judicial review, and (b) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy). …..” …..”
“142 Requirements that must be met by warrants” (1) A bulk interception warrant must contain a provision stating that it is a bulk interception warrant. (2) A bulk interception warrant must be addressed to the head of the intelligence service by whom, or on whose behalf, the application for the warrant was made. (3) A bulk interception warrant must specify the operational purposes for which any intercepted content or secondary data obtained under the warrant may be selected for examination. (4) The operational purposes specified in the warrant must be ones specified, in a list maintained by the heads of the intelligence services (“the list of operational purposes”), as purposes which they consider are operational purposes for which intercepted content or secondary data obtained under bulk interception warrants may be selected for examination. (5) The warrant may, in particular, specify all of the operational purposes which, at the time the warrant is issued, are specified in the list of operational purposes. (6) An operational purpose may be specified in the list of operational purposes only with the approval of the Secretary of State. (7) The Secretary of State may give such approval only if satisfied that the operational purpose is specified in a greater level of detail than the descriptions contained in section 138(1)(b) or (2). (8) At the end of each relevant three-month period the Secretary of State must give a copy of the list of operational purposes to the Intelligence and Security Committee of Parliament. (9) In subsection (8) “relevant three-month period” means— (a) the period of three months beginning with the day on which this section comes into force, and (b) each successive period of three months. (10) The Prime Minister must review the list of operational purposes at least once a year. (11) In this Chapter “the specified operational purposes”, in relation to a bulk interception warrant, means the operational purposes specified in the warrant in accordance with this section.”
“(a) relate to a particular operator or any description of operators, (b) require the retention of all data or any description of data, (c) identify the period or periods for which data is to be retained, (d) contain other requirements, or restrictions, in relation to the retention of data, (e) make different provision for different purposes, (f) relate to data whether or not in existence at the time of the giving, or coming into force, of the notice.”
“(a) that it is necessary for the relevant public authority to obtain communications data for a purpose falling within subsection (7), (b) that it is necessary for the relevant public authority to obtain the data— (i) for the purposes of a specific investigation or a specific operation, or (ii) for the purposes of testing, maintaining or developing equipment, systems or other capabilities relating to the availability or obtaining of communications data, and (c) that the conduct authorised by the authorisation is proportionate to what is sought to be achieved.”
“101 Subject-matter of warrants” (1) A targeted equipment interference warrant may relate to any one or more of the following matters— (a) equipment belonging to, used by or in the possession of a particular person or organisation; (b) equipment belonging to, used by or in the possession of a group of persons who share a common purpose or who carry on, or may carry on, a particular activity; (c) equipment belonging to, used by or in the possession of more than one person or organisation, where the interference is for the purpose of a single investigation or operation; (d) equipment in a particular location; (e) equipment in more than one location, where the interference is for the purpose of a single investigation or operation; (f) equipment which is being, or may be, used for the purposes of a particular activity or activities of a particular description; (g) equipment which is being, or may be, used to test, maintain or develop capabilities relating to interference with equipment for the purpose of obtaining communications, equipment data or other information; (h) equipment which is being, or may be, used for the training of persons who carry out, or are likely to carry out, such interference with equipment.”
“149. Very importantly, in our view, the warrant must also be authorised by a [Judicial Commissioner]. As we have already seen [Judicial Commissioners] must be persons who hold or have held a high judicial office, in other words at least a High Court judge. The IPC himself is currently a serving Lord Justice of Appeal. 150. The requirement for approval of a warrant by a JC is part of the so called "double-lock" system which the 2016 Act introduced. There was no such system under previous legislation such as RIPA, which was the subject of the judgment of the First Section in Big Brother Watch. 151. Furthermore, as is apparent from the overview at paras 109-120, the [Judicial Commissioners] have a number of other important functions, including oversight by way of audit, inspection and investigation. In our view, these are important safeguards which have been introduced by the 2016 Act. They are to be seen as part of the overall, interlocking structure which the Act has created.”
“215. The decision to issue either a class BPD warrant or a specific BPD warrant must be taken by the Secretary of State personally (section 211) and is subject to prior approval by a [Judicial Commissioner], except where the Secretary of State considers there is an "urgent need" for a specific BPD warrant to be issued (sections 204(3)(e), 205(b) (e) and 208). Where a specific BPD warrant is issued without prior [Judicial Commissioner] approval because of urgent need, the Secretary of State must inform a [Judicial Commissioner] that the warrant has been issued and, within three working days, the [Judicial Commissioner] must decide whether or not to approve that decision. In the event of a refusal to approve the warrant, it ceases to have effect (section 209). The [Judicial Commissioner] may direct the destruction of data retained under the warrant or impose conditions as to the use or retention of such data (section 210). 216. A class BPD warrant authorises the retention or examination of any BPD falling within a class described in the warrant; whereas a specific BPD warrant authorises the retention or examination of any BPD described in that document. Neither type of BPD warrant may be issued (or approved) unless both the Secretary of State and the JC consider that it is necessary on the grounds of national security, for the prevention or detection of serious crime, or in the interests of the economic well-being of the UK in so far as those interests are also relevant to national security. They must also be satisfied that the operational purposes specified in the application for the warrant are purposes for which examination of the BPD described is or may be necessary, and that such examination is necessary on any of the grounds upon which the warrant is considered necessary. In addition, both the Secretary of State and the [Judicial Commissioner] must be satisfied that the conduct authorised by a warrant would be proportionate to what is sought to be achieved (see sections 204(3), 205(6) and 208(1) and (2) ). 217. Furthermore, the general duties in relation to privacy in section 2 are engaged. Thus, the Secretary of State and the [Judicial Commissioner] must consider whether what is sought to be achieved by the warrant could be achieved by other less intrusive means. They must also consider any aspect of the public interest in the protection of privacy (section 2(2)) and any consideration relevant to proportionality (section 2(3) and (4)). The [Judicial Commissioner] must consider these matters with a sufficient degree of care as to ensure that he or she complies with the duties under section 2 (section 208(2)(b)). 218. Thus, the issuing of BPD warrants under Part 7 is subject to many of the fundamental safeguards in Part 6 to which we have already referred, including, in particular, the "double-lock" provisions. 219. Furthermore, a BPD may not be retained, or retained and examined, pursuant to a class BPD warrant if the head of the intelligence service considers that the BPD consists of or includes, "protected data" or "health records" (section 206) or that a substantial proportion of the BPD consists of "sensitive personal data". Essentially, "protected data" means (section 203) "private information" (which "includes information relating to a person's private or family life" and all other data in a BPD other than "systems data" or "identifying data" which is capable of being separated logically from that BPD without revealing the meaning of any of the data). An application to retain, or to retain and examine, data within these categories would have to be made as an application for a specific BPD warrant. Additional safeguards in relation to specific warrants covering "health records" and "protected data" are provided by sections 206 and 207 (see the overview at para 90).”
“223. At the outset of the hearing before us [counsel for the claimant] submits that the BPD powers conferred by Part 7 are too wide to be compatible with articles 8 and 10 because virtually any data could be retained and examined under a BPD warrant so long as it comprises personal data held electronically: paras 106-109 of the claimant's skeleton argument. By way of example, he said that the language of the legislation is so broad to allow the authorisation of the kind of national DNA or fingerprint data base which was held to be unlawful in S and Marper and MK v France …. He submits that the safeguards relate solely to examination and not to the authorisation of retention. 224. We do not accept these submissions. As we have already indicated, the question for this court is whether the legislation as enacted, and not actual practices or activity, is incompatible with articles 8 or 10. Here the key issue for us is whether the legislation indicates the scope of the powers conferred and the manner in which they may be exercised with sufficient clarity to give adequate protection against "arbitrary interference": Zakharov, at para 230. The statutory requirement that both the Secretary of State and the independent [Judicial Commissioner] have to apply necessity and proportionality tests to a properly formulated application is designed to ensure that retention of the kind which was found to be in breach of the ECHR in S and Marper or in MK would not be authorised and would therefore be prohibited by section 200. Our conclusion is similar to that which we reached on the challenge regarding the general and indiscriminate retention of data under Part 4 of the 2016 Act (see R (National Council for Civil Liberties) v Secretary of State for the Home Department[2019] QB 481 , para 135). It is wrong as a matter of principle to argue that Part 7 is incompatible with articles 8 and 10 by advancing factual scenarios which would be incompatible with legal principles (and independent mechanisms to give effect to those principles) enshrined in the Act itself. 225. We have reached a similar conclusion on the claimant's related argument that the legislation gives the Secretary of State a choice as to whether to issue a warrant for the retention of a BPD either in the form of a class BPD warrant or a specific BPD warrant. A class warrant is simply required to describe the class of BPD to which it relates without saying how a "class" is to be defined: para 115 of the claimant's skeleton argument. We agree with the defendants that if on a given set of facts it is not necessary or proportionate to issue a class BPD warrant because a less intrusive specific BPD warrant could be issued to address the purpose of the application, then neither the Secretary of State will be able to issue, nor a JC to approve, the issuing of a class BPD warrant… 226. This conclusion is reinforced by paras 5.3-5.5 of the BPD Code of Practice. If the [Judicial Commissioner] or the Secretary are not satisfied as to the nature and scope of a class, or the number of BPDs which may fall within the class, the application for a class warrant may be refused or it may be granted subject to conditions which reduce the ambit of the class. Alternatively, the intelligence service may be required to split the class for which a warrant is sought and to submit revised applications for smaller class BPD warrants so as to ensure effective oversight. Such outcomes are the direct result of applying the necessity and proportionality tests embedded in the statutory framework and machinery for the authorisation of warrants. 227. As we have previously explained, Part 7 neither authorises an agency to obtain data, nor to retain data which could not otherwise be retained under other legislation. Instead, it requires the retention of BPD previously obtained under other regimes to be subjected to the safeguards introduced by Part 7, not least the "double lock provision", requiring independent scrutiny and approval through the warrant procedure, and the subsequent monitoring of the audit process of the powers used. As the defendants point out, there is no challenge before the court to the regime in the ISA or theSecurity Service Act 1989 .”
“276. Under the first safeguard, where a purpose of the criteria to be used for selecting such material for examination is to identify items subject to legal privilege, or the use of those criteria is likely to reveal such items, a "senior official" acting on behalf of the Secretary of State must approve the use of those criteria (sections 153(2) and 194(2)). That official must have regard to the public interest in the confidentiality of such items (section 153(3) and section 194(3)). No such approval may be given unless the official considers that the arrangements under section 150 or section 191 include safeguards for the handling, retention, use and destruction of such items. Additionally, where the purpose is to identify items subject to legal privilege, the official must be satisfied that there are "exceptional and compelling circumstances" making it necessary to authorise the use of those selection criteria (section 153(4) and section 194(4)). That test is not satisfied unless the official is satisfied that the public interest in the selection for examination outweighs the public interest in the confidentiality of "items" subject to legal privilege, there are no other means by which the information may reasonably be obtained, and the information is necessary for national security or to prevent death or significant injury (sections 153(5) and 194(3)). 277. Under the second safeguard, where a purpose of the criteria to be used for selecting "intercepted content" or "protected material" for examination is to identify communications that would be subject to legal privilege if they were not made in order to further a criminal purpose, those criteria may not be used unless approved by a senior official acting on behalf of the Secretary of State and that person considers that the targeted communications are likely to have been made with the intention of furthering a criminal purpose (sections 153(6)—(8) and 194(6)—(8)). 278. Under the third safeguard, where an item subject to legal privilege has been intercepted under Chapter 1 or obtained under Chapter 3 and is retained following its examination, other than to be destroyed, the IPC must be informed as soon as reasonably practicable (sections 153(9) and 194(9)). The IPC must either direct the destruction of the item or impose conditions on its use or retention (sections 153(10) and 194(10)), unless he considers that the public interest in retaining the items outweighs the public interest in the confidentiality of "items" subject to legal privilege and that retention is necessary for national security or for preventing death or significant injury (sections 153(12) and 194(12)). Even where he does so consider, the IPC may still impose conditions on the use or retention of the items in order to protect the public interest in the confidentiality of legal privilege (sections 153(11) and 194(11)). It is to be noted that the application of the third safeguard is not limited to "intercepted content" or "protected material"; it applies generally to any item subject to legal privilege which has been intercepted or obtained under Chapters 1 or 3 of Part 6.”
“285. There was a dispute as to how exceptional or otherwise such examples of legal privilege may be. We do not need to resolve this. Even if legally privileged items falling outside the scope of "content" are intercepted or obtained under a warrant, they are subject to the "third safeguard" in section 153(9)—(14) and also sections 55 , 131 , 194(9)-(14) and 223 . The IPC must apply the dual tests of whether (a) the public interest in retention outweighs the public interest in the confidentiality of legally privileged items and (b) retention is necessary for national security or for preventing death or significant injury. Subject to the outcome of the IPC's assessment applying those tests, the commissioner may direct destruction of the items in question or the imposition of conditions on their retention or use. 286. The requirement under that third safeguard for both tests to be applied, if a legally privileged item is intercepted or obtained, also meets in substance the claimant's criticism that the first safeguard does not require those tests to be applied where the use of selection criteria for examination is only "likely to identify" legally privileged items, as opposed to its being a purpose of using those criteria to identify such items. In this context, we also bear in mind the overarching requirements of the general duties in relation to privacy, notably section 2(2)(a)(b) and (d), (4)(c) and (5). These protections under the third safeguard are not confined to "content", "protected material" or "protected data" but apply also to "secondary data" and to non-protected material or data. 287. The claimant also criticises this third safeguard because it does not provide for prior independent authorisation of the interference. We accept the submission of Sir James Eadie [counsel for the Secretary of State] that neither Strasbourg nor domestic jurisprudence lays down a general requirement for such authorisation in order to achieve compatibility with article 8 in relation to legally privileged items: see McE v Prison Service of Northern Ireland (Northern Ireland Human Rights Commission intervening)[2009] AC 908 ; RE v United Kingdom(2015) 63 EHRR 2 ; Szabo v Hungary(2016) 63 EHRR 3 ; Michaud v France(2012) 59 EHRR 9 . 288. We do not accept that the claimant's contention is supported by the decision in Kopp v Switzerland(1998) 27 EHRR 91 . There the Federal Prosecutor had ordered monitoring of the private and professional phone lines of a lawyer and his wife, who was the former head of the Federal Department of Justice and Police, in order to identify a person working in that department who might have disclosed official secrets. The monitoring covered all the telephone lines in the lawyer's office and therefore also involved listening to privileged communications by all the lawyers in the office. In those unusual circumstances, the court expressed concern that the task of distinguishing between calls that were the subject of the investigation and other calls, the contents of which were legally privileged, had been entrusted to an official in the legal department of the Post Office without supervision by an independent judge. However, the court did not lay down any general principle requiring prior authorisation by a judge or other independent body of the interception or obtaining of material which is the subject of legal privilege. 289. The claimant criticises Part 7 of the 2016 Act for failing to apply the safeguards in respect of legally privileged items to "class" BPD warrants. However, we accept the defendants' submission that such items will fall within the definition of "protected data" (section 203). In this context it should be recalled that "identifying data" which is incapable of being separated logically from BPD without revealing the meaning of any of the data is treated as "protected data". By section 202 an intelligence service may not retain, or retain and examine, BPD which includes protected data. In such circumstances, it will be necessary for a "specific" BPD warrant to be obtained and the safeguards in respect of legally privileged items will apply. 290. As for the claimant's criticism that Chapter 2 of Part 6 does not contain specific safeguards in relation to the bulk acquisition of CD, we have previously referred to the general privacy duties in section 2 and the relevant parts of the Code of Practice. The case law upon which the claimant relies (cited above) is all concerned with the targeted surveillance of the content of lawyer-client communications, not the obtaining or examination of CD. That case law does not lay down a lexicon of specific rules for surveillance of any lawyer-client communication. Instead, it refers to a broad principle that the importance of lawyer-client confidentiality requires specific recognition in domestic legal rules. Beyond that principle the issue of whether additional protection is required depends upon the context. That broad principle is reflected in section 2 of the 2016 Act. 291. Furthermore, as we have explained, "content" is excluded from the ambit of CD (section 261(5)). Indeed, the legislation goes further by excluding from the ambit of CD anything within the scope of "systems data" which would otherwise fall to be treated as "content". Thus, the acquisition, examination and disclosure of "content" cannot be authorised by a warrant issued under Chapter 2 of Part 6. We accept the defendants' submission that, although CD may reveal when a communication occurred, between which devices, and for how long, it will not reveal what was discussed or the subject matter. It will not therefore touch upon the central purpose of legal privilege, namely to enable a client to disclose whatever he wishes to in order to obtain legal advice, without the fear of that material being disclosed to others without his consent. 292. For all these reasons we are satisfied that the rules regarding legally privileged items are set out in the 2016 Act and codes of practice with sufficient clarity and with sufficient safeguards so as to avoid arbitrary interference and so as to render the statutory scheme compatible with article 8.”
“In so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning of those rights shall be the same as those laid down by the said Convention. This provision shall not prevent Union law providing more extensive protection.”
“127. The scheme laid down in Part 4 of the 2016 Act is very different from the Swedish legislation. First, the Act does not contain a blanket requirement requiring the general retention of communications data. The Act does not itself impose any requirement on telecommunications operators to retain data. Instead, the Secretary of State is given a power to require retention of data by serving a notice on an operator. 128. Secondly, the Secretary of State may only exercise that power if she considers it both necessary and proportionate for one or more of the specific purposes currently listed in section 61(7) of the Act. This enshrines in the statute the essence of the tests propounded by the court in Watson CJEU. 129. Thirdly, although the claimant relies heavily upon section 87(2)(b) as allowing a notice to require the retention of “all data”, that provision cannot be read in isolation and taken out of its context. The claimant's submission overlooks the statutory requirement to satisfy the necessity and proportionality tests. It is difficult to conceive how a retention notice drafted so as to encompass all communications data in the UK could satisfy those tests. In any event, section 87(2) provides that a notice may relate to a “description of data” and not just to “all data”
“(a) whether what is sought to be achieved by the warrant, authorisation or notice could reasonably be achieved by other less intrusive means, (b) whether the level of protection to be applied in relation to any obtaining of information by virtue of the warrant, authorisation or notice is higher because of the particular sensitivity of that information, (c) the public interest in the integrity and security of telecommunication systems and postal services, and (d) any other aspects of the public interest in the protection of privacy.”
“139. First, we accept the defendants’ submission that Part 7 of the IPA does not fall within the scope of EU law at all. Part 7 does not contain any power to acquire information, still less impose a duty upon [communication service providers] to provide information to the state. Rather it concerns how state authorities should handle bulk personal datasets which they have already obtained under other powers. We do not accept Mr Jaffey's submission that, because the data will originally have been obtained under other powers from [communication service provides] that brings it within the scope of the e-Privacy Directive. We note, as the defendants do, that in the proceedings which led to the reference by the IPT in Privacy International, the claimant in that case conceded that, in the absence of a regime requiring controllers to provide bulk personal datasets to an agency, the regime was outside the scope of EU law; see also the judgment of the CJEU, at para 45–46.”
“145. We accept the submissions for the defendants that Watson CJEU did not go so far as to require separate independent authorisation each time retained data is selected for examination or accessed. The requirement for independent authorisation is satisfied by the need for approval to be obtained from a Judicial Commissioner for a bulk warrant which addresses not only the obtaining of data but also access thereto. This is reinforced by the statutory safeguards, as summarised in the Annex to our 2019 judgment, at paras 42–65.”
“In the exceptional event that an officer were to select for examination communications data specifically in order to determine a journalist’s source, they should only do this if the proposal had been approved beforehand by a person holding the rank of Director of above within their organisation level. Any communications data obtained and retained, other than for the purposes of destruction, as a result of such selection for examination must be reported to the Investigatory Powers Commission at the next inspection.”
“6.30 The requirement for senior approval does not apply where the intent is to examine communications data obtained in bulk to identify the communications data of a journalist, but it is not intended to determine the source of journalistic information (for example, where the journalist is suspected of involvement in terrorist activity). 6.31. In such cases there is nevertheless a risk of collateral intrusion into legitimate journalistic sources. In such a case, particular care must therefore be taken to ensure that the officer considers whether the intrusion is justified, giving proper consideration to the public interest. The officer needs to consider whether alternative evidence exists, or whether there are other alternative means for obtaining the information being sought.”
“(2) The requirements of this subsection are met in the case of a warrant if it appears to the Secretary of State— (a) that requirements corresponding to the requirements of section 150(2) and (5) and section 152 will apply, to such extent (if any) as the Secretary of State considers appropriate, in relation to any of the material which is handed over, or any copy of which is given, to the authorities in question…..”
“9.28 As outlined at paragraph 9.27, the Act places a requirement on the issuing authority (the Secretary of State, or where appropriate Scottish Ministers) to ensure that safeguards corresponding to those in the Act should apply, to the extent appropriate, where material obtained under a warrant is being shared with overseas authority. In most circumstances, intelligence sharing will take place with countries with which the United Kingdom has long and established intelligence sharing relationships and which apply corresponding safeguards to material obtained under a warrant as those provided in the Act. 9.29 But there will also be occasions where material derived from interception warrants may need to be shared with a country overseas with whom we do not have an existing intelligence sharing relationship and whose authorities do not apply safeguards to intercepted material corresponding to those in the Act. Issuing authorities will need to consider the arrangements that should be in place to regulate such disclosure. These should require the person considering the authorising disclosure to balance the risk that material will not be subject to the same level of safeguards that it would be in this country, against the risks to national security if material is not shared.”
“the rules regarding legally privileged items are set out in the … Act and codes of practice with sufficient clarity and sufficient safeguards so as to render the statutory scheme compatible with Article 8.”
“…(b) equipment belonging to, used by or in the possession of a group of persons who share a common purpose or who carry on, or may carry on, a particular activity; (c) equipment belonging to, used by or in the possession of more than one person or organisation, where the interference is for the purpose of a single investigation or operation; (d) equipment in a particular location; (e) equipment in more than one location, where the interference is for the purpose of a single investigation or operation; (f) equipment which is being, or may be, used for the purposes of a particular activity or activities of a particular description; (g) equipment which is being, or may be, used to test, maintain or develop capabilities relating to interference with equipment for the purpose of obtaining communications, equipment data or other information; (h) equipment which is being, or may be, used for the training of persons who carry out, or are likely to carry out, such interference with equipment.”
“(a) inform the person of any rights that the person may have to apply to the Investigatory Powers Tribunal, and (b) provide such details of the error as the Commissioner considers to be necessary for the exercise of those rights, having regard in particular to the extent to which disclosing the details would be contrary to the public interest or prejudicial to anything falling within subsection (4)(b)(i) to (iv).”