CHAPTER 5: LEGAL CONSTRAINTS
considers very similar factors under the headings of “in accordance with the law” and
proportionality (and may even consider them together).
5.34.
In summary, the case law of the ECtHR suggests that bulk data collection and
analysis, in the absence of suspicion, is not in itself a disproportionate interference
with the right to respect for private life. However, bulk collection will be assessed
against a higher standard than individual interferences with the right to privacy. The
justification for that interference, and the safeguards in place to prevent abuse, will
need to be more compelling if the requirements of Article 8(2) are to be satisfied.42
5.35.
The IPT recently heard extensive argument concerning whether or not the current
bulk interception processes under RIPA s8(4) were “in accordance with the law” in the
Liberty IPT Case. The Claimants argued that the current distinction between internal
and external communication was so unclear that the bulk collection framework was
itself unlawful. They also argued that data sharing arrangements between various
governments and the UK were not in accordance with the law, and that insufficient
safeguards were in place. All those arguments were rejected in the judgment of 5
December 2014, though the IPT went on to rule that prior to disclosures made in 2014,
the regime for sharing data with the US had contravened the “in accordance with the
law” requirement.43 After further (closed) argument, the IPT is expected to determine
the Claimants’ submissions that the bulk interception of external communications is a
disproportionate interference with their Article 8 and Article 10 rights. The Claimants
have already applied to the ECtHR in relation to the arguments rejected by the IPT.44
Home and away
5.36.
Every state of whose legal framework I am aware draws some kind of distinction
between the protections afforded to its own citizens or residents and others.45 The
apparent distinction in RIPA between “internal” and “external” communications,
together with the additional safeguards under RIPA s16 for persons known to be for
the time being in the British Islands,46 is explained at 6.42-6.59 below.
5.37.
The ECHR case law has not directly considered the lawfulness of that dichotomy. 47
As a general rule, Member States do not owe ECHR duties to individuals outside their
territory or “effective control”.48 However, both the case law of the ECtHR and the UN
Human Rights Committee have made clear that treaty obligations may extend
extraterritorially.49 The application of that doctrine to surveillance conducted abroad
42
43
44
45
46
47
48
49
That conclusion is consistent with the approach adopted by the CJEU in Digital Rights Ireland as set out
below.
Liberty IPT Case, judgment of 6 February 2015.
10 Human Rights Organisations v United Kingdom, an application filed on 10 April 2015 [Liberty
ECtHR Application].
See further 5.90 and 14.76-14.77 below.
British Islands means the UK, Channel Islands and Isle of Man: Interpetation Act 1978 s5.
In Weber v Germany, the ECtHR declined to decide the question of whether German nationals
resident in Uruguay who complained of “strategic monitoring” of international telecommunications by
the German Federal Intelligence Service were entitled to the protection of the ECHR (the case being
declared inadmissible on other grounds).
In Al Skeini v United Kingdom (Application no. 55721/07, judgment of 7 July 2011), paras 138-148.
European Commission for Democracy Through Law (Venice Commission), Update of the 2007 report
on the democratic oversight of the security services and report on the democratic oversight of signals
intelligence agencies, Study No 719/2013, April 2015, [Venice Commission Report], paras 69-71.
79