8
BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM JUDGMENT
Kingdom, irrespective of whether it is/they are solicited or unsolicited, whether the
content is analysed or unanalysed, or whether or not the communications data are
associated with the content of communications, the communications content and data
are, pursuant to internal ‘arrangements’, subject to the same internal rules and
safeguards as the same categories of content or data, when they are obtained directly
by the Intelligence Services as a result of interception under RIPA.
3. Those of the Intelligence Services that receive unanalysed intercepted material
and related communications data from interception under a s.8(4) warrant have
internal ‘arrangements’ that require a record to be created, explaining why access to
the unanalysed intercepted material is required, before an authorised person is able to
access such material pursuant to s.16 of RIPA.
4. The internal ‘arrangements’ of those of the Intelligence Services that receive
unanalysed intercepted material and related communications data from interception
under a s.8(4) warrant specify (or require to be determined, on a system-by-system
basis) maximum retention periods for different categories of such data which reflect
the nature and intrusiveness of the particular data at issue. The periods so specified (or
determined) are normally no longer than 2 years, and in certain cases are significantly
shorter (intelligence reports that draw on such data are treated as a separate category,
and are retained for longer). Data may only be retained for longer than the applicable
maximum retention period where prior authorisation has been obtained from a senior
official within the particular Intelligence Service at issue on the basis that continued
retention of the particular data at issue has been assessed to be necessary and
proportionate (if the continued retention of any such data is thereafter assessed no
longer to meet the tests of necessity and proportionality, such data are deleted). As far
as possible, all retention periods are implemented by a process of automated deletion
which is triggered once the applicable maximum retention period has been reached for
the data at issue. The maximum retention periods are overseen by, and agreed with the
Commissioner. As regards related communications data in particular, Sir Anthony
May made a recommendation to those of the Intelligence Services that receive
unanalysed intercepted material and related communications data from interception
under a s8(4) warrant, and the interim Commissioner (Sir Paul Kennedy) has recently
expressed himself to be content with the implementation of that recommendation.
5. The Intelligence Services’ internal ‘arrangements’ under [the Security Services
Act 1989], [the Intelligence Services Act 1994] and ss.15-16 of RIPA are periodically
reviewed to ensure that they remain up-to-date and effective. Further, the Intelligence
Services are henceforth content to consider, during the course of such periodic
reviews, whether more of those internal arrangements might safely and usefully be put
into the public domain (for example, by way of inclusion in a relevant statutory Code
of Practice).”
2. The IPT’s first judgment of 5 December 2014
31. The IPT issued its first judgment on 5 December 2014. The
judgment addressed the arrangements then in place for intercepting and
sharing data, making extensive reference throughout to this Court’s caselaw.
(a) The PRISM issue
32. The IPT accepted that the PRISM issue engaged Article 8 of the
Convention, albeit at a “lower level” than the regime under consideration in