CDT Urges European Court of Human Rights To Outlaw or Limit Bulk Collection

Today, the Center for Democracy & Technology (CDT) filed a brief in the Grand Chamber of the European Court of Human Rights (ECtHR) in the joined petitions of Big Brother Watch and Others v. United Kingdom, Bureau of Investigative Journalism and Alice Ross v. the United Kingdom, and 10 Human Rights Organisations v. the United Kingdom (collectively called “Big Brother Watch”). Big Brother Watch challenges the United Kingdom’s bulk interception regime by which intelligence agencies tap the fiber cables carrying internet traffic to analyze all electronic data that goes in or out of the U.K. The parties also challenge the intelligence sharing program between the U.K. and U.S., by which the National Security Agency (NSA) shares intelligence with the U.K.

The ECtHR enforces the European Convention on Human Rights (ECHR) to which all 47 Member States of the European Council have subscribed. It’s rare for the Grand Chamber to hear a surveillance case appealed from one of the Sections of the ECtHR and we were pleased to have the opportunity to file a brief (known as a “third-party intervention”). CDT was ably represented on a pro bono basis by expert UK barristers Can Yeginsu and Anthony Jones, of the 4 New Square chambers in London.

We hope the Grand Chamber will determine that bulk collection is not lawful under the European Convention on Human Rights

In September 2018, the First Section of the ECtHR  issued a mixed judgment in Big Brother Watch, concluding that while the U.K.’s program violated the ECHR rights to privacy and freedom of expression, bulk collection regimes were not per se incompatible with the ECHR. CDT filed third-party interventions in two of the joined petitions and argued the U.K. violated the right to privacy (ECHR Article 8) by accepting surveillance data from the U.S. because the U.S. surveillance programs themselves are not compliant with Article 8. This decision came shortly after the ECtHR issued its judgment in Centrum för rättvisa v. Sweden, a case challenging Sweden’s bulk collection regime, in which the Court opined for the first time post-Snowden that bulk collection can be compatible with the ECHR. This case too will be reviewed by the Grand Chamber.

Our intervention at the Grand Chamber argued that U.S. surveillance under FISA Section 702 and Executive Order 12333 of non-U.S. persons outside the United States is so vast, pervasive, and lacking in protections that the U.K. violates its obligations under the European Convention on Human Rights when it receives data from the NSA. Because it lacks transparency, adequate judicial oversight, and provides no notice to surveillance targets, U.S. intelligence surveillance would not be compliant with the ECHR, and therefore the U.K.’s receipt of information that is a product of this surveillance is not ECHR compliant either.

We also argued that bulk collection regimes are inherently disproportionate and therefore unlawful under the ECHR, and in the alternative, should the Grand Chamber determine that bulk surveillance is lawful in principle, we urged the Court to impose at least three limitations on the surveillance at issue:

1. States should engage in intelligence sharing arrangements only with countries whose intelligence surveillance regimes meet human rights criteria established by law (following the example of the Netherlands, which already has this requirement).
2. There must be independent—preferably judicial—authorization, based on a finding of reasonable suspicion, for the use of selectors identifiable to specific targets to query information obtained from foreign partners or from a member States’ own bulk surveillance. The First Section in Big Brother Watch dismissed the suggestion of requiring a finding of reasonable suspicion in relation to persons for whom data is sought as “inconsistent…with the operation of a bulk interception regime.” (para 317)  While this is true with respect to a determination of whether to engage in bulk surveillance at all, we explained how reasonable suspicion could be applied to determine which selectors could be used to query the information collected in bulk.
3. There must be notice provided to surveillance targets. Here, too, the First Section in Big Brother Watch assumed that notice was incompatible with the operation of a bulk interception regime. (para 317) We argued that notice in a bulk interception regime would consist of making public a description of the bulk surveillance regime with enough particularity to give notice of the type of information that can be collected and the breadth of the collection, plus specific notice to any person against whom the information collected will be used in a criminal investigation and specific notice to any person whose selector was run against the information collected in bulk. We allowed that notice could be delayed if it would undermine the purpose of the surveillance.

Many countries around the world are adopting bulk surveillance regimes, and the Court’s decision to take up these two challenges comes at a time when its guidance is most needed. We hope the Grand Chamber will determine that bulk collection is not lawful under the European Convention on Human Rights, but past decisions suggest it may rule differently.  In the event it does, we hope the ECtHR will take the opportunity to impose the safeguards we advocate here, as well as other safeguards, to promote at least some level of privacy in bulk collection regimes and with respect to intelligence sharing regimes as well.