Sunday, 24 September 2017

Bridge over troubled legal water? Legal issues of the Brexit transition period



Professor Steve Peers*

Compared to famous Florentines, Theresa May’s recent speech on the UK’s Brexit plans inevitably owed more to Machiavelli than Leonardo da Vinci. Nevertheless, it gave a rough indication of the basic legal architecture that the UK government would like to govern its relationship with the EU for a transition period after Brexit Day. I have previously summarised and commented upon the main points of the Florence speech, but there is more to say on this legal framework – and also on the rules which would apply to EU27 citizens in the UK during the transition period.

Legal framework

First of all, is a transition period after Brexit Day even legally possible? If so, what provision of EU law would apply?

Article 50 TEU, which sets out the basic rules on Member States’ withdrawal from EU membership, is silent on the issue of any transitional period after the withdrawal date. However, it might be noted that Article 49 TEU, governing accession, is equally silent on transitional periods after joining the EU; nevertheless such periods are an established feature of the accession process.

In its negotiating guidelines on the Brexit withdrawal agreement, the European Council (EU27 States’ leaders) stated that:

To the extent necessary and legally possible, the negotiations may also seek to determine transitional arrangements which are in the interest of the Union and, as appropriate, to provide for bridges towards the foreseeable framework for the future relationship in the light of the progress made. Any such transitional arrangements must be clearly defined, limited in time, and subject to effective enforcement mechanisms. Should a time-limited prolongation of Union acquis be considered, this would require existing Union regulatory, budgetary, supervisory, judiciary and enforcement instruments and structures to apply.

These principles are set out again in the negotiation directives on the agreement, handed down to the European Commission by the Council (EU27 States’ ministers) at paragraph 19. Those negotiation directives go into no further detail on the transition period issue for now; instead, there will be further negotiation directives in future, once the EU27 side has decided that there has been ‘sufficient progress’ on its priority issues (EU27 and UK citizens’ rights, financial issues, Northern Ireland) during the Brexit talks. 

For the UK’s part, the Florence speech states that on Brexit Day, the UK will cease to participate in the EU political institutions. The period must be ‘strictly time limited’, suggesting ‘around two years’;  but the two sides ‘could also agree to bring forward’ aspects, such as a new dispute settlement system. The latter point implies that the ECJ will apply until that point.

Substantively, during the transitional period, ‘access to one another’s markets should continue on current terms’; the UK will ‘continue to take part in existing security measures’; and the ‘framework’ will be ‘the existing structure of EU rules and regulations’.  There would be no change to other Member States’ payments and contributions during the current funding cycle (ending in 2020), implying that EU laws on funding and spending continue without amendment until then.

EU citizens can still come to live and work during this period, but they will be registered; but as I noted in the previous blog post, such registration is allowed under the EU citizens’ Directive. (More on that below). Finally, the speech referred to one substantive difference in law: the UK would hold its own trade negotiations, and would ‘no longer directly benefit’ from the EU’s trade negotiations.

Moreover, the speech made comments on another aspect of the withdrawal agreement – maintaining EU27 citizens’ rights – that may be relevant by analogy to transition issues. The Prime Minister said that the UK would ‘incorporate our agreement [on citizens’ rights] fully into UK law and make sure the UK courts can refer directly to it’; and that UK courts must be ‘able to take into account’ relevant ECJ case law.

Comparing the UK to the EU27 position on the transitional period, there are lots of similarities. Both sides are willing to contemplate such a period (the EU27’s ‘legally possible’ caveat is considered below). Both sides want it to be for a limited time. The Florence speech states that the transitional rules would be linked with the future permanent UK/EU relationship (‘a bridge from where we are now to where we want to be’), matching the EU27 position. (Note there’s no need to define the future relationship in detail in the withdrawal deal: Article 50 refers only to defining a ‘framework’ for that relationship, and the EU negotiation position refers only to bridges towards the foreseeable future framework).

The greatest difficulties may come with the issues of post-Brexit EU legislation, and the legal effect of EU law. At present the European Communities Act provides for the adoption of new EU law into the UK’s legal order. It gives that law direct effect and supremacy, and gives effect to ECJ rulings in domestic law. However, the proposed EU Withdrawal Bill would remove all these provisions, instead retaining pre-Brexit EU rules and ECJ judgments in force pending potential amendment by government or Parliament. Pre-Brexit ECJ judgments would retain their force subject to such amendments or overruling by the UK Supreme Court, and UK courts would have an option to take post-Brexit ECJ case law into account. The Bill would also remove the principle of damages liability for breach of EU law, and would not keep the EU Charter of Fundamental Rights as part of retained EU law in the UK (on the latter point, see discussion here).

Technically, anything which the UK agrees to in the Withdrawal Agreement can be incorporated into UK law easily enough, since clause 9 of the Withdrawal Bill would give the UK government unlimited power to amend any UK laws to give effect to that Agreement. (Note, however, that the Bill could be amended in Parliament as regards any of these points before it becomes an Act of Parliament). So the issue is not the capability of the UK government to give effect to the Withdrawal Agreement, but its willingness to negotiate on these issues.

After her speech, the Prime Minister deliberately avoided answering a question about whether the UK would apply post-Brexit EU law during the transition period, saying it was a matter for negotiation. In fact, there is some flexibility on this, since the EU27 negotiation position does not take any view on that point. (Remember that the EU27 negotiation position on transitional issues will be enlarged later). In the meantime, UK cabinet members have tried to rule this prospect out. (Note that the speech refers to keeping ‘existing’ and ‘current’ EU law in force).

There is less flexibility as regards the legal effect of EU law, where – to recall – the EU27 position is that ‘existing EU regulatory, budgetary, supervisory, judiciary and enforcement instruments and structures’ should apply. The combined reference to ‘judiciary’ and ‘enforcement’ structures suggest that the ECJ’s current jurisdiction, and the current legal effect of EU law in the UK, should apply. While the Prime Minister obliquely referred to the ECJ, she hoped that its role could be terminated early as regards the UK; and the UK government’s position on the legal status of EU27 citizens (no ECJ role; option to take account of ECJ rulings; incorporation of Withdrawal Agreement into UK law but no special status), if extended to the transitional rules in the Withdrawal Agreement, would fall short of the EU27 position. Equally, while it is not expressly mentioned in the current negotiation position, the EU27 might, when amending that position, argue that the EU Charter should still apply to the UK during the transitional period. (Note that the Charter does not apply to all actions of Member States, but only applies to Member States when they implement EU law). 

Three further points. First, what happens to the position of non-EU countries as regards the UK? They are parties to some treaties with the EU alone, and to some treaties with the EU together with its Member States. The legal issues arising in this respect during the transitional period will have to be addressed.

Secondly, what happens after the end of the transitional period? In particular, what if it is deemed desirable on both sides to continue the arrangement, in whole or part? In that case, the special decision-making rule applying to Article 50 (see next point) will have expired, and so the normal decision-making rules of EU law will apply. Depending on the content of what is carried forward then, this may require some unanimous voting and even ratification by all Member States, although it should be recalled that the EU side can decide to apply treaties provisionally pending national ratification.

That brings us to the most fundamental legal issue: can the EU27 side include a transitional deal within the scope of Article 50 in the first place? The words ‘[t]o the extent…legally possible’ hint at some doubt on this point, presumably because of an argument that Article 50 cannot extend to the regulation of legal relationships that are created after Brexit Day, but only to the regulation and/or termination of those created before that date. However, while little is certain now about how the ECJ might interpret Article 50, in my view that interpretation is too narrow, given that Article 50 refers to taking account of the framework for future relations with the withdrawing state, and Article 8 TEU refers to maintaining strong relationships with neighbouring non-EU countries. If this is correct, it follows that as long as the transitional deal is limited in time and linked to the future framework for relations – as both the EU27 and UK side intend – there should not be a legal problem. (On the other hand, there is nothing in Article 50 to require that anything in the withdrawal agreement must be subject to ECJ jurisdiction, besides the usual rule that only the ECJ can rule definitively on how to interpret EU law for EU Member States).

The importance of this is that the Article 50 agreement needs only a qualified majority vote to be approved by the EU27, without national ratification by Member States (as confirmed in the negotiation directives). But the EU27 and UK should prepare a ‘Plan B’ in the event that some Eurosceptic devoted to a ‘WTO-only’ and/or ‘no deal’ relationship between the UK and EU brings a legal challenge. If such a challenge were successful, the ECJ might anyway maintain the problematic parts of the treaty in force temporarily due to legal certainty; and the UK and EU should aim to agree the impugned parts of the Withdrawal Agreement on the correct legal basis as soon as possible, applying that new treaty provisionally.

Extension of the Article 50 period

Some have suggested extending the negotiation period for the Brexit talks instead – as Article 50 expressly allows for – arguing that a transition phase is no different from extending the negotiation period anyway.  It’s true that legally the extension of the negotiation period would be simple: it requires only a unanimous vote of the EU27 Member States (with no national ratification) required, plus the UK government, with no role for the European Parliament. As a matter of domestic UK law, arguably an Act of Parliament would be required to this end (note that the European Union (Notification of Withdrawal) Act, which gave the government power to invoke Article 50 pursuant to the Miller judgment, does not mention the issue of extension).

But an extension to the negotiation period would be politically difficult. It’s not known whether the EU27 would give their unanimous consent, particularly given the awkward consequence that the UK would then end up participating in the 2019 European Parliament elections. And within the UK, announcing an intention to delay Brexit would likely mean that Theresa May would immediately be the centrepiece of a modern version of Da Vinci’s Last Supper – followed swiftly by the political resurrection of Nigel Farage.

Furthermore, it’s false to say that there is really no difference between a negotiation extension and a transition period. First of all, during a negotiation extension the UK would still participate in the EU’s political institutions. Secondly, it’s certain that there would be no change in the legal effect of EU law in the UK or the substance of EU laws in the UK, and that new EU laws and new ECJ judgments would continue to apply, in the event of a negotiation extension – whereas those issues may, as discussed above and below, be addressed differently during a transition period.

Thirdly, in the event of a change of mind in the UK on Brexit, remaining within the EU on the basis of a negotiation extension may be different from rejoining the EU after having left. This depends (a) on the resolution of some legal issues concerning Article 50 (Can the withdrawal notice be rescinded? If so, must the EU consent? If so, can the EU attach conditions? Or can the Article 50 period simply be extended indefinitely, with no further negotiation taking place?) and (b) on the extent to which the UK could rejoin on the same terms (Would the EU have already removed the UK’s opt-outs from the Treaties? Would the UK rebate on the EU budget have been rescinded yet?).

EU27 citizens

As noted already, the UK government’s intention to require EU citizens to register if they come to the UK during the transitional period is consistent with the EU citizens’ Directive, which allows registration for stays longer than three months. Indeed, the Commission has reported that almost all EU states register citizens from other EU Member States. But a failure to register can only be punished by proportionate penalties, not expulsion or detention (see the ECJ ruling in Watson and Bellman, concerning a prior version of this law). According to the ECJ ruling in Huber, Member States may include information on EU citizens in a database, but this can only be used for the purpose of administering EU free movement law; if they put information on EU citizens in a criminal database, they must be treated equally with nationals of that Member State.

The Directive goes on to say that Member States cannot insist that registration certificates must be the sole method of checking entitlement to reside or any other right, since other forms of proving identity are possible; and that Member States can only penalise EU citizens for not carrying their registration certificates if they penalise their own citizens the same way for not carrying ID cards (see also the ECJ judgment in Oulane). It follows that as long as the UK doesn’t have an ID card system, it could not penalise EU citizens for not carrying registration certificates.

So while registration of EU citizens is permissible, the limits set out in the legislation and case law put the more general questions about ‘transition law’ raised in this blog post in a particular context. It would not be credible for the EU27 to insist that the UK not register EU citizens at all, particularly given that most of them do the same thing themselves. But will the important limits on registration apply? It’s an important question given the tendency of the UK Home Office to create a ‘hostile environment’ for EU and non-EU citizens alike, and the risk that absent the application of EU case law and legislation to this issue, there could be fines, detention, expulsion or other refusals of rights for EU citizens who didn’t register, lost their registration certificate or forgot to carry it. (All the same issues arise if the UK extends – as it could – the registration obligation to EU citizens who were present before Brexit Day).

If the EU27 and UK agree that the existing EU law still applies and the pre-Brexit ECJ case law remains binding, in principle the issue is resolved, at least during the transitional period. But what if the UK breaches this agreement, or if there is some question about how the UK applies the requirement, or if there is some new relevant ECJ case law? Then the important questions will be whether the existing EU law remedies (direct effect, supremacy, damages) are still available; whether UK courts can still ask the ECJ questions; and whether the UK courts are obliged to follow post-Brexit ECJ case law.

This issue, important as it would be for many EU citizens resident in the UK, is only a microcosm of the legal issues raised by the transition period – and which the UK and EU27 will hopefully have time to consider properly.

Barnard & Peers: chapter 27

Photo credit: Thousand Wonders

* *This blog post was supported by an ESRC Priority Brexit Grant on 'Brexit and UK and EU Immigration Policy'

Friday, 22 September 2017

A Renaissance of the Brexit talks? Theresa May’s Florence speech



Professor Steve Peers*

Today’s speech by Prime Minister Theresa May was widely understood to be an attempt to unblock the talks on the Brexit process, which have clearly become stalled, in particular over financial issues. Will her speech accomplish that aim? Or will its implicit attempt to reassure Leave voters in the UK, especially in the cabinet and the press, mean that it fails to unblock talks? And what does it tell us about the future of UK/EU relations?

The key feature of the talks is that they are sequenced. In an initial phase of talks, the main issues are: a) the position of EU27 citizens in the UK, and UK citizens in the EU27, after Brexit (discussed here); b) the extent of outstanding UK commitments to the EU; and c) the issue of the border between Ireland and Northern Ireland (discussed here). Only if the EU judges there to be ‘sufficient progress’ on these issues will the talks move to a second phase, about the future trade relationship between the EU and the UK and a transitional arrangement to bridge the gap between Brexit Day and that future arrangement.

As things stand, the EU will not judge there to be ‘sufficient progress’ in October, mainly because the UK has not accepted any specific financial commitments, although there has also been little progress in discussion of the Irish border and there are still gaps between the two sides’ positions on UK and EU27 citizens.

In that light, has May’s speech moved the UK closer to reaching the ‘sufficient progress’ threshold? On Northern Ireland, she simply observed that both sides wanted to avoid a ‘hard border’, but said nothing new about that. The UK’s proposals on novel customs methods to address the issue (by the government’s own admission) ‘blue sky thinking’, but she did not further flesh them out.

On the issue of EU27 citizens, she committed to setting out the withdrawal agreement into UK domestic law, and permitting the UK courts to take account of relevant ECJ case law. But this goes no further than the draft EU Withdrawal Bill, which already assumes (in Clause 9) that the withdrawal agreement will be transposed in domestic law and sets out (in Clause 6) that pre-Brexit ECJ case law binds lower courts (but not the UK Supreme Court, the government or Parliament) and that post-Brexit ECJ may be considered at a UK court’s discretion. While the Prime Minister made much of the excellence and independence of UK courts, she failed to mention the embarrassing recent refusal of the Home Secretary to give effect to a court order. So the EU27 side will still press for the ECJ’s involvement. Nor did she make any concessions as regards the substance of the law. 

On financial issues the Prime Minister said in effect that the UK would pay into EU funds to the end of the current EU budget cycle in 2020, during a transitional period after Brexit Day in March 2019 (see below). She also stated that the UK would honour commitments made during EU membership, although it is not clear if this is a reference to the broader issue of the UK’s share of costs in cases where the EU made a commitment in one year and paid for it in a later year. There are also other financial issues (off-budget funds, pensions, UK share of liability for loans that might not be paid).

More broadly, the Prime Minister supported the idea of a transitional period after Brexit Day of about two years, when the UK and EU would still trade on the same basis and apply the same security arrangements. The UK would still cease to be a formal EU Member State on Brexit Day – ceasing to participate in the EU’s political institutions – although some role for the ECJ seemed to be implicitly conceded. It should be noted that the EU27 side is also open to discussing a short transitional period as long as EU frameworks of enforcement, et al (including the ECJ) continue to apply. So there is broad agreement on the notion of a transitional period – subject to discussion of the details.

What about those details? Mrs May offered little about the substance, stating that EU27 citizens could still come to the UK during the transitional period but would have to register – as already permitted by the EU citizens’ Directive (see Article 8). Presumably the UK would have a customs union with the EU for the transitional period, although she said it would start to negotiate trade deals with non-EU countries. The transitional period could be terminated early on specific issues, for instance dispute settlement – an indication that the UK wants to end involvement with the ECJ as soon as possible.

Comments

Despite the attention paid to Mrs. May’s speech, the key question is whether the details of the UK’s negotiation position have changed. In particular, movement on those financial issues which were not expressly mentioned will be crucial determining whether talks move forward to trade issues in October. But the issue on enforcement of EU27 citizens’ rights will still remain a stumbling block, and the EU side will likely want to see some clarification of the UK’s proposals on customs and the Irish border.

The tone of the Prime Minister’s speech may help. It was civil, emphasising the importance of a future partnership between the UK and the EU, ruling out a rush to lower UK regulatory standards and with only brief mention of the discredited "no deal is better than a bad deal" mantra.

If the talks do move forward to transitional issues, this means there is no immediate need to discuss the technical questions of winding down UK/EU relations as of Brexit day, although they would still have to be discussed at some point if the UK and EU are going to change the substance of their relationship after that date. But this will mean that difficult issues of principle relating to the transitional period will have to be discussed.

What exactly is the transition period a bridge to? Which EU laws (if any) will no longer be applied? What if the transition time frame isn’t long enough? Would the UK be bound by new ECJ rulings during this period? Would it apply new EU legislation? Would the UK be consulted on it if it does? Would EU law apply in the same way as it does as an EU member? While the Prime Minister was anxious to rule out the ‘Norway model’ of EU/UK relations, the transitional period would nevertheless look somewhat like that model – except it appears that the UK would apply even more EU law than Norway does.

Overall, the Florence speech makes it somewhat more likely – but still far from certain – that there will be a conclusion to the Brexit talks, with no immediate ‘cliff edge’ for either side on Brexit Day. As always, the devil will be in the detail.

Barnard & Peers: chapter 27
Photo credit: The Telegraph

* *This blog post was supported by an ESRC Priority Brexit Grant on 'Brexit and UK and EU Immigration Policy'

Friday, 15 September 2017

Privacy at work: the Strasbourg Grand Chamber clarifies the law





Lorna Woods, Professor of Internet Law, University of Essex

Background

The case of Bărbulescu concerned the extent to which employers could track employee communications, including Internet use, when those communications might include private correspondence rather than business communications. Here, an employer dismissed an employee for failing to respect a prohibition on the use by employees of work equipment for private reasons. The employee sued his employer in the Romanian courts but lost, so brought a claim under Article 8 ECHR, which protects the right to private and family life, home and correspondence. In particular, Bărbulescu objected to the fact that, to find that he had violated the policy, his employer monitored his communications. This he claimed was contrary to the jurisprudence of the European Court of Human Rights in Copland v UK.  The Fourth Section of the Strasbourg court held, at the beginning of 2016, that the legal situation in Romania did not give rise to a violation of Article 8. While the media tended to summarise the position as the court permitting entirely unrestricted monitoring, this was not entirely the position as noted by Steve Peers here. The matter was in any event referred to the Grand Chamber and it is with this judgment that this note is concerned. The Grand Chamber came, albeit not unanimously, to the opposite conclusion from the Fourth Section, finding that there had been a violation of Article 8 ECHR.  So, why has it come to this conclusion?

Judgment

The Grand Chamber first considered the applicability of Article 8 to the situation in issue.  Re-iterating a long list of previous cases, it emphasised that Article 8 should not be understood narrowly and includes both the right to develop relationships with others and professional activities or activities taking place in a public context. The Court noted two further separate points. First it commented that:

[r]estrictions on an individual’s professional life may fall within Article 8 where they have repercussions on the manner in which he or she constructs his or her social identity by developing relationships with others [para 71].

In this context work is important in providing the possibility for individuals to develop relationships with others. Secondly, while ‘life’ in the list of interests protected by Article 8 is qualified by the adjective ‘private’, the term ‘correspondence’ is not so limited [para 72]. The Court noted that while the test of a reasonable expectation of privacy has been used to determine the scope of Article 8, it here re-iterated that is a significant though not necessarily conclusive factor [para 73]. The Court concluded that while the employee was aware of the ban, he was not aware of the monitoring; that some of the content was intimate in nature; that he alone had the password to the account. The Court left open the question of whether Bărbulescu had a reasonable expectation of privacy in the light of the employer’s policy (of which Bărbulescu was aware), but then held that ‘an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist …’ [para 80]. Both the right to private life and the right in relation to correspondence were therefore engaged.

The Court then considered whether there had been a violation. In this the Court was faced with the question of whether there was a positive obligation, given that the employer was not a public body. The Court noted that the monitoring of the communications could not be regarded as “interference” with Bărbulescu’s right by a State authority [para 109]. Nonetheless, the measure taken by the employer was accepted by the national courts, thus engaging the State’s positive obligations [paras 110-111]. It re-stated that the test was that of whether a fair balance had been struck between the competing interests. The Court noted that labour law has specific characteristics which allows for a wide margin of appreciation. This is not, however, unlimited; States must ensure that there are safeguards in respect of the monitoring of communications. It identified a number of issues:

-          Clear advance notification of the possibility of monitoring;
-          The extent of the monitoring and the degree of intrusion, taking into account the difference between monitoring ‘flow’ of communications and their content;
-          The justification for the monitoring;
-          Whether less intrusive mechanisms for monitoring exist;
-          The consequences for the employee;
-          Whether adequate safeguards were in place.

Further, there should be the possibility of a domestic remedy. The Grand Chamber took the view that the domestic courts did not consider or did not give appropriate weight to all the issues identified [para 140]. Notably, it did not appear the employer had given Bărbulescu sufficient advance notice of "the extent and nature of [its] monitoring activities, or of the possibility that [it] might have access to the actual content of his messages". The Court was also sceptical of the national courts acceptance of the justification for the intrusion. There was therefore a violation of Article 8.  There was dissent, however, on the assessment of the national courts’ approach to the matter.

Comment

The headline news from this is that the Grand Chamber came to a different determination on the issue of breach from the Fourth Section. It should be noted, however, that even that chamber did not suggest that unlimited monitoring would be permissible (see e.g. Steve Peers’ analysis). Nonetheless in purely practical terms, the Grand Chamber judgment provides a clear statement that workplace privacy cannot be reduced to zero, as well as a list of considerations that will be useful not just for national courts but also employers in considering policies regarding personal communications in the workplace. Note that this case concerned a private employer not – as in Halford and Copland – a public body as employer so the considerations highlighted will be of relevance to all employment relationships. In this, the Grand Chamber seemed to respond to some of the concerns expressed by Judge Pinto de Albuquerque in his dissent from the Fourth Section judgment regarding the factual specificity of the case. The judgment also seems to recognise the importance of work as part of daily life, an important point given the blurring of boundaries in the ‘always on’ culture of smart devices in which work-related information and communications co-habit with those of life outside work.

There are some further points to consider. The first is the scope of Article 8 and in particular the ‘reasonable expectation of privacy’.  Article 8 lists a number of aspects protected: ‘private and family life’ – usually seen as two separate elements ‘private life’ and ‘family life’ – ‘home’ and ‘correspondence’. As written, it seems that these are distinct elements yet the reasoning of the Court does not always treat them as separate; arguably the Court’s previous approach in making the matter one of a ‘reasonable expectation of privacy’ blurs any boundaries between these elements and in so doing, limits the scope of protection as far as ‘correspondence’ is concerned. The Grand Chamber seemed alive at least in some regards to this point: it specified that there is no requirement that correspondence be private. If that is the case, however, why is the issue of reasonable expectation of privacy relevant? Indeed, the Grand Chamber noted that the test of reasonable expectation of privacy is not the be all and end all of Article 8 (see para 78). Despite this recognition, the Grand Chamber still turned the question into one of a reasonable expectation of privacy:

It is open to question whether – and if so, to what extent – the employer’s restrictive regulations left the applicant with a reasonable expectation of privacy [para 80].

Is the Court here suggesting that correspondence is protected by Article 8 only when there is a reasonable expectation of privacy? Seemingly so, yet the Grand Chamber continued to state:

…. an employer’s instructions cannot reduce private social life in the workplace to zero. Respect for private life and for the privacy of correspondence continues to exist, even if these may be restricted in so far as necessary [para 80].

The position is consequently somewhat unclear. It would be more straightforward were the Court to recognise that correspondence constitutes a separate class aside from private life however broadly understood, and to deal with scope of Article 8 as a separate issue from that of interference and justification.  The current position unfortunately seems to be embedded in a long line of case law.
Bărbulescu is distinct from previous case law on employee monitoring in that it involved the State’s positive obligations. The Court has tended to adopt a different approach in regard to positive obligations than negative obligations. Rather than look at Article 8(2) and the tests of legitimate objective, lawfulness and necessity (in a democratic society), it adopts a fair balance test within which the State has a broad margin of appreciation. On this basis, the side-lining of the Copland ruling – which fell at the lawfulness stage in a standard Article 8(2) analysis – is understandable.  The Court seems to suggest, however, that there are parallels between positive and negative obligations:

[i]n both contexts regard must be had in particular to the fair balance that has to be struck between the competing interests of the individual and of the community as a whole, subject in any event to the margin of appreciation enjoyed by the State [para 112].

It is questionable whether the derogation from an individual’s rights by state actors really should be seen as being about a fair balance, a stance which arguably nudges the focus of protection away from human rights as paramount. Nonetheless, here the Court brings in factors from the standard Article 8(2) state surveillance case law aimed at preventing abuse of secret surveillance capabilities to provide guidance in finding the fair balance. It is noticeable that Copland is not considered but instead the State surveillance cases of Klass and Zakharov

It might be that the Grand Chamber accepted the referral because it wished to deal with failure of the Fourth Section to consider the EU Data Protection Directive, which protects against the collection of personal data without the explicit consent of an individual (or justified grounds for such collection).  This point was highlighted by Judge Pinto de Albuquerque. If so, the judgment fails to engage with EU data protection law in any meaningful way. The Grand Chamber noted that the national courts had considered the directive, but did not consider those rules themselves. Insofar as the Court does refer to international and European standards, it specifies the ILO standards and Council of Europe Recommendation CM/Rec(2015)5, rather than the Directive. It seems then that there has not been any direct engagement with the substantive EU data protection rules.


Photo credit: Aird and Berlis LLP

Thursday, 14 September 2017

The Privacy International case in the IPT: respecting the right to privacy?



Matthew White, PhD candidate at Sheffield Hallam University.

Introduction

On 21 December 2016, the Grand Chamber (GC) of the Court of Justice of the European Union (CJEU) in Cases C-203/15 and C-698/15 Tele2 and Watson ruled that blanket indiscriminate data retention was incompatible with European Union (EU) law. With that judgment, Professor Lorna Woods highlighted that this did not mean that the CJEU’s interpretation of the requirements of the Charter of Fundamental Rights (CFR) was ‘limited only to this set of surveillance measures.’ Hence, on 9 September 2017, the Investigatory Powers Tribunal (IPT) in Privacy International v the Secretary of State for Foreign and Commonwealth Affairs and Others handed down a judgment regarding the lawfulness under EU law of the acquisition and use of Bulk Communications Data (BCD) under s.94 of the Telecommunications Act 1984 (TA 1984) [4], including a request to the CJEU to answer further questions on EU law. This blog post concerns itself not with the preliminary reference itself, but the underlying flawed logic of the IPT’s reasoning with regards to fundamental rights protection.

The IPT’s faulty premise plagues its judgement from the beginning

The IPT highlighted that the issue before them was the balance between steps taken by the State, through Security & Intelligence Agencies (SIAs) and to ‘protect its population against terror and threat to life against the protection of privacy of the individual’ [6]. The premise of the IPT is deeply flawed from the outset thus impacting upon its reasoning. Daniel Solove has highlighted that ‘protecting the privacy of the individual seems extravagant when weighed against the interests of society as a whole’ (Daniel Solove, (2009) Understanding Privacy, Harvard University Press, p89). When privacy is confined to individualistic notions (particularly of ‘bad guys’), the argument for the departure of its protection becomes easier to justify, no less when that justification is protecting an entire nation.

Privacy is not just an Individual Right

Many (including Solove) have argued that privacy has a common, public and/or social value (Priscilla M. Regan, Legislating Privacy, Technology, Social Values and Public Policy, The University of North Carolina Press, 1995; Kirsty Hughes, ‘The social value of privacy, the value of privacy to society and human rights discourse’ in Beate Roessler and Dorota Mokrosinska (eds), Social Dimensions of Privacy Interdisciplinary Perspectives (Cambridge University Press). Privacy is a prerequisite for liberal democracies because it sets limits on surveillance by acting as a shield for groups and individuals (Alan F. Westin, Privacy and Freedom, New York: Atheneum (1967), p24). It is also important in that, in terms of voter autonomy and its attraction of talented people to public office (Hughes, p228-229). Privacy is also important for social relations (ibid, p229), even more so in that privacy invasive technologies can affect social life more generally (Beate Roessler and Dorota Mokrosinska, p2). A failure to protect social relations, is a failure to protect the democratic state (Francesca Malloggi. “The Value of Privacy for Social Relationships.” Social Epistemology Review and Reply Collective 6, no. 2 (2017): 68-77, p70).

These Powers do NOT just affect Individuals

Another problem with the IPT’s premise is that to argue that such measures as BCD acquisition/use only affect an individual’s privacy is simply not true. It should be obvious by the very name and nature of the powers that they are not targeted on individuals (para 2.1), something which the Respondents in Privacy International even attested to [9(ii)]. The draft BCD Code of Practice under the Investigatory Powers Act 2016 (IPA 2016) notes that ‘if the requirements of this chapter are met then the acquisition of all communications data generated by a particular CSP (Communications Service Provider e.g. BT, Google, iCloud) could, in principle, be lawfully authorised’ (para 3.5). Thus, any suggestion that the issue at hand only concerns an individual is palpably false. As the Grand Chamber (GC) of the European Court of Human Rights (ECtHR) in S and Marper v United Kingdom noted that the:

[M]ere storing of data relating to the private life of an individual amounts to an interference within the meaning [of Article 8]…subsequent use of the stored information has no bearing on that finding [67]. 

Due to the nature of the BCD powers, to say they only affect the individual is to ignore the reality of such sweeping powers which constitute mass interference of a ‘substantial portion, or even all of the relevant population’ [256] and do have chilling effects on totally innocent people (Rozemarijn van der Hilst, (2009), ‘Human Rights Risks of Selected Detection Technologies Sample Uses by Governments of Selected Detection Technologies’ p20; German Forsa Institute, Meinungen der Bunderburger zur Vorratsdatanspeicherung, 28 May 2008). Just like blanket data retention, BCD acquisition/use would ‘relate to all communications effected by all users, without requiring any connection whatsoever with’ [180] national security. 

Article 8 is not limited to Privacy

As ‘private life’ in Article 8 of the European Convention on Human Rights (ECHR) is not susceptible to exhaustive definition [66], this means that the notion is much wider than that of privacy (p12). This encompasses a sphere within which every individual can freely develop and fulfil his personality, both in relation to others and with the outside world (ibid). Private life also includes one’s physical and psychological integrity [58], autonomy [ibid] as well as a right to a form of informational self-determination [137], physical, social [159] and ethnic identity [58], professional activities [29], a certain degree of anonymity [42] and the protection of personal data (S and Marper, [103]).

This does not even begin to consider how such concepts overlap (p10-11). Nor is Article 8 limited to private life, as ‘correspondence’ [44] and the potential for ‘home’ [41] and family life (p21) (even more so now under the new regime of the IPA 2016 in light of the Internet of Things etc) are equally important in the surveillance context. The measure ‘strikes at freedom of communication between users of the postal and telecommunication services [41] because we increasingly use the internet to ‘establish and support personal relationships, bank, shop, to gather the news, to decide where to go on holiday, to concerts, museums or football matches. Some use it for education and for religious observance – checking the times and dates of festivals or details of dietary rules.’ Very few aspects of our lives are untouched by the internet (Paul Bernal, ‘Data gathering, surveillance and human rights: recasting the debate’ (2016) Journal of Cyber Policy, 1:2 243, p247).

Correspondence becomes particularly important when it affects legal professional privilege (LPP) and journalistic sources. This was a criticism of data retention laws in that it did not provide any exceptions for professional secrecy (Tele2 and Watson, [105]). The ECtHR in Kopp v Switzerland noted that Swiss law violated Article 8 because it provided ‘no guidance on how authorities should distinguish between protected and unprotected attorney-client communications’ [73-75]. BCD acquisition/use suffers from the same drawbacks.  

Thus, when the IPT refers merely to individual privacy, it does so without acknowledging the breadth and multifaceted nature of Article 8, or how surveillance measures impact on them in various ways, which limits their ability to give a thorough assessment resulting in a possible divergence from the ECtHR.

Confining the discussion to Privacy foregoes the broader context of Fundamental Rights Protection

[i]t is hard to imagine, for example, being able to enjoy freedom of expression, freedom of association, or freedom of religion without an accompanying right to privacy (Benjamin J. Goold, ‘Surveillance and the Political Value of Privacy’ (2009) 1:4 Amsterdam Law Forum 3, p4).

When Article 8 is confined to the narrow aspect of the privacy of a suspected terrorist, not only does it overlook the breadth of Article 8 (mentioned above) but it does not even entertain other fundamental rights that might be at stake. This is also a view the then Independent Reviewer of terrorism legislation, David Anderson acknowledged (para 2.12) and Paul Bernal (Paul Bernal). The CJEU were also aware of this to some degree in Tele2 and Watson where they noted that the data retention could have an effect on the use of means of electronic communication and, consequently, on the exercise by the users thereof of their freedom of expression, guaranteed in Article 11 of the CFR [101], which is essentially equivalent to Article 10 ECHR.

Article 10 ECHR: Freedom of Expression

Article 10 applies to communications via the internet [34] (in French), regardless of the message conveyed [55] and irrespective of its nature [47]. The ECtHR regards freedom of expression as constituting ‘one of the essential foundations of a democratic society and one of the basic conditions for its progress and for each individual’s self-fulfilment [100]. Not only does this highlight freedom of expressions value to democracy, it highlights one of the various ways in which Article 10 interplays with Article 8 i.e. self-development [117].

Another way in which Articles 10 and 8 interlink is that of anonymity, where Lord Neuberger noted that in the context of anonymous speech, Article 8 reinforces Article 10 (para 25). Within that context, Neuberger continued that Article 8 rights are of fundamental importance (ibid, para 42). Political reporting and investigative journalism attract a high level of protection under Article 10 [129]. The then Special Rapporteur for the United Nations of freedom of expression, Frank La Rue highlighted that that restrictions on anonymity can have a chilling effect, which dissuades the free expression of information and ideas (para 49).

Article 9 ECHR: Freedom of Religion, Thought and Conscience

Like Article 10, Article 9 is regarded as one of the foundations of a democracy [34]. Article 9 entails the freedom to manifest one’s religion can be done in public or in private [78]. It also includes the absolute and unconditional right to hold a belief [ibid, 79]. The right to manifest one’s belief has a negative aspect, in that an individual has a ‘right not to be obliged to disclose his or her religion or beliefs and not to be obliged to act in such a way that it is possible to conclude that he or she holds’ [41]. BCD acquisition/use makes this entirely possible (para 1.1), causing a notable chilling effect.

Article 11 ECHR: Freedom of Association/Assembly

The GC of the ECtHR has referred to freedom of assembly, like Article 9 and 10 as one of the foundations of a democratic society [91]. Similarly, freedom of association is of utmost importance because it ‘enables individuals to protect their rights and interests in alliance with others’ (p4). The Steering Committee on Media and Information Society (Sterling Committee) in their to human rights for Internet users when referring to Article 11 noted that users have ‘the right to peacefully assemble and associate with others using the Internet’ (para 61). Just as noted above with other Convention Rights, surveillance has harmful effects on freedom of association (see also Valerie Aston, ‘State surveillance of protest and the rights to privacy and freedom of assembly: a comparison of judicial and protester perspectives’ (2017) EJLT 8:1).

The enjoyments of the rights contained in Articles 9-11, which are foundations for democracy (especially online) are underpinned by Article 8.

How the premise impacts upon the IPT’s reasoning

Given the above mentioned, it is important to discuss how the lack of consideration for the potential effects on other fundamental rights affects the IPT’s reasoning.

It’s not all about Utility

The IPT discussed the evidence for supporting BCD acquisition/use, ranging from Anderson’s report, the case studies within them, Mi5 witness statements (Privacy International, [11-17]). The IPT makes reference to the critical value of BCD acquisition/use and the need for the haystack, in order to find the needle. A quick counter to the second point is ‘[i]f you’re looking for a needle in a haystack, how does it help to add hay?’ The problem with the needle in the haystack argument is that it could be used to justify any amounts of data to be stored/used, even all that is available.

Furthermore, this part of the judgement concerns what the IPT considers to be ‘The Facts’ yet on closer examination, not everything highlighted by the IPT are facts. For example, the IPT refers to the Respondents’ witnesses speaking persuasively and refers to an Mi5 witness. If the IPT were to regard witness statements as facts, then for example, Bruce Schneier’s, or former National Security Agency (NSA) official William Binney’s denunciation of mass surveillance should be given equal weight. There is no suggestion that this is what was (or should have been) presented before the IPT, but it highlights the weight given to opinions by the IPT. Discussing only the evidence of the Respondent also demonstrates the problematic information asymmetry in the surveillance context where:

[I]nformation asymmetrification provides a foundation on which the existence of elites is built and possibilities of strengthening that asymmetry will be enthusiastically sought (Geoffrey Lightfoot and Tomasz Piotr Wisniewski, ‘Information asymmetry and power in a surveillance society’ (2014) Information and Organization 24 214–235, p230).

Regarding the first point, the value of a measure does not necessarily make it necessary [48]. The IPT considers that although BCD acquisition/use is essential, this does not completely resolve the question of proportionality (Privacy International, [16]). Lord Kerr in his dissenting opinion in Beghal v DPP quite rightly noted that ‘powers which can be used in an arbitrary or discriminatory way are not transformed to a condition of legality simply because they are of proven utility’ [93]. Although the IPT did find s.94 not to be compliant with Article 8 prior to its avowal, this follows a trend of watering down the prescribed by/in accordance with law requirements noted in Kennedy v United Kingdom in where for the IPT, honesty appears to be synonymous with legality.

Moreover, the supporting evidence for BCD acquisition/use does not refer to what type of communications data was used, how it was used, or why it was key. The IPT noted that nothing in the evidence they examined contradicts what was set out in paragraphs 11-16. This is problematic for two reasons, if the IPT only considered evidence from the Respondent, then it would make sense that there is less likelihood that evidence presented would contradict arguments put forward, and thus becomes a one-sided argument. Secondly, as Bruce Schneier noted ‘no method of surveillance or inquiry will ever stop a lone gunman.’ Although, the murder of Fusilier Lee Rigby involved two assailants, the Intelligence and Security Committee (ISC) noted that Mi5 ‘put significant effort into investigating [Michael Adebolajo] and employed a broad range of intrusive techniques. None of these revealed any evidence of attack planning.’ What this demonstrates is the contrary view that all the surveillance in the world did not prevent individuals ‘such as the Fort Hood shooter, or Anders Behring Breivik, or the Charlie Hebdo attackers.’ Therefore, the IPT draws attention to its obscured view given that it has inquisitorial powers (s.68(2)(b) of the Regulation of Investigatory Powers Act 2000 (RIPA 2000)) and could have sought information regarding counter arguments.

No Genuine Intrusion?

When the IPT discussed the operation of s.94 TA 1984, they noted that access to BCD is either targeted or more likely to involve electronic trawling of masses of data which are not ‘read’ to find the needle in the haystack (Privacy International, [19]). The IPT continues that a ‘miniscule quantity of the data trawled is ever examined. There is thus no genuine intrusion to any save that miniscule proportion’ (ibid). This reasoning of the IPT is almost as if the UK exists in a vacuum when it comes to the findings of the GC in S and Marper. The IPT’s reasoning is that only when communications data is accessed/examined, then follows genuine intrusion. This is why confining the issue to privacy proves problematic because the GC in S and Marper noted that the protection of personal data is of fundamental importance to the enjoyment of private and family life. This protection begins as soon as the data is processed and retained, thus marks the genesis of genuine intrusion, any subsequent use has no bearing on this. The IPT’s reasoning follows the sentient being argument which suggests that privacy is only interfered with when private data is read by an intelligence officer. Following this argument would lead to the logical conclusion of sowing the seeds of the total destruction of private life and data protection as surveillance becomes increasingly automated e.g. by analogy automatic number plate recognition (ANPR) [169-170], see also CJEU Opinion on PNR [121-132]. Using last century’s arguments (if one could even call it that) are not suitable today.

The IPT maintains the approach of significantly downplaying the severity of interference caused by storing and using communications data. The IPT had previously accepted a false analogy from the Respondent of equating GPS data (a particular type of communications data) with communications data in general to argue that it is not as serious as interception (Matthew White, ‘Protection by Judicial Oversight, or an Oversight in Protection?’ (2017) Journal of Information Rights, Policy and Practice 2:1, p9). This was argued that when giving weight to this position:

[I]t did so by considering a case of an isolated specific type of data, which cannot be used to justify an argument that interference is less severe whilst ignoring the cumulative total of the different types of communications data (ibid).

Malte Spitz of the German Green party published data that was retained under Germany’s data retention laws in which Zeit Online created an interactive map detailing Spitz’s movements. Biermann continued that this data revealed:

[W]hen Spitz walked down the street, when he took a train, when he was in an airplane. It shows where he was in the cities he visited. It shows when he worked and when he slept, when he could be reached by phone and when was unavailable. It shows when he preferred to talk on his phone and when he preferred to send a text message. It shows which beer gardens he liked to visit in his free time. All in all, it reveals an entire life.

Advocate General (AG) Saugmandsgaard Øe in Tele2 and Watson noted that that in the individual context a general data retention obligation would facilitate equally serious interference as targeted surveillance measures, including those which intercept the content of communications [254]. AG Saugmandsgaard Øe continued that the risks associated with access to communications data ‘may be as great or even greater than those arising from access to the content of communications’ [259]. For example, replying to an email saying ‘lmao’ my not reveal much to an observer, but the observer could learn what email address the message was sent from and to, the time and date that message was sent, the location of when it was sent, what browser was being used and what device was being used etc. This simple analogy demonstrates why yet again the IPT are incorrect to downplay the revealing nature of communications data given that people get killed based on it. This seriousness only intensifies when the acquisition/use is in bulk.

Powerful Submissions?

The IPT highlighted the powerful submissions (hence very persuasive (Privacy International, [51])) made by the Respondent:

The use of bulk acquisition and automated processing produces less intrusion than other means of obtaining information.
The balance between privacy and the protection of public safety is not and should not be equal. Privacy is important and abuse must be avoided by proper safeguards, but protection of the public is preeminent.
The existence of intrusion as a result of electronic searching must not be overstated, and indeed must be understood to be minimal.
There is no evidence of inhibition upon, or discouragement of, the lawful use of telephonic communication. Indeed the reverse is the case.
Requirements or safeguards are necessary but must not, as the Respondents put it, eviscerate or cripple public protection, particularly at a time of high threat [50].

It is important to deal with these points individually (some of which are already dealt with above).

The Respondents maintain that BCD acquisition/use is less intrusive than other methods of gathering information without explaining what other methods are more intrusive or why and why this is the least restrictive measure to obtain the objective [260].

As noted above, this is not just an issue of narrow privacy, but an issue of other applicable fundamental rights protected by the ECHR. The premise of the balance between privacy and public safety i.e. security is a miscast (Paul Bernal, p244), misleading (ibid) and false (see here, here and here) one to begin with. It ignores factors that demands for security can actually reduce security therefore, safety (Paul Bernal, p224; Harold Abelson et al, Keys under doormats: mandating insecurity by requiring government access to all data and communications. Journal of Cybersecurity, 2015, 1–11, p5) and otherwise prove ineffectual (see here and here). It also suggests that privacy should always be on the back foot when the issue concerns the protection of the public, when the irony is that it’s the publics’ data that is being acquired and used (see social dimension of privacy above which protects against utilitarian calculation of majoritarian societal interests and/or political whims (Kirsty Hughes, p 227)). It also assumes that when Convention Rights are a stake, the only question that needs to be answered is whether the appropriate balance has been struck, forgoing legality and necessity.

These types of arguments would seemingly fall into the narrow nothing-to-hide-like argument that looks for singular type of injury, be it some grave physical violence, a loss of substantial money or something severely embarrassing (Daniel Solove. Nothing to Hide: The False Tradeoff between Privacy and Security (2011). Yale University Press, p29). This of course also ignores both European Courts on the severity of the mere storage of data interfering with private/family life/freedom of expression/association [107] and data protection.

Contrary to what the Respondents assert, there is evidence for chilling effects due to surveillance measures, some highlighted above. Moreover, assessing chilling effects should not just be measured by inhibitions, but actual methods of protecting online activity. There was An increase in Virtual Private Network (VPN) (this essentially aims hide online activity) subscriptions in Australia when their national data retention laws came into force and in the UK when the IPA 2016 and Digital Economy Act 2017 (DEA 2017) were in passing. Or by the increasing the use of ad blockers, which 11 million devices in the UK now have. As Edward Snowden revealed ‘government surveillance efforts are sometimes bolstered by online advertising practices.’ Moreover, Solove contends that the value of protecting against chilling effects is not measured simply by its effects on individuals exercising their rights, but its harms to society because among other things ‘they reduce the range of viewpoints expressed and the degree of freedom with which to engage in political activity’ (Daniel J. Solove, ‘’I’ve Got Nothing to Hide’ and Other Misunderstandings of Privacy’ (2007) San Diego Law Review 44 745, p746). It is true that the uptake in technology has increased e.g. smartphones but this does not necessarily disprove the idea of chilling effects etc. This is due to ignoring the fact that many may not be fully aware of what information is being collected (Sandra Braman, 2006, Tactical memory: The politics of openness in the construction of memory Sandra Braman. First Monday, 11(7); Connor Sheridan, (2016) "Foucault, Power and the Modern Panopticon". Senior Theses, Trinity College, Hartford, CT 2016. Trinity College Digital Repository, p48; Majority of Brits Unaware of Online Surveillance) where awareness leaves open the possibility of resistance (Andrew Roberts, Privacy, Data Retention and Domination: Digital Rights Ireland Ltd v Minister for Communications, (2015) 78(3) MLR 522–548, p545). This resistance could be not using the technology, to finding ways to circumvent surveillance law (self-regulatory), protests (Hintz, A. & Dencik, L. (2016). The politics of surveillance policy: UK regulatory dynamics after Snowden. Internet Policy Review, 5(3), p8) (political), or legal action all designed to protect fundamental rights.

This is the ‘the ends justify the means’ justification. Not every interference or derogation from the principle of protection of fundamental rights are necessary in a democratic society.

Prior Authorisation
The IPT noted that Secretary of State authorisations complied with the ECHR for reasons set out in a prior judgment. The IPT were of the opinion that the ECtHR in Szabo & Vissy v Hungary were not recommending any new safeguards because Hungarian law fell below even existing principles [60]. This of course does not consider cases such as Dumitru Popescu v Romania [71-73], Iordachi and Others v Moldova [40], and Uzun v Germany [72] all endorsing the view that the body issuing authorisations for interception should be independent and that there must be either judicial control or control by an independent body over the issuing body's activity.

So, when the ECtHR in Szabo endorses the view in Iordachi that ‘control by an independent body, normally a judge with special expertise, should be the rule and substitute solutions the exception, warranting close scrutiny’ [77] it is difficult to suggest the ECtHR in Szabo were not strongly advocating for prior judicial control (Matthew White, p15). The ECtHR did acknowledge that post factum oversight may counterbalance the short comings of initial oversight (referring to the IPT in Kennedy) (Szabo, [77]). However, it has already been argued that this counterbalance is not adequate (Matthew White, p14-16).

Notification

According to the IPT, a requirement of notification is inadequate in the circumstances of national security because (a) national security is ongoing and (b) it relates to further operations and methodologies (Privacy International, [62]). The IPT also noted that this is not required for compliance with the ECHR [63]. This, however, overlooks Association for European Integration and Human Rights and Ekimdzhiev v Bulgaria where the ECtHR found violations of Article 8 and 13 (effective remedy) for among other things, a lack of a notification procedure [94] and [103]. Yet Ekimdzhiev concerned national security and the ECtHR even referred to the notification in the national security context in Germany for both individual (Klass v Germany, [11] and general surveillance measures (Weber and Saravia v Germany, [51-54] and in Leander v Sweden [31]). This is permissible due to the ECtHR establishing the principle that:

[A]s soon as notification can be made without jeopardising the purpose of the surveillance after its termination, information should be provided to the persons concerned (Ekimdzhiev, [90]).

This establishes that to the ECtHR’s mind, notification in the national security context is not inappropriate or inadequate considering this has been the practice of Germany for decades. Furthermore, the ECtHR acknowledge that it would not be desirable in all circumstances to notify, therefore leaving that possibility open whereas the IPT would prefer it kept shut. Also, in the national security context, the GC of the ECtHR in Roman Zakharov v Russia noted that notification was inextricably linked ‘to the effectiveness of remedies before the courts and hence to the existence of effective safeguards against the abuse of monitoring powers’ [234]. A point in which Paul de Hert and Franziska Boehm share.

Although the GC referred to the alternative to notification of the UK system i.e. the IPT jurisdiction (Roman Zakharov, [234]), de Hert and Boehm have questioned whether Kennedy ‘is capable of responding to the challenges arising out of the use of new surveillance techniques’ (Franziska Boehm and Paul de Hert, The rights of notification after surveillance is over: ready for recognition? (Yearbook of the Digital Enlightenment Forum, IOS Press 2012), pp. 19-39, p37). Boehm and de Hert continue that in light of powers such as data retention and ‘fishing expeditions’ that target a greater number of people without suspicion, a notification duty appears to be an effective tool to prevent abuse (ibid, p37-8). Finally, Boehm and de Hert note that the Belgian Constitutional Court has now adopted the notification principle as a requirement to comply with Article 8 (ibid, p38). The IPT highlights difficulties with the notification of BCD acquisition/use as to whether notification should be to everyone whose data is in the database, those subject to an electronic search or all those who feature in data in targeted access (Privacy International, [64])? Accepting this premise would accept the powers that are exercised to begin with, which is at the heart of this issue.

Conclusions: Be careful what you wish for

Ultimately, the IPT referred the question as to whether the Tele2 and Watson requirements apply in the national security context to the CJEU (ibid, [72]). This blog post has argued that much of the IPT’s reasoning with regards to fundamental rights protection is lacking. By confining itself to a restrictive notion of individual privacy of a person of interest, the IPT blinds itself to the broader notions of Article 8 and the other fundamental rights it underpins. Some aspects of the IPT’s reasoning (and Respondent’s arguments) is not even consistent with the very human rights system (ECHR) the Respondents are seeking to rely upon. The ECtHR have firmly noted that:

Given the technological advances since the Klass and Others case, the potential interferences with email, mobile phone and Internet services as well as those of mass surveillance attract the Convention protection of private life even more acutely (Szabo, [53]).

The GC in Roman Zakharov found that Russian law to be in violation of Article 8 because interferences with privacy rights were ordered ‘haphazardly, irregularly or without due and proper consideration’ (Roman Zakharov, [267]) in the national security context. Judge Pinto de Albuquerque noted that Roman Zakharov was a rebuke of ‘strategic surveillance’ (Szabo, Concurring Opinion of Judge Pinto de Albuquerque, [35]) which would accord a previous concurring opinion of judge Pettiti in which surveillance should not be used for ‘fishing’ exercises to bring in information (Kopp). If as the IPT say that a ‘miniscule quantity of the data trawled is ever examined’ how would this square with the position of ‘[t]he automatic storage for six months of clearly irrelevant data cannot be considered justified under Article 8’ (Roman Zakharov, [255])? Time will tell if the ECtHR follows this trend in Big Brother Watch and Others v UK, Bureau of Investigative Journalism and Alice Ross v UK and 10 Human Rights Organisations v UK. Therefore, the IPT should not convince itself of the ‘illusory conviction that global surveillance is the deus ex machina capable of combating the scourge of global terrorism’ (Szabo, Concurring Opinion of Judge Pinto de Albuquerque, [20]). Surveillance has never just been an issue of privacy, or private life or else the ECtHR would never have uttered its awareness:

[O]f the danger such a law poses of undermining or even destroying democracy on the ground of defending it, affirms that the Contracting States may not, in the name of the struggle against espionage and terrorism, adopt whatever measures they deem appropriate (Klass, [49]).

Barnard & Peers: chapter 9

Photo credit: Pixabay