Landmark ruling “exposes years of rule-breaking” by MI5

Human Rights organisations Liberty and Privacy International, who brought this significant legal case in January 2020, have welcomed the ruling, which accepted their argument that, in breach of key legal safeguards, MI5 unlawfully handled individuals’ private data that was gathered by secret surveillance.

Under the Investigatory Powers Act, which is frequently referenced as the Snoopers’ Charter, state bodies including MI5 are allowed to collect and store wide-ranging data on any member of the public. The Investigatory Powers Tribunal has recognised that large amounts of data were unlawfully retained.

During the claim, MI5 admitted it stored the public’s data improperly when it had no legal right to do so, and also that the organisation had failed to disclose this fact to the Home Office and oversight bodies. The Tribunal also found that the Home Office, in addition to various Home Secretaries, overlooked and failed to investigate MI5’s breaches, despite having information to hand indicating that MI5 was acting outside of the law from as early as 2016.

Throughout the hearing, Liberty and Privacy International proved that successive Home Secretaries repeatedly ignored the signs of MI5’s unlawful handling of data and continued to sign-off on surveillance warrants unlawfully. Surveillance warrants must be approved by the Home Secretary and can only be approved if the Home Secretary is satisfied that legal safeguards around the handling of data are being met.

During the judgement hearing, the Investigatory Powers Tribunal affirmed: “Given reports of long-standing non-compliance risks, it was irrational of the Secretary of State to fail to make enquiries.” Therefore, according to Liberty and Privacy International, multiple Home Secretaries acted unlawfully in granting warrants to MI5 from 2016 through to April 2019.

Failure to disclose

The Investigatory Powers Tribunal said: “The failure of the Management Board [of MI5] not to disclose the compliance failings… was a serious misjudgement” and went on to state: “On consideration of the evidence… it’s clear that MI5 had not been forthcoming on the nature, scale and seriousness of the compliance risks.”

The Investigatory Powers Tribunal also found a breach of duty of candour by dint of MI5 failing to report its unlawful handling of bulk communications data to the Tribunal during a case brought by Privacy International against MI5 that challenged the latter’s mass surveillance powers. As a result of MI5’s lack of candour, the case may be reopened.

Further, the Investigatory Powers Tribunal made declarations that MI5 and the Home Secretary had acted unlawfully under the Investigatory Powers Act, the European Convention on Human Rights and retained European Union law. It refused to grant further relief, including the quashing of warrants issued during the period of unlawful handling and the Home Office’s failed oversight, destruction of data and damages.

Although information on whose data has been mishandled is unavailable, it’s likely to include that belonging to many individuals who are not suspected of any wrongdoing due to the nature of the broad surveillance powers afforded to MI5.

Basic rights

Liberty’s lawyer Megan Goulding observed: “We all want to have control over our personal information and data. MI5’s deliberate law-breaking is yet another example of how the dangerous powers granted under the Snoopers’ Charter do not work for the public. The Government and the security services routinely violate our basic rights to privacy and free expression when they spy on us.”

Goulding continued: “We are pleased that the Investigatory Powers Tribunal has found that MI5 has been mishandling our data, storing it when that shouldn’t have been done and that the Home Secretary has been unlawfully granting warrants. This judgement confirms what we at Liberty, and others, have been saying for years. Specifically, that surveillance safeguards are not fit for purpose and fail to protect our fundamental privacy rights.”

Further, Goulding noted: “For years, MI5 knowingly broke the rules and failed to report this. The internal oversight body did not detect the law-breaking and the Government failed to investigate clear red flags. Instead, the Home Office continued to issue unlawful warrants, while MI5 kept information from the authorities concerning the mishandling of our data.”

According to Goulding, mass surveillance doesn’t make us safer. “The security services shouldn’t be allowed to spy on us and collect our data. These powers breach our privacy and undermine core pillars of our democracy. This judgement has shown that the so-called safeguards are totally ineffective in protecting our rights and holding those in power to account. Now is the time for the Government to step up and create restrictions to protect our privacy rights.”

Serious intrusion

Caroline Wilson Palow, legal director at Privacy International, said: “We’ve been here many times before. UK intelligence agencies seriously intrude on thousands or even millions of people’s privacy. We call them out on this, then the Government promises better safeguards. This latest ruling is particularly troubling because it confirms that those safeguards can be illusory. MI5 failed to follow them for years, with successive Home Secretaries ignoring signs of them breached as well.”

Wilson Pallow went on to state: “The judgement also acknowledges that MI5 breached its duty of candour to the Investigatory Powers Tribunal in a previous case by withholding crucial information, which calls past decisions into question. These are not technical breaches. At its highest levels, MI5 systemically disregarded the law, while the Home Office’s failure to do anything green-lighted their activities. Nothing good comes of unchecked power being exercised by Government intelligence agencies operating in the shadows. It’s undemocratic and dangerous to our rights to give the MI5 a free pass.”

In conclusion, Wilson Pallow explained: “While we are pleased that the Investigatory Powers Tribunal has recognised MI5’s serious failures, we’re disappointed that they did not go further to remedy them. What’s important now, though, is that the Government recognises we are entitled to real protections for our privacy and takes action to safeguard them.”

*Tom de la Mare KC, Ben Jaffey KC, Daniel Cashman and Gayatri Sarathy of Blackstone Chambers and David Heaton of Brick Court Chambers, Megan Goulding and Mark Scott acted for Liberty and Privacy International