Wednesday, February 26, 2014

PRISM and TEMPORA before the European Court of Human Rights - Big Brother Watch and others v UK

As was to be expected, a case regarding the mass surveillance of e-mails and other communication by the American NationalSecurity Agency (NSA) and the British Government Communications Headquarters (GCHQ) have reached the European Court of Human Rights. Four applicants have submitted an application against the UK in which they contend that the collection of information on internet based communication by the British intelligence agency and the obtaining of information from the NSA breaches their rights under article 8 ECHR.

The applicants are Big Brother Watch, an organization dedicated to data protection and privacy rights, the British section of the writers’ association PEN, Open Rights Group, which advocates for freedom of expression and Constanze Kurz, a German expert on data protection and internet communication.

Edward Snowden has revealed that the United States National Security Agency has put into place programs (PRISM, UPSTREAM) for the large-scale monitoring of internet based communication such as e-mails, chats, video transmissions etc. The programs allow for the scrutiny of the content of communication as well as the storage and analysis of so called metadata, i.e. information about participants of communication, IP addresses, place and times.

According to the information provided by Edward Snowden, the British intelligence service was granted access to the data which had been obtained by the NSA. In addition to that, it was uncovered following Snowden’s leaks that the British Government Communication Headquarters had run its own surveillance program, called TEMPORA. It had concerned the strategic monitoring of e-mails and other communications over the internet - that means the interception of a large number of e-mails and its analysis and scrutiny on the basis of certain key words and phrases.
The applicants contend that their rights under article 8 ECHR have been infringed upon in two ways:

  • Firstly, according to them, the British intelligence service has monitored their communication without sufficient legal basis.
  • Second, it has obtained information on their communication via the internet from the NSA without sufficient legal basis.

The Court has communicated the case to the British government; it has provided a summary of the main facts of the case and invited the parties to submit their observations on three questions, which the Court considers particularly relevant for the outcome of the case. Two of the questions concern the admissibility, the other  the merits.
With regard to the admissibility, the Court put the question whether the applicants can claim to be victims of violations of their rights under article 8 ECHR.  This refers to the requirement laid down in article 34 ECHR, which sets out that applicants must claim to be a victim of the violation of a right under the European Convention on Human Rights.
Applicants cannot request an abstract scrutiny of legal acts or actions they consider to be contrary to the ECHR; there is no ‘actio popularis’ under the Convention. Applications are only admissible if applicants can substantiate that they are directly affected by an action of the state. However, applying this requirement strictly would put the applicant in a very difficult situation when measures are concerned which are usually applied in secret. The applicant cannot know whether he is subjected to such measures and unable to substantiate his suspicion that he is. As a consequence, secret measures – such as the interception of communication – would in practice be immune to scrutiny by the Court and individuals bereft of protection.
In order to enable control of secret measures by the Court and ensure that the protection afforded by article 8 ECHR is effective, the European Court of Human Rights has lowered the bar for the admissibility of applications in this area.
 ‘to the extent that a law institutes a system of surveillance under which all persons in the country   concerned can potentially have their mail and telecommunications monitored, without their ever knowing this unless there has been either some indiscretion or subsequent notification, it directly affects all users or potential users of the postal and telecommunication services in that country. The Court therefore accepted that an individual may, under certain conditions, claim to be the victim of a violation occasioned by the mere existence of secret measures or of legislation permitting them, without having to allege that such measures were in fact applied to him or her’.

In Iordachi v Moldova, the European Court of Human Rights held that the applicants could claim to be victims of phone interceptions because they were human rights lawyers  and their communication was likely to be incepted due to their regular contacts with persons accused of criminal offences.

All four applicants claim that their communication is likely to be subjected to surveillance, because they are outspoken critics of policies applied in relation to national security, of interference with private communication and civil liberties and because they maintain frequent contacts with persons advocating for individual freedom and critical of governments and security services.

The second question asked by the Court regarding the admissibility concerns the exhaustion of domestic remedies. Prior to submitting an application to the European Court of Human Rights, applicants have to avail themselves of all domestic remedies which are accessible and effective (article 35 ECHR). This reflects the principle that the control by the Court is subsidiary. Before having to answer to an international institution, states shall be given the opportunity to iron out mistakes on their own. But applicants only have to exhaust such legal remedies which are effective, that means which bear the prospect of succeeding.

In the UK, the interception of communication is governed by the Regulation of Investigatory Powers Act. This act provides for a court, the Investigatory Powers Tribunal (section 65 of the act), which is mandated to oversee the interception of communications.

If courts in the UK deem that a legal provision contravenes the Convention, they can in general make a statement of incompatibility (see section 4 of the Human Rights Act), which does not make the provision in question inapplicable, though. The European Court of Human Rights asked the parties whether the Investigatory Powers Tribunal could have made such a statement and whether this would have been an effective domestic remedy.

The next question asked by the European Court of Human Rights concerns the merits of the case. The Court distinguishes between the receipt of data from the US, their storage, analysis etc. on the one hand and the interception of data, their storage etc. by the British intelligence agency on the other hand.

With regard to both measures, the Court invited the parties to submit observations whether they were ‘in accordance with the law’ and ‘necessary in a democratic society’.

The interception of communications interferes with the right to private life and the right to respect for correspondence, which are enshrined in article 8 paragraph 1. As other articles of the Convention, article 8 ECHR provides that interferences with the rights it protects are justified if they are in accordance with the law, serve certain objectives specified in the article and are necessary in a democratic society.

In accordance with a law does not only require the existence of a law, but also refers to the quality of the legal basis of an interference. The European Court of Human Rights has set out in a number of decisions the criteria which legal acts allowing for the interception of communication have to satisfy (e.g. Kennedy v UK, Weber and Saravia v Germany ). For example, the pertinent laws and regulations have to be publicly accessible (Liberty v UK), they have to limit the duration of interceptions, they have to define clearly in which circumstances interceptions are permitted, they have to contain clear regulation regarding the storage, deletion and security of data obtained and they have to provide effective mechanisms for external control (more detailed information can be found here).

Now the parties will submit their observations on these questions for the Court to decide.

No comments:

Post a Comment