R (on the application of Privacy International) v. The Commissioner for HM Revenue & Customs (Gamma FinFisher Exports)

UK High Court

Case No. CO/4089/2013

Status: Closed

In August 2012, Privacy International began an investigation into Gamma International, a UK-based surveillance company that was exporting the invasive spyware FinFisher to repressive regimes with poor human rights records. As part of that investigation, Privacy International sought further information regarding FinFisher's export from the UK government and the Department of Business, Innovation and Skills confirmed that products in Gamma’s ‘FinSpy’ suite of hacking software do fall within the scope of the UK’s export control regime. They further informed Gamma of this fact in August 2012.

However, despite the fact that FinSpy had by that point been on the market for six years, and that companies are legally obliged to request export licence classifications, Gamma had only submitted a Control List Classification enquiry (CLC) asking the government whether or not they needed export licences for the product in July 2012.

Privacy International then submitted a 186-page dossier of evidence against Gamma to HM Revenue and Customs, the body responsible for overseeing the enforcement of export regulations, and called for an investigation. Despite this overwhelming evidence, HMRC categorically refused to provide any details regarding any investigation into Gamma’s export practices, arguing it is statutorily barred from releasing information to victims or complainants.

As a result, in May 2013, Privacy International filed for judicial review of HMRC's decision, arguing that the body acted unlawfully, either because it misconstrued the law to justify its evasive practices, or because it issued a blanket refusal without considering the facts of the case at hand. 

In May 2014, the Administrative Court declared that HMRC acted unlawfully and “irrationally” in issuing blanket refusals into the status of any investigation into the potentially illegal export of the FinFisher. The ruling found that HMRC had committed a serious error in not providing information about whether it was investigating Gamma for illegal exporting spyware to repressive regimes. Describing the actions of HMRC as “irrational” and “simply inconsistent with the legislation”, the judgment quashed HRMC’s decision and ordered it to again consider Privacy International’s request.

The judgment provides clear authority that the public is entitled to know what HMRC is doing to investigate and if appropriate prosecute companies that are sending surveillance technologies to countries where it is likely to be used for human rights abuses. It also establishes the important principle that NGOs and pressure groups such as Privacy International, just like the press, “act as guardians of the public conscience” and play a significant role in ensuring transparency and enforcing legal rights in court. As such, Mr Justice Green remarked, “the rationale which justifies the provision of information by HMRC to the press applies in large measure to disclosure of information to pressure groups and other NGOs”.