BPD/BCD : IPT Judgment October 2016
Updated on 7 October 2020
The Investigatory Powers Tribunal, following PI’s lawsuit, ruled that acquisition and use of bulk personal datasets (BPD) and bulk communications data (BCD) conducted in secret by Intelligence Agencies (MI5, MI6 and GCHQ) before avowal in 2015 had not been legal. The decision emphasised the importance of transparency and legal regulations of such practices and opened new opportunities for advocacy to civil society.
On 17 October 2016, the Investigatory Powers Tribunal handed down judgment in a case brought by Privacy International against the Foreign Secretary, the Home Secretary and the three Security and Intelligence Agencies (MI5, MI6 and GCHQ).
The case concerned the Agencies’ acquisition and use of bulk personal datasets (‘BPD’) – datasets that contain personal data about individuals, the majority of whom are unlikely to be of intelligence interest, such as passport databases and finance-related activity of individuals. It also concerned the acquisition under s. 94 of the Telecommunications Act 1984 of bulk communications data (‘BCD’), which includes the “who, when, where and how” of both telephone and internet use and the subsequent use of this data.
The existence of the BPD and BCD regimes was initially secret. The BPD regime was first publicly acknowledged in March 2015, and the BCD regime in November 2015.
The Tribunal held that the Intelligence Agencies had breached Article 8(2) of the European Convention of Human Rights in respect of both the BPD and BCD regimes from their commencement until their public avowal in 2015. The Tribunal held that, during this period, there was not sufficient foreseeability or accessibility of the existence of the BPD and BCD regimes, nor of the nature of controls over them; in consequence, the regimes could not be said to be “in accordance with law”.
However, the Tribunal held that the power in s. 94 of the Telecommunications Act 1984 was able, as a matter of domestic law, to provide a legal basis for the BCD regime. The Tribunal also held that, once the regimes had been made public and a more adequate system of supervision had been implemented, both regimes satisfied the requirement of being “in accordance with law” for the purposes of Article 8(2) ECHR.
A number of outstanding issues have been adjourned to a subsequent hearing, including to determine whether the Agencies’ actions were proportionate, and to consider whether the regimes were in compliance with EU law.
The full judgment can be read here.
