PI and Liberty submit a new legal challenge after MI5 admits that vast troves of personal data was held in “ungoverned spaces”

In mid-2019, MI5 admitted, during a case brought by Liberty, that personal data was being held in “ungoverned spaces”. Much about these ‘ungoverned spaces’, and how they would effectively be “governed” in the future, remained unclear. At the moment, they are understood to be a ‘technical environment’ where personal data of unknown numbers of individuals was being ‘handled’. The use of ‘technical environment’ suggests something more than simply a compilation of a few datasets or databases.

The longstanding and serious failings of MI5 in relation to these ‘ungoverned spaces’ first emerged in PI’s pre-existing case (Privacy International v Secretary of State for Foreign and Commonwealth Affairs and others), started in November 2015, which challenges the processing of bulk personal datasets (BPDs) and bulk communications data (BCD) by the UK Security and Intelligence Agencies.

In the course of these proceedings, it was revealed that PI’s data were illegally held by MI5, among other intelligence and security agencies. Then MI5 decided to delete PI’s data before the on-going investigation was completed.

In proceedings brought by Liberty against the bulk surveillance powers contained in the Investigatory Powers Act 2016 (IPA), MI5 admitted that personal data was being held in ‘ungoverned spaces’, demonstrating a known and continued failure to comply with both statutory and non-statutory safeguards in relation to the handling of bulk data since at least 2014. Importantly, documents disclosed in that litigation, and detailed in our Complaint, showed that MI5 had sought and obtained bulk interception warrants on the basis of misleading statements made to the relevant authorities.

In this new complaint, PI and Liberty argue that MI5’s data handling arrangements result in the systematic violation of the rights to privacy and freedom of expression (as protected in Articles 8 and 10 of the European Convention of Human Rights) and under EU law. Furthermore, we maintain that the decisions to issue warrants requested by MI5, in circumstances where the necessary safeguards were lacking, are unlawful and void.

This challenge also seeks to partially amend PI’s existing claim against MI5.

PI’s Legal Director Caroline Wilson Palow said: “For more than a decade, MI5 has been building massive datasets by systematically collecting our personal information. Such practices are a serious interference with our right to privacy and threaten democratic values. We were promised that robust safeguards were in place so that such data would never be abused. Yet it turns out that those safeguards were in some cases illusory - that MI5 held significant data in ungoverned spaces without any effective oversight. We are bringing this challenge together with Liberty to ensure that MI5 does not continue to operate outside of the law.”