Press: Landmark ruling exposes years of rule breaking by MI5

In a landmark judgment, handed down today (Monday 30 January 2023), the Investigatory Powers Tribunal have found that there were “very serious failings” at the highest levels of MI5 to comply with privacy safeguards from as early as 2014, and that successive Home Secretaries did not to enquire into or resolve these long-standing rule-breaking despite obvious red flags.
Human rights organisations Liberty and Privacy International, who brought this significant legal case in January 2020, have welcomed today’s ruling, which accepted their argument that MI5, in breach of key legal safeguards, unlawfully handled individuals’ private data that was gathered by secret surveillance. Under the Investigatory Powers Act, otherwise known as the Snoopers’ Charter, state bodies including MI5 are allowed to collect and store wide ranging data on any member of the public. As the Tribunal has recognised that large amounts of data were unlawfully retained today’s findings concern everyone’s rights to privacy.

During the claim, MI5 admitted it stored the public’s data improperly when it had no legal right to do so, and that it failed to disclose this to the Home Office and oversight bodies. The Tribunal also found that the Home Office, and various Home Secretaries, overlooked and failed to investigate MI5’s breaches, despite having information that indicated that MI5 was acting outside the law from as early as 2016.

Throughout the hearing, Liberty and Privacy International proved that successive Home Secretaries repeatedly ignored the signs of MI5’s unlawful handling of data, and continued to sign off on surveillance warrants unlawfully. Surveillance warrants must be approved by the Home Secretary, and can only be approved if the Home Secretary is satisfied that legal safeguards around the handling of data are being met.

In today’s judgment, the Tribunal said, “given reports of longstanding non-compliance risks, it was irrational of the Secretary of State to fail to make enquiries.” Therefore, multiple Home Secretaries acted unlawfully in granting warrants to MI5 from 2016 to April 2019.

The Tribunal said that “the failure of the Management Board [of MI5] not to disclose the compliance failings…was a serious misjudgment” and went on to say that “on consideration of the evidence…it is clear that MI5 had not been forthcoming on the nature, scale and seriousness of the compliance risks.” The Tribunal also found a breach of duty of candour by MI5 failing to report its unlawful handling of bulk communications data to the Tribunal during a case brought by Privacy International against MI5 that challenged MI5’s mass surveillance powers. As a result of MI5’s lack of candour, the case may be reopened.

The Tribunal made declarations that MI5 and the Home Secretary had acted unlawfully [under the Investigatory Powers Act, the ECHR and retained EU law]. It refused to grant further relief including the quashing of warrants issued during the period of unlawful handling and the Home Office’s failed oversight, destruction of data and damages. Although information on whose data has been mishandled is unavailable, it is likely to include many people who are not suspected of any wrongdoing due to the nature of the broad surveillance powers given to MI5.

Megan Goulding, Lawyer at Liberty, said:

We all want to have control over our personal information and data. But MI5’s deliberate law-breaking is yet another example of how the dangerous powers granted under the Snoopers’ Charter do not work for the public, and how the Government and security services routinely violate our basic rights to privacy and free expression when they spy on us.
We are pleased that the Tribunal has found that MI5 have been mishandling our data, storing it when they shouldn’t have, and the Home Secretary has been unlawfully granting warrants. This judgment confirms what we at Liberty, and others, have been saying for years – surveillance safeguards are not fit for purpose and fail to protect our fundamental privacy rights.
For years, MI5 knowingly broke the rules and failed to report it, the internal oversight body did not detect it and the Government failed to investigate clear red flags. Instead, the Home Office continued to issue unlawful warrants, and MI5 kept information from the authorities about it mishandling our data.
Mass surveillance doesn’t make us safer. The security services shouldn’t be allowed to spy on us and collect our data, these powers breach our privacy and undermine core pillars of our democracy. Today has shown that the so-called safeguards are totally ineffective in protecting our rights and holding those in power to account. Now is the time for the Government to step up and create restrictions that protect our privacy rights.

Caroline Wilson Palow, Legal Director at Privacy International, said:

We’ve been here many times before. UK intelligence agencies seriously intrude on thousands or even millions of people’s privacy, we call them out, then the government promises better safeguards. Today’s ruling is especially troubling because it confirms that those safeguards can be illusory. MI5 failed to follow them for years, with successive Home Secretaries ignoring signs of their breach, too.
The judgment also acknowledges that MI5 breached its duty of candour to the Tribunal in a previous case by withholding crucial information, which calls past decisions into question.
These are not technical breaches. At its highest levels, MI5 systemically disregarded the law, and the Home Office’s failure to do anything green-lighted their activities. Nothing good comes of unchecked power being exercised by government intelligence agencies operating in the shadows. It’s undemocratic and dangerous to our rights to give MI5 a free pass.
While we are pleased that the Investigatory Powers Tribunal has recognised MI5’s serious failures, we are disappointed that they did not go further to remedy them. What’s important now though is that the Government recognises that we are entitled to real protections for our privacy and takes action to safeguard them.

Tom de la Mare KC, Ben Jaffey KC, Daniel Cashman and Gayatri Sarathy of Blackstone Chambers, and David Heaton of Brick Court Chambers, Megan Goulding and Mark Scott acted for Liberty and Privacy International.

Contact the Liberty press office on 07973 831 128 or [email protected]
Contact the Privacy International’s press and communications team on [email protected]

Notes to Editors:

1. For an outline of how Liberty’s mass surveillance litigation fits together, see here.
2. For a summary and timeline of Privacy International’s BPD/BCD litigation see here.
3. For further information on this case, see here.
4. Copy of Liberty and Privacy International’s skeleton argument available on request.
5. Copy of judgment available on request.

About Liberty:

Liberty challenges injustice, defends freedom and campaigns for everyone in the UK to be treated fairly, with dignity and respect. We’re an independent membership organisation, and our principles are guided by evidence and expertise – not political agenda, profit or popular opinion. We use our voice in courtrooms, in the news, on the streets and in politics to demand and deliver lasting change to benefit the many and most marginalised. Since 1934 we’ve inspired and empowered people to defend their rights, and the rights of their family, friends and communities. Join us. Stand up to power.

About Privacy International:

Privacy International (PI) is a London-based charity that researches and advocates globally against government and corporate abuses of data and technology. It exposes harm and abuses, mobilises allies globally, campaigns with the public for solutions, and pressures companies and governments to change. PI challenges overreaching state and corporate surveillance so that people everywhere can have greater security and freedom through greater personal privacy.