Judgment says that UK cannot digitally spy on people outside its borders without accountability

Today the European Court of Human Rights held the United Kingdom accountable for its digital spying, even when that spying affects people outside of the UK’s borders.

In this case, Mr Wieder and Mr Guarnieri, both researchers who work on information security and privacy, challenged the lack of access to redress mechanisms for alleged breaches to their rights to privacy and freedom of expression by UK intelligence agencies before the European Court of Human Rights.

Mr Wieder and Mr Guarnieri complained that their communications were intercepted and accessed by the UK’s intelligence agencies - either through the UK’s bulk interception regime or under intelligence sharing arrangements with US intelligence agencies. The UK has already acknowledged that its historic bulk interception regime was unlawful.

Because Mr Wieder and Mr Guarnieri live outside the UK, the UK’s Investigatory Powers Tribunal (IPT) refused to investigate their complaints, leaving them as a result without access to an appropriate redress mechanism.

The European Court of Human Rights in a landmark judgment today decided that:

• That the “interference with the privacy of communications clearly takes place where those communications are intercepted, searched, examined and used and the resulting injury to the privacy rights of the sender and/or recipient will also take place there” (para 93);
• Given the UK intercepted, searched, examined or used the applicants’ communications within the United Kingdom’s territory, the interference with their right to privacy fell within the territorial jurisdiction of the United Kingdom. (paras 94-95);
• The UK government had already accepted the applicants’ victim status. The European Court highlighted for the purposes of bulk interception of communications, the “the level of persuasion necessary to establish victim status cannot be unreasonably high” (para 99);
• In light of its findings in Big Brother Watch and others v the United Kingdom case, it concluded that there has been a violation of Article 8 of the European Convention (para 104).

Dr Ilia Siatitsa, Senior Legal Officer said: 

This judgment signifies a significant milestone for the safeguarding of privacy and the enjoyment of human rights in the digital era. The ever-expanding capabilities of technology have empowered states to spy far beyond their traditional borders, granting them unprecedented access to individuals’ information and lives. States can no longer assume digital surveillance comes without consequences or that they can evade accountability by targeting people outside their borders. Today’s ruling from the European Court of Human Rights emphatically underscores that security and intelligence agencies must be held responsible for the effects of their actions no matter where they occur. 

Editors note

• On 4 November 2016, seven applicants, including journalists and human rights activists, submitted complaints before the European Court of Human Rights (European Court) against the UK. They challenged the Investigatory Powers Tribunal’s (IPT) decision on a number of grounds. The applicants who were UK residents challenged the IPT’s failure to make any determination in their favour in relation to the interception of their personal communications. The applicants who were non-UK residents also challenged the IPT’s finding that it does not have jurisdiction to investigate their complaints. They brought this challenge on the basis that the IPT’s decision failed to provide them with an effective remedy to breaches of their right to privacy.
• The applicants submitted their complaints following Privacy International’s campaign. In 2015, Privacy International started a campaign encouraging individuals and organisations to make applications to the IPT to investigate whether they had been subjected to unlawful surveillance measures by the UK’s intelligence agencies. 663 investigation requests were made to the IPT. After the IPT refused to investigate their claims, several applicants took their challenge to the European Court. PI, along with pro bono counsel, assisted six of those applicants.
• The European Court decided not to examine the cases until it reached a decision on a closely related case where PI was also an applicant. On 25 May 2021, the European Court issued its judgment in the related Big Brother Watch and others v the United Kingdom case. It found that the UK had violated people’s rights to privacy and freedom of expression.
• In September 2021, following that decision, the European Court reopened the seven case. It split them into two groups: the first group concerned UK residents, including Human Rights Watch and others. The second group concerned non-UK residents. You can find more information in the corresponding pages.
• On 16 May 2016, the IPT issued its decision refusing to investigate their complaints, because Mr Wieder and Mr Guarnieri lived outside the UK. In its decision, the IPT read Article 1 of the European Convention of Human Rights as limiting the application of the ECHR to the territory of contracting member states. It found that the UK owed no obligations under Article 8 to claimants not residing in the UK; not even if the claimants communications had been intercepted or obtained within the UK’s territory.

About Privacy International:

Privacy International (PI) is a London-based charity that researches and advocates globally against government and corporate abuses of data and technology. It exposes harm and abuses, mobilises allies globally, campaigns with the public for solutions, and pressures companies and governments to change. PI challenges overreaching state and corporate surveillance so that people everywhere can have greater security and freedom through greater personal privacy.