Published on 20 September 2021

FOURTH SECTION

Applications nos. 64371/16 and 64407/16 Joshua WIEDER against the United Kingdom and Claudio GUARNIERI against the United Kingdom lodged on 4 November 2016 communicated on 1 September 2021

STATEMENT OF FACTS

The applicant in application no. 64371/16 (“the first applicant”), Mr Joshua Wieder, is a United States’ national, who was born in 1984 and lives in Cloud Lake, Florida. The applicant in application no. 64407/16 (“the second applicant”), Mr Claudio Guarnieri, is an Italian national, who was born in 1987 and lives in Berlin, Germany. Both applicants are represented before the Court by Mr M. Scott of Bhatt Murphy Solicitors, a lawyer practising in London.

The facts of the case, as submitted by the applicants, may be summarised as follows.

The first applicant is an IT professional and independent researcher. He has worked for commercial data centres and news organisations.

The second applicant is a privacy and security researcher and the creator of an open source malware analysis system. He has researched and published extensively on privacy and surveillance with Der Spiegel and The Intercept.

On 5 December 2014, 6 February 2015 and 22 June 2015 the Investigatory Powers Tribunal (“the IPT”) handed down three rulings on an application lodged by ten human rights organisations (“the Liberty proceedings”: see Big Brother Watch and Others v. the United Kingdom [GC], nos. 58170/13 and 2 others, §§ 28-60, 25 May 2021). That case concerned the bulk interception of communications by the United Kingdom intelligence agencies pursuant to section 8(4) of the Regulation of Investigatory Powers Act 2000 (“RIPA”) and the receipt by the United Kingdom intelligence agencies of material intercepted by their foreign counterparts. The IPT upheld the lawfulness of those regimes, finding neither to be in breach of Articles 8, 10 or 14 of the Convention. However, it accepted that prior to disclosures made in the course of the proceedings, “the regime governing the soliciting, receiving, storing and transmitting by UK authorities of private communications of individuals located in the UK, which have been obtained by US authorities pursuant to Prism and/or ... Upstream, contravened Articles 8 or 10 ECHR”.

It further held that the communications of one of the applicants had been lawfully and proportionately intercepted and accessed pursuant to section 8(4) of RIPA but that the material had been retained for longer than permitted in breach of Article 8 of the Convention. In respect of another applicant, the IPT found that communications from an email address associated with it had been intercepted and selected for examination under a section 8(4) warrant. Although it was satisfied the interception was lawful and proportionate and that selection for examination was proportionate, the IPT found that the internal procedure for selection had not been followed and consequently there had been a breach of the complainant’s Article 8 rights.

There followed a worldwide campaign by Privacy International, one of the applicants in the Liberty proceedings, through which it sought to encourage individuals to lodge complaints with the IPT.

The applicants in the present case lodged applications with the IPT with the aid of a standard application form made available on Privacy International’s website. They alleged that the respondent Government and/or the security services had breached Articles 8 and 10 of the Convention because they had and/or continued to intercept, solicit, obtain, process, use, store and/or retain their information and/or communications; and because their information and/or communications were accessible to the respondent Government as part of datasets maintained wholly or in part by other Governments’ intelligence agencies.

Over 600 applications of a similar nature were received by the IPT. Of these applicants 294 were resident in the United Kingdom.

The IPT listed the first ten applications (which included those lodged by the present applicants) for hearing to enable issues to be addressed as to whether the claims should be investigated. The applicants, together with four other complainants, were represented and were identified in the proceedings; the other four complainants were neither represented nor identified, except to the extent that it could be said that three were resident in the United States of America and one was resident in the United Kingdom.

The Government made preliminary submissions to the IPT in which they sought a “principled basis on which the claims generated by the Privacy campaign can be addressed”. In the Government’s view, these complaints raised no new issues of law but were instead designed for the purpose of finding out whether the intelligence agencies in fact held information about persons or organisations, or whether they had access to that material from the United States’ National Security Agency (”NSA”). The operation of the regime had been examined in detail in the Liberty proceedings and nothing would be achieved by requiring individual examination of a potentially very large number of cases.

Of the first ten claims before the IPT, five of the complainants were resident abroad. The Government argued that these applicants were outside the scope of Article 1 of the Convention and, as such, it would be appropriate for the IPT to dispose of the complaints at a preliminary stage on that basis. While it was accepted, more generally, that individuals of any nationality could bring complaints to the IPT, the Government argued that the IPT was entitled to proceed on the basis that unless an individual was present in the United Kingdom, there was no jurisdiction to consider a complaint under the Convention concerning the interception, obtaining or handling of communication by the Government and/or intelligence agencies.

The Government further argued, inter alia , that the ten claimants could not claim to be victims of a violation of the Convention because they could not show that due to their personal situation they were potentially at risk of being subject to secret interception measures.

The claimants contended that their claims required individual consideration. They further contended that the IPT had jurisdiction over those among them who were resident abroad; and that they all enjoyed “victim” status under the Convention.

The IPT handed down its judgment on 16 May 2016. At the outset, it noted that, encouraged by the jurisprudence of the Court, it had approached the question of locus standi on a very open-minded basis and without requiring from its claimants the kind of arguable case they would need to present a case in the High Court. It therefore concluded that the judgments in the Liberty proceedings were not the finishing point but rather the starting point for the potential investigation of any proper individual claims. Just as the applicants in the Liberty proceedings, who had established sufficient locus to bring the claim, were entitled, after the legal issues had been decided, to have investigations of their own individual circumstances, so should be the case of any other such claimant who could satisfy the locus requirement. To not look at the individual cases of other claimants who could establish the relevant locus would be contrary to Roman Zakharov v. Russia ([GC], no. 47143/06, ECHR 2015) and Weber and Saravia v. Germany ((dec.), no. 54934/00, ECHR 2006‑XI), and to its own duty under RIPA. Moreover, it would undermine the position adopted in Kennedy v. the United Kingdom (no. 26839/05, 18 May 2010), in which the Court approved the role of the IPT to such an extent that in Roman Zakharov it was prepared to recognise that in consequence there could be a different approach to locus in claims before it. Therefore, whatever the purpose of Privacy International’s campaign, the IPT was satisfied that each subsequent application had to be considered on its merits.

As for victim status, it considered that the appropriate test was whether the applicants could show that due to their personal situation they were potentially at risk of being subjected to the measures complained of (see Roman Zakharov , cited above, § 171). It was persuaded that all six of the identified claimants satisfied this test in respect of the section 8(4) regime; and that all save for Mr Wieder, who was a US citizen, satisfied the test in respect of the receipt of intelligence from the NSA. In this regard, it noted that in their complaint to the IPT two of the six had supplemented the standard application form on Privacy International’s website and the other four had provided further information at the hearing. However, as it did not consider there to be sufficient information on Privacy International’s standard application form to demonstrate victim status, it did not consider that the remaining four claimants had established locus.

As to the matter of jurisdiction, the IPT noted that a State’s competence under Article 1 of the Convention was primarily territorial and the exceptions so far recognised by the Court concerned acts of diplomatic and consular agents present on foreign territory, the exercise of control and authority over an individual outside a Contracting State’s territory, and the exercise of effective control of an area outside a Contracting State’s territory (see Al-Skeini and Others v. the United Kingdom [GC], no. 55721/07, §§ 133-142, ECHR 2011). Therefore, in the IPT’s view, a Contracting State owed no obligation under Article 8 of the Convention to persons both of whom were situated outside its territory in respect of electronic communications between them which pass through that State. Furthermore, it was not persuaded that a privacy right was a right of action present in the jurisdiction and to find otherwise would be to extend the bounds of the domestic courts’ jurisdiction under Article 8 of the Convention.

Consequently, the IPT dismissed the claims of Mr Guarnieri and Mr Wieder by reference to the Human Rights Act 1998 (“HRA”) on the ground that it had no jurisdiction to examine them. It also dismissed the claims of the three unidentified claimants who were resident in the United States of America. It accepted, however that any claims made otherwise than by reference to the HRA could not be resisted on this basis.

In light of its findings, the IPT directed inquiries in respect of the six identified applicants, with the exception of the HRA claims by Mr Guarnieri and Mr Wieder, and in respect of any claim by Mr Wieder relating to the receipt of intelligence from the NSA. It also directed that a copy of its judgment be sent to all other claimants, notifying those who were not resident in the United Kingdom that their HRA claims were dismissed for lack of jurisdiction. Finally, it indicated that the claimants resident in the United Kingdom, and the claimants not resident in the United Kingdom in respect of their non-HRA claims, would be notified that their claims would be dismissed as unsustainable pursuant to section 68(4) of RIPA if it did not receive further submissions within twenty-eight days of the date of dispatch of the judgment.

On 12 September 2016 the IPT notified the representatives of Mr Guarnieri that it had carefully considered his domestic law complaints and made no determination in his favour. According to the letter:

“Under section 68(4) of [RIPA], when not making a determination in favour of an applicant, the Tribunal is only permitted to inform such a complainant that no determination has been made in his favour.

If no determination is made in favour of the complainant that may mean that there has been no conduct in relation to the complainant by any relevant body which falls within the jurisdiction of the Tribunal, or that there has been some official activity which is not in contravention of [RIPA]. The provisions of [RIPA] do not allow the Tribunal to disclose whether or not your client is, or has been, of interest to the security, intelligence or law enforcement agencies. Nor is the Tribunal permitted to disclose what evidence it has taken into account in considering your client’s complaint.”

The relevant domestic law and practice is set out in Big Brother Watch and Others , cited above, §§ 61-201.

COMPLAINTS

The applicants complain under Articles 8 and 10 of the Convention about the operation of the regime under 8(4) of the RIPA; and about the receipt by the United Kingdom intelligence agencies of material intercepted by the United States’ intelligence services. In this regard, they state that they “reasonably believe” that their communications have been intercepted, extracted, filtered, stored, analysed and disseminated by the United Kingdom intelligence agencies or accessed by those agencies pursuant to sharing agreements with the United States’ National Security Agency.

They further complain under Article 13 read together with Articles 8 and 10 of the Convention that the IPT did not afford them an effective remedy on account of their being resident outside the United Kingdom.

QUESTIONS TO THE PARTIES

1. Does the interception of communications by a Contracting State, or the receipt of solicited intercept material from foreign intelligence services, fall within the that State’s jurisdictional competence for the purposes of Article 1 of the Convention when the sender and receiver of the communications is outside its territory? To what extent is it relevant that the communications obtained by the Contracting State are stored, processed and interrogated on its territory?

2. If the applicants fall within the respondent State’s jurisdictional competence, can they claim to be “victims”, within the meaning of Article 34 of the Convention, of the alleged violations of Article 8 and/or 10 in respect of either the bulk interception regime which existed under section 8(4) of the Regulation of Investigatory Powers Act 2000 or the receipt of solicited intercept material from the United States of America? Insofar as the applicants allege that their communications were actually obtained by the United Kingdom intelligence agencies under these surveillance regimes, is there a “reasonable likelihood” that the surveillance measures were in fact applied to them (see Kennedy v. the United Kingdom , no. 26839/05, § 123, 18 May 2010)?

3. If the applicants can claim to be victims of the alleged violations, having regard to the Court’s findings in Big Brother Watch and Others v. the United Kingdom ([GC], nos. 58170/13 and 2 others, 25 May 2021), has there been a breach of their rights under Articles 8 and/or 10 of the Convention by virtue of the operation of the section 8(4) regime or the regime permitting the solicitation of intercept material from the United States of America? In respect of the latter, what impact does the absence of oversight by the Investigatory Powers Tribunal vis-à-vis the applicants’ Convention complaints have on this question in light of the Court’s findings in Big Brother Watch and Others (cited above, §§ 500-516)?

4. Does any separate issue arise under Article 13 of the Convention as a result of the Investigatory Powers Tribunal’s judgment of 16 May 2016? If so, can the Investigatory Powers Tribunal’s conclusions on jurisdiction be said to have deprived the applicants of an effective remedy, when they were still able to pursue their claims under domestic law?