JOINT PARTLY DISSENTING AND PARTLY CONCURRING OPINION OF JUDGES PARDALOS AND EICKE

Introduction

1. For the reasons set out in more detail below, we are unfortunately, not able to agree with the majority in relation to two aspects of the judgment in this case; namely

(a) that the applicants in the first and second of the joined cases had shown “special circumstances absolving them from the requirement to exhaust” domestic remedies by first bringing proceedings before the IPT (§§ 266-268 and operative part § 3; “admissibility”); and

(b) that there has been a breach of Article 8 of the Convention in respect of the section 8(4) regime (§ 388 and operative part § 4; “the section 8(4) regime”).

2. In relation to the latter issue our position is reinforced by the contrast between the conclusions reached by the majority in this case and that reached in the judgment in Centrum För Rättvisa v. Sweden , no. 35252/08 (not yet final); a judgment adopted by the Third Section of this Court on 19 June 2018, a mere two weeks before the final deliberations in this case. In that case, the Court concluded, unanimously, that, despite having identified “some areas where there is scope for improvement” (§ 180) and “making an overall assessment and having regard to the margin of appreciation enjoyed by the national authorities in protecting national security” (§ 181), the Swedish system of signals intelligence provided adequate and sufficient guarantees against arbitrariness and the risk of abuse; as a consequence, it was held that the relevant legislation met the “quality of law” requirement, that the “interference” established could be considered as being “necessary in a democratic society” and that the structure and operation of the system were proportionate to the aim sought to be achieved.

3. That said, we agree both with:

(a) the underlying general principles identified by the Court both in this case and in Centrum För Rättvisa to be applied in relation to these aspects of the case; as well as

(b) the conclusion of the majority in this case that, for the reasons given in the judgment, there has been no breach of Article 8 of the Convention in relation to the intelligence sharing regime (§§ 447-448 and operative part § 6) and that there is no need to examine the remaining complaints made by the applicants in the third of the joined cases under Article 10 of the Convention.

4. In relation to the findings that there has been a breach of the Convention in relation to the Chapter II regime (§§ 468 and 500, operative part §§ 5 and 7) as well as the conclusions under Article 41 of the Convention (operative part § 9), one of us (Judge Pardalos) considered that her conclusion on the admissibility of the first and second of the joined cases invariably determined the related substantive issues against the applicants in those cases. By contrast, Judge Eicke considered that, the Court having decided that the first and second cases were, contrary to his view, admissible he was required, as a member of that Court, to go on and decide those cases on the merits by reference to the evidence and pleadings before the Court.

Admissibility

5. As indicated above, we agree with the majority that, for the reasons they give, the IPT is and has been an effective remedy “since Kennedy was decided in 2010” (§ 268); i.e. a remedy which is “available in theory and practice” and “capable of offering redress to applicants complaining of both specific incidences of surveillance and the general Convention compliance of surveillance regimes” (§ 265). Consequently, applicants before this Court will be expected to have exhausted this domestic remedy before the Court has jurisdiction to entertain their application under Article 35 § 1 of the Convention.

6. In addition to the purely legal point that, under Article 35 § 1, the Court “may only deal with the matter after all domestic remedies have been exhausted”, we would underline what the majority says in § 256 about the invaluable assistance derived by the Court, in examining a complaint before it, from the “elucidatory” role played by the domestic courts (in this case the IPT) both generally as well as in the specific context of considering the compliance of a secret surveillance regime with the Convention.

7. For the reasons set out below, however, we disagree with the conclusion reached by the majority (§ 268) that there existed, in this case, “special circumstances” absolving the applicants in the first and second of the joined cases from satisfying this requirement.

8. Firstly, as the majority implicitly accepts (§ 267), the case of Kennedy is clearly distinguishable on its facts from the present case. After all, the applicant in that case had already brought a specific complaint about the section 8(1) regime before the IPT before applying to this Court. Consequently, unlike the applicants in the first and second of these joined cases, Mr Kennedy was not inviting the Court to consider his general complaint entirely in abstracto . Furthermore, in its judgment in that case, the Court considered it “important” that his challenge was (consequently) exclusively a challenge to primary legislation. By contrast, in the present cases the scope of each of the regimes complained of (bulk interception, intelligence sharing and the acquisition of communications data) is significantly broader than that of the section 8(1) regime, and the applicants’ complaints concern not only primary legislation, but the overall legal framework governing those regimes (including the alleged absence of any relevant arrangements or other safeguards). Consideration of the broader legal framework necessarily requires an examination of both RIPA and the relevant Codes of Practice, together with any “below the waterline” arrangements and/or safeguards. In view of the much broader scope of both their complaints and the impugned regimes, none of which had been the subject of any examination by the IPT, it should have been evident to the applicants in the first and second of the joined cases – who were, at all times, represented by experienced counsel – that, unlike Kennedy , this was a case in which the general operation of these regimes required further elucidation, and in which the IPT, on account if its “extensive powers ... to investigate complaints before it and to access confidential information” would have been capable of providing a remedy.

9. There is, therefore, also no basis for any suggestion that our approach seeks, in any way, to overturn or “disapply” the Court’s unanimous ruling in Kennedy . The simple fact is that, in our view, the two are clearly and obviously distinguishable.

10. Secondly, the first applicant, was clearly informed by the Government, in their response to the letter before action of 26 July 2013 (§ 19), that their complaints could be raised in the IPT, a court established specifically to hear allegations by citizens of wrongful interference with their communications as a result of conduct covered by that Act and a court endowed with exclusive jurisdiction to investigate any complaint that a person’s communications have been intercepted and, where interception has occurred, to examine the authority for such interception. This letter was, of course, sent at around the same time as the ten human rights organisations which are the applicants in the third of the joined cases, no doubt recognising the need to have exhausted existing effective domestic remedies before applying to this Court, lodged their complaints before the IPT (June to December 2013; § 21). It was also four years after the UK Supreme Court, in its judgment in R (on the application of A) v B [2009] UKSC 12, had confirmed the exclusive jurisdiction of the IPT and its ability, as demonstrated by its decisions in Kennedy (IPT/01/62 & 77) and The British-Irish Rights Watch and others v Security Service, GCHQ and the SIS (IPT/01/77), to adjust the procedures before it as necessary so as to ensure that disputes before it can be determined justly.

11. Thirdly and in any event, even if, contrary to our view, the applicants in the first and second of the joined cases would have been entitled to rely on Kennedy at the time they lodged their applications with the Court they nevertheless accepted before this Court (§ 241), by reference to the judgment in Campbell and Fell v. the United Kingdom , 28 June 1984, §§ 62-63, Series A no. 80, that in light of any finding by the Court to the effect that the IPT is an effective remedy, they would now be required to go back and exhaust unless it would be unjust to require them to do so. As these applicants’ complaints concern the general operation of the impugned regimes, rather than specific complaints about an interference with their rights under the Convention, they would still be entitled to raise them before the IPT now.

12. Many of the complaints advanced in the first and second of the joined applications (including, in particular, all of those relating to the Chapter II regime, the sharing of non-intercept material with foreign governments and the lack of protection for confidential journalistic material and journalistic sources under the section 8(4) regime) were not addressed in the Liberty proceedings and have not yet been determined by the IPT. Consequently, there is no reason to doubt that if the applicants were now to raise those complaints before the IPT, they would have “a reasonable prospect of success”. In fact, in respect of the Chapter II complaint it may be thought that they would have a more than reasonable prospect of success. After all, as the majority records in § 463 of the judgment, the Government, in response to a challenge brought by Liberty, recently conceded that Part 4 of the IPA (which included a power to issue “retention notices” to telecommunications operators requiring the retention of data) was incompatible with fundamental rights in EU law: R (The National Council for Civil Liberties (Liberty)) v Secretary of State for the Home Department & Anor [2018] EWHC 975 (Admin). As Chapter II of RIPA, like Part 4 of the IPA, permits access to data for the purpose of combating crime (as opposed to “serious crime”), this concession lead the majority to find a violation of Article 8 of the Convention in relation to the Chapter II regime (§ 467) which would suggest that the applicants had a strong basis for challenging, at the domestic level, the compliance of the Chapter II regime with EU law and, indeed, the Convention.

13. The same could not necessarily be said about those complaints raised by the first and/or second of the joined cases which were determined by the IPT in the Liberty proceedings; however, those issues were, of course, also raised by the applicants in the third of the joined cases and would therefore (and in fact have been) considered and determined by the Court on its merits.

14. As a result, and in clear contrast with the ultimate conclusion in Campbell and Fell , there is here therefore no evidence to suggest that “it would be unjust now to find these complaints inadmissible for failure to exhaust domestic remedies” ( ibid. at § 63). Consequently, in our view, both the requirements of Article 35 § 5 of the Convention as well as the application of the principle of subsidiarity, in fact, required such a finding.

15. The point made in the judgment about the fundamental importance of the “elucidatory” role of the domestic courts is further underlined by the complaint made in relation to the Chapter II regime. After all, as the judgment records in § 451, in both their application to the Court and their initial observations, the applicants in the second of the joined cases had incorrectly referred to the Chapter II regime as a regime for the interception of communications data; rather than a regime which permits certain public authorities to acquire communications data from Communications Service Providers (“CSPs”). This “fundamental legal misunderstanding” led the Government to submit inter alia that the applicants had put forward no factual basis whatsoever for concluding that their communications were acquired in this way, and that they did not contend that they had been affected, either directly or indirectly, by the regime.

16. As noted above, the Court’s conclusion on the Chapter II regime was, of course, ultimately based on the concession by the Government in R (The National Council for Civil Liberties (Liberty)) v Secretary of State for the Home Department & Anor [2018] EWHC 975 (Admin) which enabled the majority to find that the equivalent language in the Chapter II regime was “not in accordance with the law” within the meaning of Article 8 of the Convention (§ 467). However, had that not been the case, this Court would have been confronted with the task of considering in detail whether the regime’s attendant safeguards were sufficient to satisfy the requirements of the Convention; and that (1) on the basis of a case initially advanced on the basis of a “fundamental legal misunderstanding” about the nature of the regime, (2) without any assistance or findings by the IPT in relation to what the attendant safeguards, both above and below the waterline, in fact were and/or (3) any reasoned conclusion by the IPT as to whether or not they satisfied the requirements of Article 8 (or could be made to satisfy the requirements of Article 8 by means of further disclosure akin to that ordered on 9 October 2014 in the proceedings brought by the applicants in the third of the joined applications). This would plainly have been a wholly undesirable state of affairs.

The section 8(4) regime

17. As indicated above, there is much in the judgment of the majority we agree with.

18. Firstly, we agree with the majority (as well as with the unanimous judgment in Centrum För Rättvisa ) in relation to the relevant general principles as set out in the judgment. In particular we agree with the affirmation by the majority (as well as the judgment in Centrum För Rättvisa and the report by the Venice Commission) that while the Court has considered prior judicial authorisation to be an important safeguard, and perhaps even “best practice”, it has also repeatedly confirmed that, by itself, such prior judicial authorisation is neither necessary nor sufficient to ensure compliance with Article 8 of the Convention (§ 320).

19. Secondly, we also agree with the majority in identifying as potential shortcomings (or, to use the language in Centrum För Rättvisa “areas where there is scope for improvement”) in the operation of the section 8(4) regime “the lack of oversight of the entire selection process, including the selection of bearers for interception, the selectors and search criteria for filtering intercepted communications, and the selection of material for examination by an analyst; and secondly, the absence of any real safeguards applicable to the selection of related communications data for examination” (§ 387).

20. Finally, we agree with the majority as to the correct approach to be applied when considering whether the system under review satisfied the requirement of being “necessary in a democratic society” under Article 8 § 2 of the Convention, namely that:

“... regard must be had to the actual operation of the system of interception, including the checks and balances on the exercise of power, and the existence or absence of any evidence of actual abuse (see Association for European Integration and Human Rights and Ekimdzhiev, cited above, § 92) (§ 320)

... it must principally have regard to the actual operation of a system of interception as a whole, including the checks and balances on the exercise of power, and the existence (or absence) of any evidence of actual abuse (...), such as the authorising of secret surveillance measures haphazardly, irregularly or without due and proper consideration (see Roman Zakharov, cited above, § 267) (§ 377).”

21. Where we disagree is (again) in the application of that approach to the system under review.

22. Before setting out in little more detail the basis for our disagreement we note in passing that this Court’s underlying approach appears to be in clear contrast to the approach taken by the CJEU in Digital Rights Ireland v. Minister for Communications, Marine and Natural Resources and Others and Settinger and Others (Cases C-293/12 and C-594/12) and Secretary of State for the Home Department v. Watson and Others (C-698/15). In the former case, the CJEU was considering the validity of the Data Retention Directive, and in the latter, the validity of domestic legislation containing the same provisions as that directive. While its focus was on the retention of data by CSPs, it also considered the question of access to retained data by the national authorities. In doing so, it indicated that access should be limited to what was strictly necessary for the objective pursued and, where that objective was fighting crime, it should be restricted to fighting serious crime. It further suggested that access should be subject to prior review by a court or independent administrative authority, and that there should be a requirement that the data concerned be retained within the European Union. Therefore, while there is some similarity in the language used by the two courts, the CJEU appears to have adopted a more prescriptive approach as regards the safeguards it considers necessary. This may be due to the fact that in both cases it was considering the rights guaranteed by reference to Articles 7 (Respect for private and family life) and 8 (Protection of personal data) of the Charter of Fundamental Rights. However, while in Watson the CJEU declined to state whether the protection provided by Articles 7 and 8 of the Charter was wider than that afforded by Article 8 of the Convention, we can but note that, on the one hand, Article 52 § 3 of the Charter of Fundamental Rights, while recognising the ability of EU law providing more extensive protection, is clearly expressed by reference to “rights” guaranteed by the Convention (rather than “Articles”) corresponding to “rights” contained in the Charter and that, on the other hand, this Court has, at least since the 1978 judgment of the Plenary Court in Klass and Others v. Germany , Series A no. 28, consistently protected the right to the protection of personal data under Article 8 of the Convention. In any event, in Ben Faiza v. France , no. 31446/12, 8 February 2018, which was decided one year after Watson , and four years after Digital Rights Ireland , this Court did not follow the CJEU’s approach, preferring instead to follow its well-established approach and to review the impugned regime as a whole in order to evaluate the adequacy of the available safeguards.

23. In any event, applying this Court’s well-established approach, it is in our view, clear from the (in the context of secret surveillance cases unusually) extensive and detailed (publicly available) evidence in relation to the operation of the section 8(4) regime (summarised over some 35 pages in the judgment) that, despite the identified areas where there is scope for improvement, these are not, in themselves, sufficiently significant to justify the conclusion that “the section 8(4) regime does not meet the ‘quality of law’ requirement and is incapable of keeping the ‘interference’ to what is ‘necessary in a democratic society’” (§ 388). On the contrary, adopting the approach of this Court in Centrum För Rättvisa , § 181, it is clear in our view that, making an overall assessment and having regard to the margin of appreciation enjoyed by the national authorities in protecting national security, the section 8(4) regime does provide adequate and sufficient guarantees against arbitrariness and the risk of abuse. As a result, we concluded that the relevant legislation meets the “quality of law” requirement and the “interference” established can be considered as being “necessary in a democratic society” and that there was, therefore, no violation of Article 8 of the Convention.

24. In this context, the contrast to the judgment in Centrum För Rättvisa is instructive. After all, in that case the Court applied the same general principles to the Swedish bulk interception regime and concluded, unanimously, that there was no breach of Article 8 of the Convention. Conscious of the difficulty – at times – in making detailed meaningful comparisons between different interception regimes, it is nevertheless noteworthy that the regime under consideration in that case, while equipped with judicial prior authorisation:

(a) was completely shrouded in secrecy with the Court having little meaningful information at all either about the actual generic operation of the system (including the actual operation of the Foreign Intelligence Court (“FIC”) itself) or the impact of the system on and/or operation of safeguards in relation to any individual;

(b) provided that, in principle, the FIC should hold public hearings but found that there has never been a public hearing, all decisions are confidential and no information is disclosed to the public about the number of hearings, the number of permits granted or rejected, the reasoning of the court’s decisions or the amount or type of search terms being used. While the FIC is assisted by the “privacy protection representative” whose role it is to protect the “interests of the general public” he or she does not appear on behalf of or represent the interests of any affected individual. Furthermore, the privacy protection representative cannot appeal against a decision by the FIC or “report any perceived irregularities to the supervisory bodies”;

(c) was concerned with interception by the National Defence Radio Establishment (“FRA”) on behalf of, and which, therefore, required communication of the intercept material to, a much wider group “clients” (“the Government, the Government Offices, the Armed Forces and, as from January 2013, the Security Police and the National Operative Department of the Police Authority”);

(d) provided for authorisation of interception for a greater number (eight) of “purposes” (“1) external military threats to the country, 2) conditions for Swedish participation in international peacekeeping or humanitarian missions or threats to the safety of Swedish interests in the performance of such operations, 3) strategic circumstances concerning international terrorism or other serious cross-border crimes that may threaten essential national interests, 4) the development and proliferation of weapons of mass destruction, military equipment and other similar specified products, 5) serious external threats to society’s infrastructure, 6) foreign conflicts with consequences for international security, 7) foreign intelligence operations against Swedish interests, and 8) the actions or intentions of a foreign power that are of substantial importance for Swedish foreign, security or defence policy”);

(e) had similar difficulties to those identified in relation to the UK regime to separate out non-external communications between a sender and receiver within the respective State at the point of collection;

(f) allows for the communication of intercept product not only to other states but also to “international organisations” (not further defined) where that is “not prevented by secrecy and if necessary for the FRA to perform its activities within international defence and security cooperation” and “it is beneficial for the Swedish government or Sweden’s comprehensive defence strategy” and without any provision requiring the third country/international organisation recipient to protect the data with the same or similar safeguards as those applicable internally; and

(g) provided for an obligation to notify the subject of an intercept after the event; an obligation which, however, “had never been used by the FRA, due to secrecy.

25. Considering the accepted difficulty in making a meaningful comparison between two or more distinct interception regime together with the different conclusions reached by this Court at about the same time, in our view, further underlines the importance of the Court adopting an approach of asking whether, taking “an overall assessment and having regard to the margin of appreciation enjoyed by the national authorities in protecting national security” the system adopted provides adequate and sufficient guarantees against arbitrariness and the risk of abuse, even if there may be individual aspects of any system which might be capable of being altered or improved. Such an approach properly reflects the role of the Convention, which is to set down “minimum standards” that can be applied across all Member States. Provided that – following an overall assessment – the Court finds that a system for bulk interception provides adequate and sufficient guarantees against arbitrariness and abuse, in view of the very different regimes in operation in different States, it will not be appropriate for it to be too prescriptive about the way in which those regimes should operate (although it may, as it did both in Centrum För Rättvisa and in this case, identify those aspects of the regime which could be improved upon). Applying this approach to the Court’s supervisory jurisdiction in the present case (as it was in Centrum För Rättvisa ), the Court should have given due weight to the fact that the domestic courts and authorities have subjected both the UK system as a whole as well as the individual complaints at issue to detailed and extensive scrutiny by express reference to the Convention standards and this Court’s case law and should have found that there was, here, no breach of Article 8 of the Convention.

Post Scriptum

26. Since the adoption of this judgment on 3 July 2018, the IPT has handed down yet another judgment in relation to another, unrelated, aspect of the UK’s surveillance regime: Privacy International v Secretary of State for Foreign and Commonwealth Affairs (Rev 1) [2018] UKIPTrib IPT_15_110_CH (23 July 2018). For obvious reasons this judgment was not available for consideration by the Court when it reached its conclusions on the question of exhaustion of domestic remedies (and we have heard no submissions on it). That said, it seems to us that this careful and detailed judgment provides yet further support (if any was necessary) that, in principle, the IPT is an effective remedy for the purposes of Article 35 § 1 of the Convention which applicants will be required to have exhausted before this Court has jurisdiction to entertain their application.

[1] As the United Kingdom is leaving the European Union in 2019, it granted royal assent to the Data Protection Act 2018 on 23 May 2018, which contains equivalent regulations and protections.