Surveillance legislation rushed through Parliament in a matter of days is unlawful, the UK High Court has ruled.

In a challenge brought by MPs David Davis and Tom Watson, represented by Liberty, the court found that sections 1 and 2 of the Data Retention and Investigatory Powers Act 2014 (DRIPA) are incompatible with the British public’s right to respect for private life and communications and to protection of personal data under Articles 7 and 8 of the EU Charter of Fundamental Rights.

Landmark judgment

The landmark ruling, issued on Friday, comes exactly one year after DRIPA received Royal Assent on July 17, 2014. It was rushed through Parliament by the coalition government, which claimed "emergency" legislation was necessary three months after the Court of Justice of the EU ruled the existing EU directive on data retention invalid because it was so sweeping in its interference with individual privacy rights.

DRIPA allows the home secretary to order communications companies to retain communications data for 12 months. It catches the records of communications of everyone in the UK, including the emails, calls, texts and web activity of MPs, journalists, lawyers, doctors and other correspondence that may be confidential or privileged.

Data retained under DRIPA is then subject to an extremely lax access regime, allowing it to be acquired by hundreds of public authorities, many of which can authorize access themselves for a broad range of reasons that have nothing to do with the investigation of serious crime. Roughly 500,000 requests are granted each year.

Unlawful

The High Court has found sections 1 and 2 of DRIPA unlawful on the basis that:

• they fail to provide clear and precise rules to ensure data is only accessed for the purpose of preventing and detecting serious offenses, or for conducting criminal prosecutions relating to such offenses.
• access to data is not authorized by a court or independent body, whose decision could limit access to and use of the data to what is strictly necessary. The ruling observes that: “The need for that approval to be by a judge or official wholly independent of the force or body making the application should not, provided the person responsible is properly trained or experienced, be particularly cumbersome.”

The unlawful sections of DRIPA will remain in force until the end of March 2016 to allow time for the Government to legislate properly. At that point they will cease to have effect.

Demand for change

James Welch, legal director for Liberty:

"Liberty has long called for fundamental reform of our surveillance laws to ensure the public’s rights are properly respected by our government – the chorus of voices demanding change is now growing. Campaigners, MPs across the political spectrum, the government’s own reviewer of terrorism legislation is all calling for judicial oversight and clearer safeguards. The High Court has now added its voice, ruling key provisions of DRIPA unlawful. Now is the time for the Home Secretary to commit publicly to surveillance conducted with proper respect for privacy, democracy and the rule of law – not plough on with more of the same."

David Davis, Conservative MP:

"The court has recognized what was clear to many last year, that the government’s hasty and ill-thought through legislation is fatally flawed. They will now have to rewrite the law to require judicial or independent approval before accessing innocent people’s data, reflecting the new consensus amongst experts in the Anderson and RUSI reports. This change will improve both privacy and security, as whilst the government gave Parliament one day to consider its law, the court has given almost nine months."

Tom Watson, Labour MP:

"The government was warned that rushing through important security legislation would end up with botched law. Now the High Court has said they must come back to Parliament and do it properly. The government gave MPs one day to discuss the legislation which was wrongly represented as respectful of people's right to privacy: it has until March 2016 to make sure that the law is re-written. There must be independent oversight of the government's data-collection powers and there must be a proper framework and rules on the use and access of citizens' communications data."

A growing consensus

The judgment follows June’s major report from the government’s reviewer of terrorism legislation, David Anderson QC, who described the current law as "undemocratic" and "intolerable" and called for a comprehensive overhaul of laws governing state surveillance. Among other things, he recommended prior judicial authorization for all interception warrants and some communications data requests – something for which Liberty has campaigned for more than a decade.

Earlier this week, a surveillance review from the Royal United Services Institute (RUSI) – whose panel includes a former director general of MI5, chief of the Secret Intelligence Service and director of intelligence for the Metropolitan Police – recommended judicial authorization for some interception warrants. Judicial approval is also supported by Labour, the SNP, the Liberal Democrats, the Green Party and a number of high-profile Conservative MPs, including former Attorney General Dominic Grieve QC.

Current system inadequate

In some of the rare instances in which spying has come to light in recent years, the inadequacy of the self-authorization system has been laid bare. Metropolitan Police have accessed journalists’ phone records, spied on Baroness Doreen Lawrence and her family, and infiltrated social and environmental justice groups to the extent that women were tricked into long-term romantic relationships – one even having a child with an undercover officer.

Over the same period, legal challenges have revealed that GCHQ has intercepted legally privileged communications of a torture victim challenging UK complicity in his rendition to Gaddafi’s Libya and spied on respected human rights organizations.

Home Secretary Theresa May has so far refused to commit to the Anderson report’s recommendations for prior judicial approval. The UK is alone amongst the Five Eyes nations – an intelligence alliance comprising the UK, USA, Australia, Canada and New Zealand – in making no use of judges in the prior authorization of interception warrants.

The full judgment can be read here.

A joint briefing by Liberty, Privacy International, Open Rights Group, Big Brother Watch, Article 19 and English PEN on the fast-track Data Retention and Investigatory Powers Bill is available here.