A privacy rights org this week lost an appeal [PDF] in a case about the sharing of Bulk Personal Datasets (BPDs) of UK residents by MI5, MI6, and GCHQ with foreign intelligence agencies, according to a recent article published in The Register.
The British agencies have never stated, in public, whether any of them have shared BPDs with foreign intelligence agencies – they have a so-called “neither confirm nor deny” (NCND) policy – but the judgment noted it “proceeds on the assumption that sharing has taken place.”
The true position, as noted by Queen’s Bench Division president Dame Victoria Sharp in the judgement, was revealed to the defendant in its closed hearings.
The defendant in the case was the Investigatory Powers Tribunal (IPT), a secret, independent body established under the controversial Regulation of Investigatory Powers Act 2000 (RIPA).
The decision means a contested part of a 2018 ruling by the IPT will stand: that safeguards and rules around data collection between 2015 to 2017 by the state agencies meant that sharing that data was legal – “compatible with article 8 of the European Convention of Human Rights.”
Dismissing Privacy International’s claim for judicial review, the Queen’s Bench Division judgement stated that this was despite the Tribunal identifying “serious errors that had been made by GCHQ.”
According to the judgement:
The Tribunal… considered a significant amount of written and oral evidence. It was dissatisfied with the way in which the evidence emerged from GCHQ. This involved, on a number of occasions, statements made by GCHQ having “to be subsequently corrected” as a result of “re-thinking or double-checking.”
Among other things, the IPT and spy agency regulator the Investigatory Powers Commissioner (IPCO), part of the new regime as of 2017, are supposed to have oversight of the conduct of the Security Service (MI5), the Secret Intelligence Service (MI6), and the Government Communications Headquarters (GCHQ), the signals intelligence unit famously housed in a doughnut-shaped building in Cheltenham that may or may not have employed a Register writer in its time.
Tom de la Mare QC, for Privacy International, challenged the application of NCND over whether BPDs had been shared by GCHQ with foreign agencies, pointing out that was untenable given the content of IPCO’s 2019 report, which refers to a “fact-led review of the sharing that has taken place in the past” and talks about making changes in the future.
Before March 2015, the UK’s spy agencies never publicly admitted they used BPDs, which the judgement characterized as a dataset that “contains personal data about individuals, the majority of whom are unlikely to be of intelligence interest, and that is incorporated into an analytical system and used for intelligence purposes.
In the case, the UK government admitted that its surveillance regime prior to 2016 – where journalists’ call records were accessed by cops to identify confidential sources – violated human rights laws.