On May 25, 2021, the Grand Chamber of the European Court of Human Rights (ECtHR) ruled in joined cases Big Brother Watch and Others v. the United Kingdom (Big Brother Watch)Footnote ¹ that some aspects of the United Kingdom's surveillance regime violated the rights to privacy and freedom of expression, guaranteed under Articles 8 and 10 of the European Convention on Human Rights (ECHR).Footnote ² The program enabled the UK authorities to bulk intercept communications data, acquire data from communications service providers, and receive material from foreign intelligence services, all with wide discretion. The ECtHR found that the UK program violated the Convention due to several procedural deficiencies. Yet, ultimately, the decision stands for a highly permissive approach to government surveillance.

The Grand Chamber decision marks the end of an eight-year battle spearheaded by sixteen journalists and NGOs following the Edward Snowden revelations about the U.S. and UK's mass surveillance programs in 2013. Across three separate legal challenges, the claimants contended that the surveillance programs under UK's Regulation of Investigatory Powers Act (RIPA) 2000Footnote ³ failed to operate “in accordance with the law.”Footnote ⁴ The Grand Chamber agreed with the applicants that the regimes for the bulk interception of communications data and the acquisition of intelligence from communication service providers—but not for the receipt of foreign intercept material—violated ECHR. The Big Brother Watch decision has significant implications not only for the UK's legal framework for bulk interception programs, but also for data privacy law, the future of mass surveillance programs and intelligence data sharing regimes in the UK, Europe, and beyond. The ruling is particularly relevant now as national governments are increasingly relying on intrusive methods of data collection and contact tracing to prevent the spread of COVID-19.

The case was initially decided by a lower Chamber of the ECtHR in 2018, which held that aspects of the UK's data interception and acquisition systems violated Articles 8 and 10 of the Convention.Footnote ⁵ The Chamber held that bulk interception was not per se impermissible under the ECHRFootnote ⁶ and that contracting states’ governments enjoy a wide “margin of appreciation” in deciding what is necessary to guarantee national security.Footnote ⁷

The Grand Chamber agreed. It emphasized that Article 8 permits bulk interception, and devoted attention to the procedural safeguards required of surveillance regimes. The Grand Chamber found that the UK's bulk interception of communications framework, referred to as the “Section 8(4) regime,” entailed three “fundamental deficiencies.” First, bulk interception was not authorized by a body independent of the executive, but by the secretary of state. Second, the categories of search terms defining the kinds of communications to be examined were not included in the warrant application. And third, the use of specific identifiers (“subject selectors linked to an individual”) had not been authorized.Footnote ⁸ Thus, being too broad, the “Section 8(4) regime” failed to satisfy the “quality of law” requirement, rendering it incapable of keeping the rights interference to a degree “necessary in a democratic society.”Footnote ⁹

Moreover, the Grand Chamber unanimously decided that the UK's acquisition of communications data from communication service providers (the “Chapter II regime”) also breached Article 8 because it failed to limit access to data solely for the purpose of combatting “serious crime” and did not require a prior review by a court or an independent administrative body.Footnote ¹⁰

The Court further ruled that both the bulk interception of communicationsFootnote ¹¹ and the acquisition of data from the service providersFootnote ¹² had violated Article 10 because of a lack of safeguards in relation to journalistic sources and confidential journalistic material.

Finally, a majority of the Court (twelve to five) decided that the system of information sharing, through which the UK authorities received material from foreign intelligence services, did not violate Articles 8 or 10.Footnote ¹³ In the majority's view, intelligence sharing is permissible provided that there are certain additional safeguards (1) domestic law must clearly articulate the circumstances in which such a transfer may take place; and (2) the transferring state must receive guarantees from the receiving state about secure storage of information and restrict its onward disclosure. This, however, “does not necessarily mean that the receiving State must have comparable protection to that of the transferring State; nor does it necessarily require that an assurance is given prior to every transfer.”Footnote ¹⁴

Five judges argued, in three separate opinions, that the judgment does not go far enough. For example, Judges Lemmens, Vehabović, and Bošnjak, stated that the judgment does not provide “any clear substantive protection . . . against disproportionate interference” by surveillance regimes,Footnote ¹⁵ and judicial authorization should be required for bulk interception.Footnote ¹⁶ Judge Pinto de Albuquerque issued the most far-reaching opinion, rejecting outright the proportionality of mass surveillance programs and criticizing the Court's procedural focus as inadequate toward preventing abuse.Footnote ¹⁷

* * * *

Following September 11, 2001, the UK enacted extensive surveillance and data retention regimes which provided law enforcement agencies with intrusive powers to battle the “war on terror.”Footnote ¹⁸ These expansive regimes have been cast as “inevitable” and “vital to the war on terror and defending . . . citizens against a ruthless enemy.”Footnote ¹⁹ The ECtHR has examined many such regimes over the past two decades, including those of Sweden,Footnote ²⁰ Hungary,Footnote ²¹ Russia,Footnote ²² Germany,Footnote ²³ Moldova,Footnote ²⁴ Romania,Footnote ²⁵ and (in several instances) the UK, tending to afford states a wide “margin of appreciation” (or zone of discretion) in this area.Footnote ²⁶

Big Brother Watch is the first ECtHR ruling against the UK's mass surveillance programs since the 2013 Snowden revelations about the U.S. and UK electronic surveillance regimes. While the judgment concerns surveillance regimes under RIPA 2000, and the superseding Investigatory Powers Act 2016 (IPA).Footnote ²⁷ The Grand Chamber ruling sets a standard against which any other bulk interception regimes will be examined. However, from the perspective of privacy and data protection, that standard is a rather thin one. The Court has endorsed mass-surveillance as, in principle, acceptable, by holding that that bulk interception was not per se disproportionate, and that judicial authorization was not a requisite for the legality of bulk surveillance, which “is of vital importance to Contracting States in identifying threats to their national security” (with only one dissent on this point).Footnote ²⁸

The Big Brother Watch decision therefore reinforces and cements the Court's longstanding liberal approach that governments may continue to deploy mass surveillance regimes where certain (vague) procedural safeguards are incorporated. Citing its earlier decisions in Weber and Saravia,Footnote ²⁹ inter alia, the Court affirmed the “six minimum requirements” for surveillance schemes, known as “six Weber safeguards.” These require domestic law to specify: (1) the nature of offenses that may give rise to an interception order; (2) a definition of the categories of people liable to have their communications intercepted; (3) a limit on the duration of interception; (4) the procedure to be followed for examining, using and storing the data obtained; (5) the precautions to be taken when communicating the data to other parties; and (6) the circumstances in which intercepted data may or must be erased or destroyed.Footnote ³⁰ Moreover, the Grand Chamber adds, here, two additional elements in the context of national security: (7) supervision of the implementation of secret surveillance measures; and (8) notification of secret surveillance measures and available remedies.Footnote ³¹ However, where the Court continues to grant states a wide margin of appreciation to uphold national security, vague conformity with the “six minimum requirements” will often not breach Article 8. The international intelligence sharing regime in Big Brother Watch, did not, in the majority's view, breach Article 8 because it had “adequate safeguards for the examination, use and storage of the content and communications data received from intelligence partners; for the onward transmission of this material; and for its erasure and destruction.”Footnote ³²

Big Brother Watch is also the first decision on the legality of international intelligence sharing under the ECHR, and thus will shape the future of intelligence sharing regimes. Here, the Grand Chamber's approach contrasts sharply with the CJEU approach, where the emphasis is on the safeguards provided by the third countries receiving the information. For example, in the Schrems II decision, delivered in July 2020, the CJEU invalidated the EU-U.S. Privacy Shield agreement,Footnote ³³ which enabled transatlantic data transfers between the two regions, due to lack of adequate safeguards in the surveillance framework of the receiving country—the United States.Footnote ³⁴ As Big Brother Watch concerned the requests and reception of intelligence from foreign countries by the UK (as opposed to transfers of intelligence to foreign countries), the sole focus on legislative safeguards in the UK is understandable. However, it remains unclear whether the ECHR requires adequate safeguards in the recipient country, if the UK or another ECHR contracting state shared the data with foreign countries.Footnote ³⁵ If the focus remains solely on the legislative framework of the transferring country (e.g., the UK), ignoring the safeguards of the country with whom data is shared (e.g., the United States), such interpretation would leave UK residents vulnerable to the misuse of personal data by U.S. authorities, without a remedy.Footnote ³⁶

The ECtHR's approach is ultimately minimalist and deferential. Not only may governments deploy mass surveillance regimes, they may also share gathered information with other countries as long as “certain safeguards” are in place. For the Grand Chamber, “independent authorisation at the outset” “supervision and independent ex post facto review” are the “fundamental” and “cornerstone” safeguards for any bulk interception regime to be compliant with Article 8.Footnote ³⁷ Thus, the focus is not on the substantive legality or the actual effectiveness of the regime, but solely on procedural safeguards. In fact, the procedures matter so much for the Court that it develops “a wider range of criteria than the six Weber safeguards”Footnote ³⁸ listed above.

These safeguards, as the Grand Chamber explains, are part of the “global assessment of the operation of the regime.”Footnote ³⁹ But it is not clear if any of the requirements are mandatory.Footnote ⁴⁰ It rather seems that non-compliance with one or several is not fatal. As Judge Pinto de Albuquerque argues in his dissent, these are expressed in “inadmissibly vague” terms.Footnote ⁴¹ Judges Lemmens, Vehabović, and Bošnjak held that the new criteria do not clearly serve as “self-standing minimum standards,” nor do they “set any minimum safeguards themselves” in domestic law, failing to provide for “any clear substantive protection of an individual against disproportionate interference” with their rights.Footnote ⁴²

The Big Brother Watch majority's lax and proceduralist approach reinforces what I call the “inevitability” of mass surveillance narrative, by not questioning the effectiveness or proportionality of blanket surveillance regimes, and rather assuming their necessity and efficiency for ensuring national security.Footnote ⁴³ The Court's commitment to the inevitability narrative is also clearly visible in of the parallel judgment of Centrum för Rättvisa v. Sweden, delivered on the same day, asserting that “in present-day conditions, no alternative or combination of alternatives would be sufficient to substitute for the bulk interception power.”Footnote ⁴⁴ Judge Pinto de Albuquerque's lone dissent in Big Brother Watch represents the alternative vision, in noting that bulk interception is “proven to be ineffective for the prevention of terrorism . . . [it] is not only dangerous for the protection of human rights but also a waste of resources.”Footnote ⁴⁵

Until recently the CJEU has pushed back against the inevitability rhetoric, frequently siding with privacy activists in the wake of the 2013 Snowden revelations in many strong pro-privacy judgments.Footnote ⁴⁶ However, the CJEU's recent reversals suggest the emergence of a dangerous judicial consensus on the substantive prima facie legality of mass surveillance programs. In particular, in Quadrature Du Net (2020), the CJEU ruled that the EU does not preclude indiscriminate data retention measures when member states can prove legitimate and serious threats to national security.Footnote ⁴⁷ This decision is a significant departure from the CJEU's prior case law insisting that to be proportionate, data retention had to be targeted. So why has the CJEU recently changed its mind? Have the “lower” standards adopted by the ECtHR Chamber in Big Brother Watch ruling in 2018 influenced the CJEU's laxer approach in Quadrature Du Net? Whatever the reason, the European courts now appear to be converging around the “inevitability” narrative of mass surveillance.

The convergence of the two European courts on substantive legality of mass surveillance regimes in Europe will have serious implications for the future development of surveillance programs, data retention, and sharing regimes in Europe and beyond. First, such convergence comes at a crucial time for EU institutions, which are now preparing an e-Privacy Regulation,Footnote ⁴⁸ and discussing an EU e-Evidence package, aimed at facilitating law enforcement agencies’ and judicial authorities’ cross-border access to electronic evidence.Footnote ⁴⁹

Second, such convergence provides extra weight to law enforcement in the ongoing discussions and negotiations of data sharing and retention regimes on international level. For example, in 2018 the UN established an open-ended, ad hoc, intergovernmental committee of experts tasked to elaborate a comprehensive international convention on cybercrime.Footnote ⁵⁰ The weak judgment in Big Brother and convergence of the ECtHR and CJEU—which are often regarded as the most pro-privacy courts in the worldFootnote ⁵¹—strengthens the position of law enforcement agencies in these ongoing discussions by affirming the prima facie legality of mass surveillance measures, and the ECtHR's abstract reasoning provides a lot of room to contracting states’ agencies to claim that their blanket, mass-surveillance regimes fall within the “margin of appreciation.” This impact is already evident in the updates to the Council of Europe's Cybercrime Convention (“Budapest Convention”),Footnote ⁵² which is the only binding international instrument on this issue. (The parties include the United States and the EU member states, except for Ireland and Sweden). The Second Additional Protocol to the Budapest Convention was adopted on November 21, 2021 and provides for enhanced international cooperation, including provisions on direct cooperation of law enforcement authorities with service providers in other jurisdictions.Footnote ⁵³

In conclusion, the ECtHR decision in Big Brother Watch will impact the future of surveillance. Currently, mass data interception is expressly prohibited in twenty-three European states. As the three partially dissenting judges noted: “There are rare occasions when the Court adjudicates on a case which shapes the future of our societies. The present one is such an example.”Footnote ⁵⁴ The ECtHR's minimalist approach, prioritizing procedural safeguards, as opposed to substantive legality, has also likely influenced the latest CJEU's case law on intelligence and surveillance. The full palette of constitutional and practical implications of such an increasing convergence between the two powerful European Courts remains to be seen, but it is likely that mass surveillance regimes will become increasingly legitimate in the UK, EU, wider Europe, and beyond. As Judge Pinto De Albuquerque warns in his dissenting opinion, “[i]n some corners of Europe, zealous secret services will be strongly tempted to take advantage of the Court's very lax fashion of formulating legal standards and innocent people will pay the price sooner or later.”Footnote ⁵⁵