National Council for Civil Liberties, R (on the application of) v Secretary of State for the Home Department & Anor

In this appeal the National Council for Civil Liberties, the appellant, challenges the compatibility of certain Parts of the Investigatory Powers Act 2016 (“the Act”) with Articles 8 and 10 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”). The appellant also challenges the compatibility of certain provisions of the Act with provisions of retained European Union (“EU”) law.

The Act is concerned with the interception of communications, equipment interference in order to obtain communications or other information, the acquisition and retention of communications data, and the retention and examination of bulk personal datasets. It was introduced with the broad aim of consolidating investigatory powers previously contained in other statutes – and in certain respects, expanding and adding safeguards to various of those powers. Various of the provisions of the Act were brought into force between November 2016 and February 2019. Some powers concern the obtaining and examination of the content of communications. Other powers relate to “communications data”, that is, data concerning matters such as where, when and by and to whom communications were sent but not the content of the communication.

The case itself and this appeal concerns in particular what are called “bulk powers”, that is, powers which are not directed at particular individuals. This appeal also concerns equipment interference warrants granted under Part 5 of the Act which can be directed not only to particular individuals but also at groups, organisations or those engaged in particular activities.

Whether the arrangements governing access to data involve a justified interference with the right to respect for private and family life guaranteed by Article 8 and the right to freedom of expression in Article 10 is at the heart of this appeal. Those articles provide:

By a claim form issued on 28 February 2017, the appellant, a well-known civil liberties organisation, brought a wide-ranging claim for judicial review. The claim challenged Parts 3, 4, 5, 6 and 7 of the Act on the ground that certain provisions violated Articles 8 and 10 of the Convention and also violated EU law. At that stage, the United Kingdom was a Member State of the EU and bound by EU law.

The Act is a lengthy and complicated piece of legislation. The Divisional Court recognised that a proper understanding of this case would be assisted by a summary of the Act’s provisions, and attached to its judgment an Annex (“the Annex”) prepared by the parties, which contained an agreed overview of the Act, subject to three “riders” from the appellant, then claimant, which were identified where relevant. For convenience we attach the Annex to this judgment. A recitation of the substance of the provisions under challenge is nonetheless unavoidable.

By way of introduction however it is sufficient to say that Parts 3 and 4 of the Act concern authorisations and notices for the retention and authorisation of communications data; Part 5, concerns warrants for targeted equipment interference for the obtaining of communications and equipment data and other information; Part 6, Chapter 1, concerns bulk interception warrants; Part 6, Chapter 2, concerns bulk acquisition warrants; Part 6, Chapter 3, concerns bulk equipment interference warrants; and Part 7, concerns warrants for the retention and examination of bulk personal datasets.

The Divisional Court (Singh LJ and Holgate J) dealt with the claim over the course of three very substantial judgments. The first judgment dealt with the compatibility of the provisions of Part 4 of the Act with certain aspects of EU law: see [2018] EWHC 975 (Admin) (“the first EU law Judgment”). The second judgment dealt with the challenge pursuant to the Human Rights Act 1998 (“the HRA”) and the Convention: see [2019] EWHC 2057 (Admin) [2020] 1 WLR 243 (“the Convention Judgment”). This was the only part of the proceedings below in which the Intervener, the National Union of Journalists, took part; and it is to the Convention Judgment that the Annex was attached. The third judgment dealt with the compatibility of provisions of Parts 3, 4, 5, 6 and 7 of the Act with EU law: see [2022] EWHC 1630 (Admin) (“the second EU law Judgment”).

The fact that this litigation has extended over a six-year period has added various layers of complexity to the case and to this appeal. In the result, we do not have the benefit of a reasoned judgment at first instance on some of the issues which are central to this appeal, the evidence is not necessarily apt to meet those issues; and the case as argued before us is different in certain material respects to the claim as originally mounted and argued before the Divisional Court. We should briefly explain how this state of affairs has come about.

There are eight grounds of appeal. Grounds 1 to 5 concern the Convention Judgment. Those grounds identify five areas where it is said that the Divisional Court erred in failing to find that provisions of the Act were incompatible with Article 8 and (in the case of the first three grounds) Article 10 of the Convention: see appellant’s notice dated 20 May 2022. Grounds 6 to 8 (our numbering) concern three EU law related grounds raised in respect of the first and second EU Judgments: see appellant’s notice dated 12 August 2022.

The Grounds may be summarised as follows:

In brief summary, our conclusions are first, that the provisions challenged in this appeal are, with one exception, Convention compliant, and secondly, that those provisions do not violate EU law. More specifically:

In Big Brother Watch, the Grand Chamber considered the compatibility of the provisions of section 8(4) of RIPA with Articles 8 and 10 of the Convention. Section 8(4) was repealed on 27 December 2018. Section 8(4) is materially different to the legislative provisions under consideration in this appeal and the new legislation includes additional safeguards.

Section 8(4) of RIPA conferred a power on the Secretary of State to issue a warrant for “the interception of external communications in the course of their transmission by means of a telecommunication system”. The Secretary of State was also required to issue a certificate setting out a description of the intercepted material which the Secretary of State considered it necessary to examine and stating that he or she considered that it was necessary in the interests of national security, for the purposes of preventing or detecting serious crime, or in the interests of the economic well-being of the United Kingdom so far as relevant to national security.

The complaint in Big Brother Watch concerned “the bulk interception of cross-border communications by the intelligence services” (paragraph 322). The Grand Chamber viewed bulk interception as a gradual process where the degree of interference with Article 8 rights increased as the process progressed. It acknowledged that bulk interception regimes did not all follow the same model, and that the different stages of the process would not necessarily be discrete or followed in strict chronological order. Subject to those caveats, the Grand Chamber considered that the bulk interception process could be described in four stages: (i) the interception and initial retention of communications and related communications data; (ii) the application of specific selectors to the retained communications or communications data; (iii) the examination of selected communications and communications data by analysts; and (iv) the retention and use of the product of the analysis, including sharing with third parties (paragraph 325). These stages are then described.

The Grand Chamber considered that Article 8 applied to each of those four stages; that the initial interception followed by the discarding of parts of the communications did not constitute a particularly significant interference; and that the degree of interference increased as the bulk interception process progressed (paragraph 330).

The Grand Chamber noted that any interference with a person’s Article 8 rights could only be justified if it is in accordance with law, pursues one or more legitimate aims and is necessary in a democratic society to achieve such aims. The requirement that the interference be “in accordance with law” required the impugned measure to have a basis in domestic law, to be accessible, and to be foreseeable (that is, that there must be sufficiently clear rules to give citizens an adequate indication as to the circumstances in which, and the conditions on which, public bodies may resort to such measures). Furthermore, the lawfulness of the interference was closely related to whether the interference was “necessary”, in particular by providing adequate and effective safeguards against abuse (paragraphs 332 to 334).

The Grand Chamber accepted that bulk interception regimes fell within the range of a state’s discretion. The decision to operate a bulk interception regime in order to identify threats to national security or to essential national interests fell within this margin of appreciation (paragraph 340). It then explained how bulk interception was generally directed at international communications, and was not necessarily targeted at specific individuals but could be used for that purpose. At that stage, individuals could be targeted by the use of what it termed “strong selectors”, i.e., search terms for examining the material which are related to individuals (paragraphs 344 to 348).

Against that background, the Grand Chamber set out the approach to be followed in bulk interception cases. The grounds upon which bulk interception might be authorised and the circumstances in which an individual’s communications might be intercepted must be identified (paragraph 348). Bulk interception should be authorised by an independent body who should be informed both of the purpose of the interception and the bearers (that is the communication systems) subject to interception. Dealing with the examination of intercepted material, the authorisation should identify the “types or categories of selectors to be used” (paragraph 354). Further, the use of “strong selectors”, that is, search terms linked to identifiable individuals, must be justified by the intelligence services by reference to necessity and proportionality and be recorded and subject to a process of prior internal authorisation (paragraph 355). There should be supervision of the bulk interception process by an independent authority and an effective remedy should be available to anyone who suspected that his or her communications had been intercepted (paragraphs 356 and 357).

The Grand Chamber summarised its approach in the following way at paragraph 360:

Further, at paragraph 361, it said this:

The Grand Chamber offered guidance on the safeguards necessary in connection with the communication of intercepted material to foreign states or international organisations. The circumstances in which such a transfer may take place should be set out clearly in domestic law. The transferring state should make sure that the receiving state has adequate safeguards in place, particularly as regards secure storage and the restriction of onwards transmission. Heightened safeguards would be necessary where the material required special confidentiality such as confidential journalistic material. Transfer should be subject to independent control (paragraph 362).

It did not consider that the acquisition of communications data through bulk interception was necessarily less intrusive than the acquisition of content. It therefore considered that the interception, retention and searching of communications data should be analysed by reference to the same safeguards as those applicable to content. However, in view of the different character of communications data, and the different way in which they were used by the intelligence services, the legal provisions governing the treatment of communications data did not have to be identical in every respect to those governing the treatment of content (paragraphs 363 to 364).

The Grand Chamber then carried out an assessment of the whole process governing the bulk interception of communications and related communications data to determine whether viewed as a whole it contained “sufficient end-to-end safeguards” to provide adequate and effective safeguards against arbitrariness and the risk of abuse. In that regard, it considered the eight features that it had identified.

First, the grounds upon which bulk interception could be authorised under RIPA were that the Secretary of State was satisfied that it was necessary in the interests of national security, for the purpose of preventing or detecting serious crime, or safeguarding the economic well-being of the United Kingdom. Although broad, the identification of those as grounds for bulk interception was not of itself considered deficient (paragraphs 368 to 371).

Secondly, the circumstances in which an individual’s communications might be intercepted under section 8(4) of RIPA were sufficiently foreseeable. The warrant authorised the interception of those bearers (or communication systems) most likely to be carrying external communications of interest to the intelligence service (paragraphs 372 to 376).

Thirdly, the Secretary of State alone had the power to issue a warrant. There was no requirement for authorisation by a body independent of the executive. Consequently, “the section 8(4) regime lacked one of the fundamental safeguards: namely that bulk interception should be subject to independent authorisation at the outset” (paragraph 377). (The position is different under the Act, where there is the “double-lock”, that is, the decision to grant a warrant is taken by the Secretary of State but has to be approved by a Judicial Commissioner.)

In terms of the level of scrutiny provided for, the procedure for granting authorisation involved the following. The application had to include a description of the communications to be intercepted, details of the communications service providers, an assessment of the feasibility of the operation, a description of the conduct to be authorised, an explanation of why interception was necessary for the permitted purposes for which authorisation had to be granted and various assurances. The Secretary of State would have to provide a certificate setting out the intercepted material that the Secretary of State considered it necessary to examine. The Grand Chamber considered that that would mean that the Secretary of State would be informed of the purposes of the operation (national security, prevention or detection of serious crime, or protection of the economic well-being of the United Kingdom) and would have to assess whether the warrant was necessary for those purposes and proportionate for what it sought to achieve.

Fourthly, the Grand Chamber noted that the application for a warrant did not have to include an indication of the categories of “selectors” or search terms to be employed and as a consequence there was no possibility for their necessity and proportionality to be assessed at the authorisation stage. Given that the choice of search terms determined which communications would be eligible for examination by an analyst, the Grand Chamber considered that the categories or types of “selectors” (or search terms) should be identified in the authorisation and that “strong selectors” (or search terms) linked to identifiable individuals should be subject to prior internal authorisation. In those circumstances, it considered that “the absence of any oversight” of the categories of selectors at the authorisation stage was “a deficiency in the section 8(4) regime”. The Grand Chamber also noted that there was no prior internal authorisation of “strong selectors” linked to identifiable individuals (although analysts had to record and justify the use of such selectors or search terms and that was subject to subsequent independent supervision (paragraphs 378 to 383)). Further, the certificate that the Secretary of State had to provide under section 8(4) of RIPA was couched in such general and insufficiently precise terms, that did not provide any meaningful restriction on the process of selecting material for examination (paragraphs 384 to 391). The Grand Chamber considered that subject to the “deficiencies relating to the authorisation of selectors” and the general nature of the section 8(4) RIPA certificate, the circumstances in which the intercepted material could be selected were sufficiently foreseeable for the purposes of Article 8 of the Convention (paragraph 391).

In relation to the remaining four criteria, the Grand Chamber considered that the safeguards in place were sufficiently clear and satisfactory to guarantee against abuse (paragraphs 392 to 399 in relation to communication to other states, paragraphs 400 to 405 on duration, storage and destruction of intercepted material, paragraphs 406 to 412 on supervision of the regime and paragraphs 413 to 415 on ex post facto review).

The Grand Chamber considered related communications data and identified the same three deficiencies, namely the absence of prior independent authorisation, the failure to identify the categories of selectors in the application, and the failure to subject selectors linked to identifiable individuals to prior internal authorisation, together with the general nature of the section 8(5) certificate. It did not consider that two other matters carried decisive weight in the assessment, namely that where communications data were examined by reference to a selector referable to an individual known to be in the British Islands that selector or search term did not need approval as necessary and proportionate by the Secretary of State, and that communications data could be kept for a longer period than communications (paragraphs 416 to 423).

In the light of that assessment, the Grand Chamber concluded that “bulk interception is of vital importance to Contracting States in identifying threats to their national security” (paragraph 424). At paragraph 425 to 427, it said this:

The Grand Chamber then considered whether there had been a violation of Article 10 of the Convention. It recognised that freedom of expression constituted one of the essential foundations of a democratic society. It noted that the safeguards for the press were particularly important and that the protection of journalistic sources was one of the cornerstones of a free press. It noted that orders to divulge a source could have a detrimental impact, but considered that the search of a journalist’s home or workplace to reveal or confirm the identity of the journalist’s sources constituted a more drastic measure (paragraphs 442 to 445).

It set out its general approach to Article 10 in the context of bulk interception. It noted that under the section 8(4) RIPA regime, the intelligence services could access confidential journalistic material either intentionally, through the use of search terms connected to a journalist or news organisation, or unintentionally as a consequence of the bulk interception operation accessing material which turned out to be confidential journalistic information. It considered that, before the intelligence services used selectors which were known to be connected to a journalist, or which would make the selection of confidential journalistic material highly probable, those search terms should have been authorised by an independent body who could determine whether these were justified by an overriding requirement in the public interest (paragraphs 445 to 449). Domestic law should also contain safeguards regarding storage, examination, use, onward transmission and destruction (paragraph 450). Applying that approach to the regime in issue there, the Grand Chamber identified two weaknesses. These were first that where the intention was to access confidential journalistic material, or where the use of particular search terms made that highly probable, there was no provision for authorisation by an independent person who could determine whether that was justified by an overriding public interest requirement. Secondly, there were insufficient safeguards for storing or examining such material once it became apparent that such material had been examined. In view of those weaknesses, the European Court found a breach of Article 10 (paragraphs 451 to 451).

The Grand Chamber also considered the application of Article 10 to the regime in RIPA governing the bulk acquisition of communications data. It noted that the relevant code of practice required that where an application was intended to determine the source of journalistic information there had to be an overriding requirement in the public interest for such a warrant. However, those provisions of the code of practice only applied where the purpose was to determine a source and did not apply in every case where a request was made for the communications data of a journalist or where such an intrusion was likely. Further, there was no requirement restricting access to serious crime (as opposed to crime). For those reasons, the Grand Chamber found that there had been a violation of Article 10 in relation to the regime governing the acquisition of communications data as the regime was not in accordance with law (paragraph 517).

Before addressing the legislative scheme in detail as we must, it is important to have in mind the problems to which the Act is addressed and the degree of scrutiny given to the provisions of the Act prior to its enactment. These matters are fully set out in the Convention Judgment (handed down, as we have said, before the Grand Chamber’s decision in Big Brother Watch) in the following terms:

Any assessment of the compatibility of the provisions of the Act with the Convention or retained EU law, will, critically, involve consideration of the whole scheme of the Act and relevant Codes of Practice, and a close assessment as well as an overview, of the safeguards governing the regime.

Part 1 of the Act sets out an overview of the Act and general privacy duties. Section 1 provides so far as material that:

Section 2 of the Act sets out general duties on public authorities in relation to privacy, dealing with the powers conferred by Parts 3, 4, 5, 6 and 7 of the Act. It provides, so far as material, that:

Part 2 of the Act deals with targeted interception warrants. These are warrants which authorise the interception of communications in relation to a particular person or organisation, or a single set of premises. Such a warrant may extend to groups who share a common purpose or carry on a common activity or more than one person or organisation or premises where the warrant is for the purposes of a single investigation or operation (sections 15 and 17 of the Act). No issue arises on this appeal in relation to these warrants.

As already mentioned, in Parts 3 and 4 the Act deals with the bulk retention and acquisition of communications data. In Part 5 it deals with targeted equipment interference warrants. Part 6 deals with bulk powers governing bulk interception, bulk acquisition and bulk equipment interference warrants which are dealt with in Chapters 1, 2 and 3 of Part 6, respectively. Part 7 deals with the retention and examination of bulk personal datasets.

It is convenient to start with the provisions in Part 6.

A bulk interception warrant is a warrant that authorises the interception of communications or the obtaining of secondary data, and the examination and disclosure of the content of the intercepted communications or secondary data. Further, the main purpose of the warrant must be the interception of “overseas-related communications” (or obtaining secondary data from such communications), that is, communications sent or received by individuals who are outside the British Islands (section 136 of the Act). The purpose therefore is to facilitate the interception of cross-border communications by the intelligence services.

An application for a warrant may only be made on behalf of the head of an intelligence service (they are not available to public authorities generally). The power to issue the warrant must be exercised by the Secretary of State personally. The Secretary of State may only grant a bulk interception warrant if he or she considers, amongst other things, that the warrant is necessary “in the interests of national security” or for national security reasons together with the prevention or detection of serious crime or in the interests of the economic well-being of the United Kingdom so far as relevant to national security. The Secretary of State must also consider whether the conduct authorised by the warrant is proportionate and if the examination of intercepted communications or secondary data is necessary for each of the specified operational purposes: sections 138 and 141 of the Act. The Secretary of State must also comply with the obligations imposed by section 2 of the Act, including considering whether what is sought could be reasonably achieved by less intrusive means, whether the level of protection for the information should be higher because of its particular sensitivity, and any other aspects of the public interest in the protection of privacy.

The issuing of a bulk interception warrant is subject to prior approval by a Judicial Commissioner, that is, a person who holds or has held high judicial office (section 227(2)). Such persons will have experience of independent and impartial scrutiny of the exercise of executive powers. The need for the warrant to be granted personally by the Secretary of State and approved by the Judicial Commissioner is what is referred to as the “double-lock.” That safeguard did not exist under RIPA where there was no provision for prior approval by an independent judicial body. Section 140 of the Act provides, so far as material, that:

The reference to operational purposes is a reference to one of the requirements that must be met by a warrant. Section 142 provides, so far as material, as follows:

Further provisions governing the information that must be included in an application for a bulk interception warrant are set out in the Interception Code of Practice (“the Interception Code”) issued pursuant to Schedule 7 to the Act. That explains that the application should contain the background to the application, a description of the communications to be intercepted and the conduct to be authorised, the operational purposes for which the data may be selected for examination and an explanation of why examination is or may be necessary, and a description of why it is necessary to authorise the conduct for one of the statutory purposes for which warrants may be granted which must always include an explanation of why the interception is necessary in the interests of national security and other matters (paragraph 6.20 of the Interception Code). The Judicial Commissioner is also able to seek clarification or additional information in relation to a warrant application and there is an obligation on the agency requesting the warrant to provide information and documents if requested to do so (section 235 of the Act and paragraph 6.29 of the Code).

The Secretary of State must satisfy herself that arrangements are in force providing safeguards governing the use and retention of material (section 150). The arrangements must ensure that the number of people to whom material is disclosed, and the extent to which it is made available and copied is limited to the minimum necessary (section 150). The arrangements must also ensure that the selection of intercepted communications and secondary data is carried out only for the operational purposes specified in the warrant and if that is necessary and proportionate (section 152). Further, the criteria used for the selection of material for examination must not be referable to an individual known to be in the British Islands (section 152). There are safeguards relating to the disclosure of material to overseas authorities (section 151) and the selection for examination of legally privileged material (section 153).

There are additional safeguards in relation to confidential journalistic material. Once the amendments come into force (see paragraph 9 above), the Investigatory Powers Commissioner must first approve the use of selection criteria where one of the purposes is to identify confidential journalistic information or to identify or confirm a source of journalistic information, or the use of such criteria would be highly likely to identify such material or source. In a written ministerial statement made to Parliament on 31 March 2022, the Secretary of State stated that prior internal authorisation for the use of what were called “strong selectors”, that is, search terms linked to identifiable individuals (such as e-mail addresses) will be required.

Bulk interception warrants last for 6 months unless already cancelled. They may be renewed by a decision of the Secretary of State, taken personally, and with the approval of the Judicial Commissioner (section 144).

There is provision for supervision and oversight of these powers in Part 8. The arrangements are described below. There are provisions for applications to an Investigatory Powers Tribunal (“IPT”) which are also described below.

A bulk acquisition warrant is a warrant requiring a telecommunications operator to obtain and/or disclose any communications data specified in the warrant (section 158(5)-(6)). The power is limited to communications data. That is defined as data about a person or thing (entity data) and data which defines an event on or by means of a telecommunication system (events data). In very broad terms, it covers data about who was using a telecommunications system and where and when. It does not include the content of communications (section 261).

The arrangements governing these warrants are broadly similar to the arrangements described above in relation to bulk interception warrants. In brief, the warrant must be necessary in the interests of national security (alone or together with prevention or detection of serious crime or the economic well-being of the United Kingdom so far as relevant to national security) (section 158). They must specify the operational purpose for which any communications data may be selected for examination (section 161). The warrant may only be applied for by or on behalf of the head of an intelligence service and must be granted by the Secretary of State personally (sections 158(9) and 160). The Secretary of State must ensure that the warrant is necessary for the statutory purposes. The warrant must be approved by a Judicial Commissioner who must consider whether the warrant is necessary for the statutory purposes, that the conduct authorised is proportionate to what is sought to be achieved and that the examination of the communications data for each of the specified operational purposes is necessary (section 159). The Secretary of State must be satisfied that there are in force satisfactory arrangements governing the use and disclosure of data (section 171). They must ensure that the number of people to whom the material is disclosed and the extent to which it is made available and copied is limited to the minimum necessary (section 171). The arrangements must also ensure that data may only be selected for examination for the specified operational purposes and so far as that is necessary and proportionate (section 172). Warrants cease to have effect after six months (section 162). The oversight arrangements in Part 8, described below, and the provisions for applications to the IPT, apply to the exercise of functions governing bulk acquisition warrants.

Bulk equipment interference warrants authorise the interference with any equipment for the purpose of obtaining communications, equipment data and other information. Their main purpose must be to obtain overseas-related communications, information or equipment data. Such a warrant may also authorise the selection for examination of any material obtained under the warrant and the disclosure of such information (section 176).

The arrangements governing these warrants are similar to the arrangements governing bulk interception warrants. In brief, the warrant must be necessary in the interests of national security (alone or together with prevention or detection of serious crime or the economic well-being of the United Kingdom so far as relevant to national security) (section 178). They must specify the operational purpose for which any material obtained under the warrant may be selected for examination (section 183). The warrant may only be applied for by or on behalf of the head of an intelligence service and must be granted by the Secretary of State personally (section 178(4) and 182). The Secretary of State must ensure that the warrant is necessary for the statutory purposes. The warrant must be approved by a Judicial Commissioner who must consider whether the warrant is necessary for the statutory purposes, that the conduct authorised is proportionate to what is sought to be achieved and that the examination of the material for each of the specified operational purposes is necessary (section 179). There are provisions requiring the Secretary of State to ensure that there are arrangements in force governing the use and retention of such material (section 191). Those arrangements must ensure that the number of people to whom the material is disclosed and the extent to which it is made available and copied is limited to the minimum necessary (section 191). Those arrangements must also ensure that selection of data for examination may only be carried out for the operational purposes specified in the warrant and if that is necessary and proportionate. Further, data must not be selected for examination if any of the criteria used for selection are referable to an individual known to be in the British Islands (section 191 and 193). Warrants cease to have effect after six months (section 184). The oversight arrangements in Part 8, described below, and the right of application to the IPT apply to the exercise of functions governing bulk equipment interference warrants.

Parts 3 and 4 of the Act deal with the retention and acquisition of communications data. They do not relate to the content of communications.

Part 4 deals with retention. Section 87 of the Act provides for the Secretary of State to issue a retention notice to a telecommunications operator to retain communications data. Such notices may be given where the Secretary of State considers retention necessary and proportionate in the interests of one or more of the following purposes: national security, prevention or detection of serious crime or crime (for communications data relating to events, and entities respectively), economic well-being of the United Kingdom so far as relevant to national security, public safety, prevention of death or injury, or investigation of alleged miscarriages of justice. A notice cannot require data to be retained for more than 12 months. Section 87(2) provides that a retention notice may:

A Judicial Commissioner must approve the decision to issue a retention notice and must consider whether the notice is necessary and proportionate for the purposes for which it is sought. A Judicial Commissioner must also consider the matter with a sufficient degree of care to ensure that he or she complies with the general obligations relating to the protection of privacy set out in section 2 of the Act (section 89). There are obligations on a telecommunications operator to maintain the integrity and security of communications data which it is required to retain under the Act (section 92) and to put in place adequate security arrangements to prevent unauthorised disclosure (section 93).

Part 3 of the Act deals with authorisations for obtaining data that has been retained. Section 60A of the Act empowers the Investigatory Powers Commissioner to authorise a relevant public authority to obtain the communication data where he or she considers:

The purposes for which communications data may be obtained are those for which a retention notice may be issued and are described in paragraph 26 above, together with one additional purpose, the identification of a dead person or a person who is unable to identify himself or herself because of a mental or physical condition (section 60A(7)). There are restrictions on the circumstances in which the Investigatory Powers Commissioner can authorise the obtaining of data which can only be obtained by processing an internet connection record. The Investigatory Powers Commissioner cannot grant such authorisations to local authorities and, in relation to other public authorities, the purposes for which that data may be obtained are restricted to the interests of national security or the prevention or detection of serious crime and the Investigatory Powers Commissioner considering that it is necessary to obtain the data to identify which person or apparatus is using an internet service (section 62). Authorisations last for one month (section 65). There are additional powers for designated senior officers of certain public authorities to grant authorisations (sections 61 and 61A).

The oversight arrangements in Part 8, described below, and the provisions for application to the IPT, apply to the retention and acquisition of communications data under Parts 3 and 4 of the Act.

The warrants that may be issued under Part 5, and which are in issue this appeal, are targeted equipment interference warrants. That is a warrant which authorises a person to secure interference with any equipment for the purpose of obtaining communications, equipment data and any other information, including by monitoring, observing or listening to a person’s communications and recording them (section 99). The subject matter of targeted equipment interference warrants is defined in section 101 of the Act as follows:

The applications under section 102 must be made by or on behalf of the head of an intelligence service. The Secretary of State may only issue a warrant if it is necessary in the interests of national security, for the purposes of preventing or detecting serious crime or in the interests of the economic well-being of the United Kingdom (so far as those are relevant to the interests of national security). The Secretary of State must consider that the conduct authorised by the warrant is proportionate to what is sought to be achieved (section 102). The Secretary of State must also ensure that there are arrangements in place for limiting the number of persons to whom material is disclosed, the extent to which any material is disclosed, and the extent and number of any copies (sections 102(1)(c) and 129). If one of the purposes is to obtain items subject to legal privilege, that must be stated in the application and the warrant; and the Secretary of State must have regard to the public interest in the confidentiality of legally privileged material and may only grant the warrant if there are exceptional and compelling circumstances which make it necessary to authorise such interference and there are arrangements in place relating to the disclosure and retention of such material (sections 112 and 129). If one of the purposes of the warrant is to obtain confidential journalistic material or to identify or confirm a source of journalistic information, that must be stated in the application for a warrant and the Secretary of State may only issue the warrant if there are arrangements in place relating to the disclosure and retention of such material (sections 112, 113 and 129). The details that must be specified in the warrant are set out in section 115 of the Act. There are also detailed provisions governing warrants granted on the application of the Chief of Defence Intelligence and law enforcement officers (sections 104 to 107). In addition, under section 106, applications may be granted by law enforcement chiefs on the application of an appropriate officer to them (with Judicial Commissioner approval).

A Judicial Commissioner must approve the decision to issue a targeted equipment interference warrant. The Judicial Commissioner must consider whether the warrant is necessary and whether the conduct authorised is proportionate (section 108).

The oversight arrangements in Part 8, and the provisions for application to the IPT, apply to the exercise of functions related to the issuing of targeted equipment interference warrants.

The provisions in Part 7 authorise the retention and examination of bulk personal datasets which the intelligence services have already acquired under other statutory provisions. Section 200 of the Act provides that an intelligence service may not exercise a power to retain or examine a bulk personal dataset unless that is authorised by a warrant issued under Part 7. The intelligence services retain a bulk personal dataset if they have acquired a set of information, including personal data within the meaning of section 3(2) of the Data Protection Act 2018, relating to a number of individuals, the nature of the set is such that the majority of the individuals are not and are unlikely to become of interest to the intelligence services, the intelligence services retain the set and the set is held or to be held electronically for analysis.

There are two types of warrants that can be issued under Part 7. First there are class bulk personal dataset warrants, applicable to a class of bulk personal datasets, and second, specific bulk personal dataset warrants. In both cases, an application is made by or on behalf of the head of an intelligence service and an application must be granted by the Secretary of State personally (sections 204 and 205). The Secretary of State may only issue either type of warrant if he or she considers it necessary in the interests of national security, for the purpose of preventing or detecting serious crime, or in the interests of the economic well-being of the United Kingdom so far as relevant to the interests of national security and that the conduct authorised is proportionate (sections 204 and 205). An application must specify the operational purpose or purposes which are to be included in the warrant (if any) (sections 204(2) and 205(4)). The Secretary of State must consider that examination of the relevant bulk personal datasets is necessary for each of the specified operational purposes (sections 204(3)(c) and 205(6)(c)). The Secretary of State must consider that the arrangements for storing bulk personal datasets and preventing unauthorised disclosure are satisfactory.

There are specific restrictions on the use of protected data. For present purposes, protected data, essentially, comprise the content of communications (save that systems data, which might include certain types of data which include content, namely data enabling or facilitating the function of a telecommunication system or service, and information which is not private information are not protected data). Class bulk personal dataset warrants cannot authorise the retention or examination of protected data (section 202). Where a specific bulk personal dataset warrant is issued, the Secretary of State may impose conditions governing the selection for examination of protected data on the basis of criteria referable to an individual known to be in the British Islands. There are also restrictions on the issuing of a specific bulk personal dataset warrant if the purpose is to authorise the retention and examination of health records. The Secretary of State may only issue a specific bulk personal dataset warrant if there are exceptional and compelling circumstances that make it necessary to authorise the retention or examination of health records.

A Judicial Commissioner must approve the decision to issue a class or a specific bulk personal dataset warrant. The Judicial Commissioner must consider whether the warrant is necessary for the stated purpose, whether the conduct authorised is proportionate, and whether examination of the bulk personal dataset, or the class of bulk personal datasets, described in the warrant is necessary for each of the specified operational purposes (section 208).

The oversight arrangements in Part 8, and the provisions for application to the IPT, apply to the exercise of statutory functions in relation to bulk personal datasets.

Part 8 of the Act provides for the oversight of the exercise of statutory functions. There is provision for the Investigatory Powers Commissioner to keep the exercise of functions relating to the interception of communications, the acquisition or retention of communications data, and equipment interference under review by way of audit, inspection and investigation (section 229). The Investigatory Powers Commissioner must make an annual report to the Prime Minister about the carrying out of the functions of Judicial Commissioners. This must include statistics on the use of investigatory powers, the results (including the impact) of such use, information about the operation of the safeguards in relation to legally privileged material, confidential journalistic material and sources. Copies of those reports must be sent to the Intelligence and Security Committee of Parliament. That Committee may refer matters to the Investigatory Powers Commissioner with a view to it being subject to investigation, inspection or audit (sections 234 and 236).

The IPT is created by section 65 of RIPA. The IPT has jurisdiction to hear complaints by persons aggrieved by the conduct of the intelligence services, or conduct for or in connection with the interception of communications. It is the sole appropriate tribunal for the purposes of section 7 of the HRA, that is, determining whether conduct by the intelligence services amounts to a violation of a Convention right.

As noted above, because the Convention Judgment was given before the decision of the Grand Chamber in Big Brother Watch we do not have the benefit of the Divisional Court’s views on its implications for the issues that arise in this appeal (materially for present purposes in relation to Grounds 1 to 3). The Divisional Court’s analysis is nevertheless valuable in the following respects.

First, the Divisional Court identified that the real focus of the claim for judicial review was that the Act did not contain sufficient safeguards against the risk of abuse of discretionary powers. The claim did not allege that the provisions of the Act were not necessary or were not proportionate (paragraphs 154 to 156 of the Convention Judgment). Instead, it sought to obtain a declaration of incompatibility on the basis that the Act did not satisfy the requirement that any interference with the rights guaranteed by Article 8 had to be “in accordance with law” or prescribed by law for the purposes of Article 10.

Secondly, in the context of challenges to the bulk interception powers, as the Divisional Court observed at paragraph 160:

Thirdly, the Divisional Court drew attention to the significant differences between the statutory regime set out in the Act on the one hand and section 8(4) of RIPA on the other. In relation to bulk interception warrants, for example, the Divisional Court identified a number of relevant features of the Act which differed from RIPA: see paragraphs 142 to 151 of the Convention Judgment. Further, the Divisional Court emphasised that the Act, unlike RIPA, did require prior approval by an independent body of the decision to issue the warrant (the so called “double-lock”). At paragraph 149 to 151, the Divisional Court said this:

It was against that background that the Divisional Court considered whether the totality of the safeguards provided under the Act in respect of the different powers conferred by the different parts of the Act were compatible with the Convention and found that the legislation was not incompatible with the Act (a conclusion that the appellant now contends is not consistent in certain respects with the observations of the Grand Chamber in Big Brother Watch).

Fourthly, the Divisional Court considered issues about which the Grand Chamber did not make any observations, and which now form the subject matter of Grounds 4 and 5 of the appeal.

Ground 4 concerns the claim that Part 7 of the Act, which deals with the retention of bulk personal datasets, is “impermissibly wide” so that the circumstances in which a bulk personal dataset warrant may be issued are not foreseeable and therefore not in accordance with law.

The Divisional Court identified the features, and the legal safeguards applying to bulk personal datasets at paragraph 214 to 219 of the Convention Judgment in the following terms:

At paragraphs 223 to 227, the Divisional Court summarised the basis of the challenge in relation to bulk personal datasets and its conclusion in the following terms (references omitted):

The fifth ground of appeal concerns the adequacy of the safeguards in relation to legally privileged material.

The Divisional Court described the safeguards in relation to bulk interception warrants and bulk equipment interference warrants in Chapters 1 and 3 of Part 6 in the following terms at paragraphs 276 to 278 of the Convention Judgment:

The Divisional Court noted that similar provisions to those three safeguards for legally privileged material had been enacted in relation to specific bulk personal dataset warrants under Part 7 (paragraph 280). Further, the selection criteria referable to a person known to be in the British Islands could only be used with the prior approval of a Judicial Commissioner (sections 222(2) and (4)). Provisions similar to the first two safeguards described above in relation to legally privileged material had also been enacted in relation to targeted equipment interference warrants under Part 5. Such warrants also require prior approval by a Judicial Commissioner.

Finally, the Divisional Court focussed on the oral submissions of counsel which criticised the absence of safeguards for legally privileged material in respect of the bulk acquisition of secondary data and non-protected data (under Chapters 1 and 3 of Part 6 and Part 7). The criticism involved assumptions that it may be possible to identify who has been communicating with whom from such data (and the further assumption, it seems, that such facts were legally privileged). There was further criticism of the lack of safeguards for the bulk acquisition of communications data (not content) under Part 2 of Chapter 6.

The Divisional Court dealt with these issues at paragraphs 285 to 292 in the following terms:

For those reasons, the Divisional Court held that the provisions of Parts 3, 4, 5, 6 and 7 were not incompatible with Articles 8 and 10 of the Convention.

The Divisional Court also considered, and rejected, five specific arguments concerning the scope of the definitions used in connection with safeguards relating to journalistic material (paragraphs 340 to 352 of the Convention Judgment).

The issues of retained EU law have their origin in Directive 2002/38/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (“the Directive”) and provisions of the Charter. Article 5 of the Directive provides that Member States shall ensure the confidentiality of communications and related traffic and, in particular, shall prohibit, amongst other things, interception or surveillance of communications and related traffic data.

Article 15 of the Directive, however, permits Member States to adopt legislative measures when such restrictions constitute a necessary, appropriate and proportionate measure within a democratic society to safeguard national security.

Article 8 of the Charter guarantees that everyone has the right to protection of personal data concerning him or her. Article 7 of the Charter guarantees to everyone the right to respect for his or her private and family life, home and communications. Article 11 of the Charter guarantees the right to freedom of expression. These later two articles correspond to Articles 8 and 10 of the Convention, respectively. Article 52 of the Charter provides that any limitation on the exercise of the rights recognised by the Charter must be provided by law and must be necessary. Article 52.3 of the Charter provides that:

The Act was adopted, and the claim for judicial review issued, at the time when the United Kingdom was a member of the European Union. The provisions of the Directive were therefore capable of being directly effective in United Kingdom law by virtue of section 2 of the European Communities Act 1972 (“the 1972 Act”). The Charter was also part of the law of the United Kingdom at that stage by virtue of the 1972 Act. The United Kingdom left the European Union on 31 January 2020 and the 1972 Act was repealed. There then followed an implementation period during which European Union Law continued to be part of the law of the United Kingdom. That period ended on 31 December 2020.

However, Parliament provided that any rights or remedies formerly arising under the 1972 Act (such as a directly effective right derived from a European Union Directive) remained available in domestic law (section 4 of the European Union (Withdrawal) Act 2020 (the 2020 Act)). The Charter ceased to be part of the law of the United Kingdom save that Parliament enacted that the Charter continued to apply in relation to proceedings started before the end of the implementation period (section 5(4) and paragraph 39(3) of Schedule 8 to the 2020 Act). By that route, as the Divisional Court recognised, the provisions of the Directive and the Charter remain relevant to this claim (paragraphs 28 to 37 of the second EU Judgment).

Against that background, three issues of retained EU law were considered by the Divisional Court and are now raised on this appeal.

The first concerns decisions of the CJEU that Article 15 of the Directive must be read as precluding national legislation which, for the purpose of preventing or detecting crime, provided for the general and indiscriminate retention of all data: see Joined Cases C-203/15 and C-698/15 Tele2Sverige AB v Post-och telstyrelsen and Watson.

In the first EU Judgment, the Divisional Court considered, amongst other questions, whether Part 4 of the Act involved the general and indiscriminate retention of data. It observed that the categorisation had been applied to Swedish legislation in the Tele2Sverige case heard with the Watson case. That legislation required all providers of electronic communications to retain all data. The requirements of the legislation were not qualified by a necessity or a proportionality test. The Divisional Court considered that Part 4 of the Act was different for seven reasons set out at paragraphs 127 to 134:

The Divisional Court concluded that Part 4 of the Act did not involve the general and indiscriminate retention of data. It summarised its conclusions in paragraphs 135 and 137 in the following way:

In the second EU Judgment, the Divisional Court later concluded that Part 3 of the Act did not provide for general and indiscriminate retention of data for eight reasons. These were set out at paragraphs 109 to 117 of the Second EU Judgment. The Divisional Court also rejected arguments that Parts 5 and 6 involved the general and indiscriminate retention of data as that term was used by the CJEU, as the analysis applicable to Part 4 applied to Parts 5 and 6 as well.

In relation to Part 7, the Divisional Court considered that Part 7 did not fall within the scope of EU law saying, at paragraph 139 of the Second EU Judgment that:

The Divisional Court also considered an argument that parts of the Act did not require independent authorisation each time data was accessed for a purpose other than national security, save in limited circumstances, and that this was inconsistent with the Watson judgment. The Divisional Court rejected that argument at paragraph 145 of the second EU Judgment:

Finally, of relevance to this appeal, the Divisional Court considered an argument that, following the decision of the Grand Chamber in Big Brother Watch, the Act should be understood to be incompatible with the Convention in two specific respects and that the Charter should be interpreted and applied in the same way. In that regard, the Divisional Court noted that it had already given its judgment on the Convention issue (in the Convention Judgment) and that the view to be taken of the decision in Big Brother Watch was a matter for the Court of Appeal. In relation to EU law, the Divisional Court said the judgment of the Grand Chamber was not binding on the CJEU. Further, if any judgment of the CJEU were to adopt the reasoning of the Grand Chamber, that judgment would not be binding on the courts in the United Kingdom, although those courts could take it into account following the United Kingdom’s departure from the European Union.

In those circumstances, the Divisional Court considered that the claimant could not rely on EU law as an indirect means of achieving compliance with the judgment of the Grand Chamber in Big Brother Watch (paragraphs 149 to 158 of the second EU Judgment).

For the purposes of this appeal, it is convenient to take the Grounds of Appeal in the following order. We deal first with Ground 2, so far as that concerns Parts 6 and 5 of the Act, as this ground involves a generalised challenge to the adequacy of the different Parts of the Act when measured against the Convention. We deal next with Grounds 1 and 3, 4 and 5 in so far as they challenge particular aspects of Parts 6, 3, 4 and 5 of the Act. We then turn to the challenges under Grounds 1 to 5 in so far as they concern Part 7. Finally, we deal with Grounds 6 to 8 as they raise discrete points relating to retained EU law.

Mr Ben Jaffey KC, with Mr Heaton and Ms Bird, for the appellant, submits that three significant safeguards identified as necessary by the Grand Chamber in Big Brother Watch are absent in relation to Parts 5 and 6 of the Act. Consequently, the provisions are not in accordance with law for the purposes of Article 8, are not prescribed by law for the purposes of Article 10, and do not justify any interference with the rights guaranteed by those Articles.

First, Mr Jaffey submits that the Grand Chamber recognised that there was a need for the categories or types of selectors, or search terms, to be identified in the application for the warrant and there was no provision for that under the Act. Mr Jaffey relies on paragraphs 354 and 381 to 382 amongst others of the judgment in Big Brother Watch. He submits that the requirement in sections 142 and 183 (in Part 6 Chapters 1 and 3) that operational purposes be specified was insufficient for these purposes. That requirement simply set out the purpose for which a warrant could be granted at a greater level of specificity than the grounds upon which a warrant could be granted. It was a subcategory of purpose, not a category of search terms. It did not describe the category of selectors or search terms that would be used for deciding whether material would be examined. Further, the specified operational purposes were no different in substance from the certificate that had to be provided previously under section 8(4) of RIPA and that had been found to be insufficient in Big Brother Watch. The same applied to Part 7. There was no requirement for the operational purposes to be specified for warrants issued under Part 5 of the Act.

Secondly, Mr Jaffey submits that the use of strong selectors, that is search terms linked to an identifiable individual to identify which material should be examined, required prior internal authorisation. The respondents had accepted that prior internal authorisation was required for strong selectors in relation to bulk interception warrants under Part 6 Chapter 1. However, the respondent had not accepted that that was required for the remainder of Part 6 or Part 5.

Finally, he submits that the absence of a safeguard preventing the examination of secondary data under Part 6 Chapter 1 which was referable to an individual in the British Islands was also a deficiency which resulted in Part 6 Chapter 1 failing to provide adequate safeguards. There was no objective and reasonable basis for the differentiation between content (where the safeguard applied) and secondary data (where it did not). The same applied to the differential treatment of protected data in relation to Part 6 Chapter 3. Content could not be examined if it is referable to a person in the British Islands but equipment data could. Such data could often include items such as a private diary or photographs stored on equipment (but not transmitted) and so accessible by a bulk equipment interference warrant. Similar criticisms were made of Part 5.

Sir James Eadie KC, with Mr Facenna KC, Mr Milford KC, Mr Armitage, Mr Bethell and Ms Kelleher for the respondents, submits that the Grand Chamber in Big Brother Watch had accepted that bulk interception powers fell within a state’s margin of discretion. In order to determine if the legislation was in accordance with law, it was necessary to consider the totality of the safeguards. Further, as a general matter, Big Brother Watch concerned RIPA not the Act, which had different provisions and different, and strengthened, safeguards. It was not possible to read the observations of the Grand Chamber in the context of RIPA as being transferrable, or applicable, to the different Parts of the Act. Nor was it appropriate to treat the observations of the Grand Chamber made in the context, as it said, of “bulk interception powers” as applicable to other types of powers under different Chapters of Part 6, or different Parts of the Act.

In relation to bulk interception warrants in Chapter 1 of Part 6, Sir James submits that they were foreign focussed, concerning overseas communications. They had to be used in the interests of national security. Only heads of security intelligence agencies could apply. The Secretary of State must personally grant them. He or she had to be satisfied they were necessary and proportionate. Further, they had to specify the specific operational purposes for which the material could be examined. In addition, and significantly, there had to be prior approval by a Judicial Commissioner who had to be satisfied that the examination of material was necessary and proportionate for each specified operational purpose. It was possible through the use of specified operational purposes to control the data that would be examined. Further, if the Judicial Commissioner was not satisfied, he could call for further information. Strong selectors would now require prior internal authorisation (as explained in the written ministerial statement). There were oversight arrangements and remedies before the IPT. In totality, therefore, the safeguards were sufficient to ensure that there was no risk of abuse. The legislation was in accordance with law.

So far as the other Chapters of Part 6 are concerned, Sir James submits that it is not possible to read across from the observations made in the context of bulk interception powers and to conclude that the safeguards referred to by the Grand Chamber for bulk interception powers applied to other powers. The same regime governing the assessment of the necessity of a warrant for the stated grounds applied. The Secretary of State and the Judicial Commissioner had to determine whether the examination of the relevant data was necessary for each specified operational purpose. The requirement that there be prior internal authorisation of the use of strong selectors could not be read across to other powers. In relation to Part 6 Chapter 2, the use of search terms against a set of communications data was not the equivalent to the use of strong selectors in relation to the content of individuals’ communications which are being transmitted. Part 6 Chapter 3 was different as it was aimed at stored information, not the continuing transmission of communications, where the practicability of applying a requirement of prior internal authorisation of each search term was more difficult.

Further, Sir James submits that the fact that there was no British Islands safeguard in relation to secondary data or protected material in Part 6 Chapters 1 and 3 did not give rise to any incompatibility. The Grand Chamber accepted in Big Brother Watch that the fact that the British Islands safeguard applied differently as concerned content and communications data did not give rise to any deficiency.

Sir James submits that the powers governing targeted equipment interference warrants in Part 5 were different in kind from bulk interception powers and the totality of safeguards applied in relation to those powers was sufficient to ensure compliance with Articles 8 and 10 of the Convention.

By way of preliminary observation, the context in which the judgment in Big Brother Watch was given concerned the bulk interception of cross-border communications by the intelligence services. The Grand Chamber recognised that the threats faced by states and their citizens had increased. These threats included global terrorism, drugs trafficking, human trafficking and child exploitation. Many of the threats came from international networks of persons and organisations with access to increasingly sophisticated technology. The Grand Chamber considered that the decision to use a bulk interception regime to identify threats to national security or against national interests was one which fell within the range of choices open to a state (paragraphs 322 to 323 and 340). The Grand Chamber accepted that the bulk interception of communications was “of vital importance to Contracting States in identifying threats to national security” (paragraph 424).

The use of such bulk interception powers could involve interference with the rights guaranteed by Article 8 and Article 10 and, in order to be justified, had to be in accordance with (or prescribed by) law. They had to have a basis in domestic law, and be foreseeable and accessible. In addition, and significantly, there had to be adequate and effective safeguards against the risk of abuse. In that context, the Grand Chamber recognised that the degree of interference with the rights guaranteed by Article 8 (or 10) would vary at different stages of the process. It was also aware that the bulk interception regimes did not all follow the same process or follow the same order. It identified the general approach to be taken to such issues. Then, when assessing the regime provided for by section 8(4) of RIPA, it considered the totality of the safeguards applied, and considered that, “viewed as a whole” the section 8(4) regime, despite its safeguards, “did not contain sufficient end-to-end safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse” (paragraph 425). In that context, it had identified certain fundamental weaknesses and considered that the safeguards applying to the section 8(4) RIPA regime “were not sufficient to counterbalance the shortcomings highlighted” (paragraph 425).

In that regard, the task for this Court is to consider the different regimes governing the different powers available under different Parts and Chapters of the Act. The Court will need to consider the degree of intrusion represented by the exercise of those powers, given the nature of the information to which they apply, and the stages of the process of surveillance. Against that background, the Court will need to assess the totality of the safeguards provided in relation to each set of powers, whether contained in the Act itself or in the relevant Code of Practice, to determine whether, viewed as a whole, the safeguards provided do adequately guard against the risk of abuse and whether they otherwise meet the requirements of having a basis in domestic law and are foreseeable and accessible or whether the absence of a particular safeguard or safeguards prevents that from being so.

It is also important to bear in mind the following. First, the provisions of the Act are different from those considered by the Grand Chamber in Big Brother Watch. Secondly, the judgment of the Grand Chamber needs to be read as a whole and in context. Care must be taken not to take statements within it out of context. Thirdly, domestic courts should be careful not to expand the scope of Convention rights unless they are fully confident that the European Court would reach the same conclusion on the interpretation and application of a Convention right.

This Court is concerned with ensuring that the obligations imposed by the HRA are respected. When questions arise in connection with Convention rights, as they do in this case, section 2(1) of the HRA requires domestic courts to take into account relevant judgments of the European Court of Human Rights. As the Supreme Court made clear in R (AB) v Secretary of State for Justice [2022] AC 487 at paragraphs 54 to 59, Parliament’s purpose in enacting the HRA was to ensure that there is correspondence between the rights enforced domestically and those available before the European Court, not to provide for rights which are more generous than those available before the European Court. In determining therefore whether the provisions of primary legislation can be interpreted in a way that is compatible with a Convention right or, if that is not possible, whether there should be a declaration that a provision of the Act is incompatible with a Convention right (sections 3 and 4 HRA), this court should be careful not to expand the scope of Convention rights as the Supreme Court said in R (AB) “further than [we] can be fully confident that the European Court would go”.

Against that background, we consider each set of powers in turn applying the eight criteria identified in Big Brother Watch. We deal first with bulk interception warrants in Chapter 1 of Part 6. First, the grounds upon which a bulk interception warrant may be issued are adequately set out in section 138 of the Act. They may only be used in in the interests of national security (either alone or together with the prevention of detection or crime or the economic well-being of the United Kingdom so far as relevant to national security). Secondly, the circumstances in which communications may be intercepted appear clearly from section 136 of the Act. A warrant may only be issued if the main purpose is the interception of overseas-related communications and secondary data. When conducting bulk interception, the authorities must use their knowledge of the way international communications work to identify those individual communication links that are most likely to contain overseas-related material (see the Code of Practice for the Interception of Communications (“the Interception Code”)).

It is convenient to take the procedure for granting a warrant and the procedure for selecting, examining and using material (the third and fourth matters) together. The Interception Code prescribes the material to be included in the application for a warrant. That will include the background to the application, a description of the communications to be intercepted, a description of the conduct to be authorised, the operational purposes for which communications and secondary data may be selected and examined, consideration of whether the material may be made available to overseas authorities, a consideration of why the conduct to be authorised by the warrant is considered proportionate and why it could not be achieved by less obtrusive means and certain assurances. That material will, therefore, be available to the decision-makers. The decision must be made personally by the Secretary of State and the application for a warrant must be made by or on behalf of a head of an intelligence service.

The Secretary of State must be satisfied that the main purpose is to intercept overseas-related communications or to obtain secondary data from such communications and that the warrant is necessary in the interests of national security (together with one or both of the other two grounds if applicable). The warrant must set out the specified operational purposes for which material may be examined. The heads of the intelligence services must maintain a list of the operational purposes for which material may be examined. That list is subject to approval by the Secretary of State and the list is subject to review by the Prime Minister and provided to the Intelligence and Security Committee of Parliament. These were regarded as important safeguards by the Divisional Court (paragraph 167 of the Convention Judgment). The operational purposes specified in the warrant must contain sufficient detail to satisfy the Secretary of State that intercepted content or secondary data may only be selected for examination for specific reasons (paragraph 6.62 of the Interception Code).

The need for the warrant to specify the operational purposes for which material may be examined will act as a significant constraint upon the use of search terms. The Secretary of State when issuing the warrant must be satisfied that each of the specified purposes is or may be a purpose for which the examination of material is necessary.

Further, the issuing of the warrant is subject to prior independent authorisation. The decision must be approved by a Judicial Commissioner who is a person who holds or has held high judicial office. The Judicial Commissioner must review the necessity for the warrant and whether the conduct authorised by the warrant would be appropriate. In addition, the Judicial Commissioner must consider when deciding whether to approve the decision to issue a warrant that each of the specified operational purposes is necessary and that “the examination of intercepted content and secondary data for each such purpose is necessary” (section 140(2) of the Act). The Judicial Commissioner is also required by the Act to have regard to whether what is sought to be achieved “could reasonably be achieved by less intrusive means” (section 2(2)(a) of the Act). The Judicial Commissioner will have all the information that the Interception Code prescribes be provided in the application for the warrant. The Judicial Commissioner may also seek further information and clarification and there is an obligation on others to provide such documents as the Judicial Commissioner may need (paragraph 6.29 of the Code and section 235 of the Act).

Furthermore, material cannot be selected for examination of intercepted content by the use of criteria referable to an individual known to be in the British Islands (section 152(4)). In addition, there is to be provision for prior internal authorisation of search terms linked to an identifiable individual (see the written ministerial statement).

We deal with the remaining three criteria briefly. There are provisions providing safeguards in relation to the storage and use of data (sections 150 and 152 described above). There are further provisions governing copying, storage and destruction in the Interception Code. A warrant lasts for six months (section 162). There are safeguards in relation to the disclosure of material to overseas authorities (section 151 of the Act). There are provisions for oversight and applications to the IPT.

The appellant submits that these provisions omit certain key safeguards. It relies on observations made by the Grand Chamber in Big Brother Watch in relation to RIPA and, in particular, the comments on the need for identification of the categories or types of search terms and the fact that the certificate issued under section 8(4) of RIPA was expressed in general terms and was insufficiently precise to provide any meaningful restriction (paragraph 387 of the judgment in Big Brother Watch). However, the position in relation to the Act is different. There is provision governing the selection of material for examination. This is done at the stage of deciding to issue, or approve, the warrant. Both the grounds for issuing the warrant, and the restrictions for which material be selected for examination are dealt with at that stage. The fact that both matters are considered prior to issue is not, of itself, a deficiency. The Grand Chamber noted that bulk interception regimes may not all follow the same model and the different stages may not be discrete (paragraph 325 of its judgment).

We are satisfied that the need to specify operational purposes, the provision of information, and the obligation on both the Secretary of State and, in particular the obligation on the Judicial Commissioner to consider that each of the specified operational purposes is necessary and that the examination of data is necessary for each such purpose, does ensure a degree of control over the range of material that may be selected for examination. We are satisfied that, overall, the safeguards put in place do meet the underlying aims identified in the Big Brother Watch judgment in this regard, namely to ensure that there is adequate identification and control over the types or categories of selectors to be used. The safeguards in place, together with the need for prior independent authorisation and the duties on the Judicial Commissioner to consider necessity, proportionality and the question of whether the aims could be achieved by less intrusive means, fulfil essentially the same aim in this context. Furthermore, it is not for this court to determine which arrangements would be preferable.

The appellant also identifies a difference in relation to secondary data. That may be examined by using criteria referable to an individual who is in the British Islands (the content of communications cannot be examined by reference to such criteria). Secondary data includes identifying data (which is data which may, amongst other things identify a person using a system or service) and systems data (which means data enabling or facilitating the functioning of a system) (section 263 of the Act). The appellant gives individual examples of systems data (part of secondary data) which might, it submits, give information such as the websites the person was browsing which might give a picture of some of the activities of the person. As the Divisional Court held at paragraphs 172 to 178 of the Convention Judgment, as a general rule the examination of the most sensitive content raises greater privacy concerns than the examination of secondary data. The position in relation to the selection of secondary data for examination in relation to persons in the British Islands was not such as to lead to the conclusion that the legislative scheme established in relation to Part 6 Chapter 1 was incompatible with Convention rights. We agree.

In conclusion, therefore, we are satisfied that the totality of the safeguards in the legislation as amended and the Interception Code, do contain adequate and effective safeguards at each stage of the bulk interception process to guard against arbitrariness and abuse. The process from application for a warrant, approval of the issuing of the warrant and of the conduct specified, the controls over the examination of material, the arrangements for storage and use, together with a system of supervision and applications to the IPT, as described above do ensure adequate safeguards. They are based in domestic law, are accessible and foreseeable. The interference is therefore in accordance with law for the purposes of Article 8 of the Convention.

Next we consider the power to issue bulk acquisition warrants. Such warrants authorise the operators to obtain and disclose any communications data. Communications data means entity data or events data. Entity data is data about a person and a thing, and any association between that person or thing and a telecommunications service. Events data means any data which describes an event (section 261 of the Act). In other words, these warrants do not authorise the interception of the content of communications. Rather they relate to facts relating to a communication, that is to matters such as “the who, when, where and how of a communication but not the content, i.e., what was said or written” (paragraph 2.8 of the Bulk Acquisition of Data Code of Practice (the “Bulk Communications Data Code”).

The Grand Chamber recognised that such data could reveal personal information such as the identities and geographic location of the sender of communications and the equipment through which the communication was sent. Further, such intrusion may be magnified if obtained in bulk as they can be analysed so as to form a picture of a person (paragraph 342 of Big Brother Watch). However, it is right to note, as the Divisional Court did at paragraphs 172 to 178 of the Convention Judgment, that as a general rule the examination of the most sensitive content raises greater privacy concerns than the examination of secondary data. Furthermore, whilst the safeguards relating to the interception, retention and searching of communications will need to be considered by reference to the same safeguards applicable to the interception of content, the safeguards do not have to be identical (paragraph 416 of Big Brother Watch).

Against that background, the grounds upon, and the circumstances in which, a bulk acquisition warrant may be issued are adequately set out in section 158 of the Act. They may only be used in the interests of national security (either alone or together with the prevention or detection of serious crime or the economic well-being of the United Kingdom so far as relevant to national security). A warrant may only be issued to obtain communications data (that is, entity and events data as defined in section 263) for one of those purposes.

Paragraph 4.5 of the Bulk Communications Data Code prescribes the material to be included in the application for a warrant. That will include the background to the application, a description of the communications data to be acquired, a description of the conduct to be authorised, an explanation of why the acquisition of communications data in bulk is considered to be necessary for one of the statutory grounds which must always include an explanation of why it is necessary in the interests of national security, the operational purposes for which communications data may be selected for examination, consideration of whether the material may be made available to overseas authorities, an explanation of why the conduct to be authorised by the warrant is considered proportionate and why it could not be achieved by less obtrusive means and certain assurances. That material will, therefore, be available to the decision-makers.

The warrant must specify the operational purposes for which any communications data acquired under the warrant may be selected for examination (section 161 of the Act).

The Secretary of State when issuing the warrant must be satisfied that the warrant is necessary and the conduct which is sought to be authorised is proportionate. Furthermore, the Secretary of State must be satisfied each specified operational purpose is a purpose for which examination of communications data is or may be necessary and that the examination of communications data is necessary for each of the specified purposes (section 158). Decisions must be taken personally by the Secretary of State and the application made by or on behalf of a head of an intelligence service.

Further, the issuing of the warrant is subject to prior independent authorisation. A Judicial Commissioner must review the necessity for the warrant and whether the conduct authorised by the warrant would be proportionate. The Judicial Commissioner must consider whether each of the specified operational purposes is necessary and that “the examination of intercepted content and secondary data for each such purpose is necessary” (section 159 of the Act). The Judicial Commissioner is also required by the Act to have regard to whether what is sought to be achieved “could reasonably be achieved by less intrusive means” (section 2(2)(a) of the Act). The Judicial Commissioner will have all the information that the Interception Code prescribes should be included in the application for the warrant. The Judicial Commissioner may also seek further information and clarification and there is an obligation on others to provide such documents as the Judicial Commissioner may need (paragraph 4.15 of the Bulk Communications Data Code and section 235 of the Act).

There are safeguards in relation to the storage and examination of communications data (section 171 and section 9 of the Bulk Communications Data Code). Communications data may only be examined if necessary for a specified operational purpose and if proportionate (section 172 and paragraphs 6.12 to 6.15) Further, specific consideration must be given as to whether a higher degree of protection is required in relation to the acquisition of communications data by reason of the particular sensitivity of such information (section 2 of the Act and paragraphs 6.19 to 6.23 of the Bulk Communications Data Code). There are safeguards in relation to the disclosure of material to overseas authorities: see section 171 and sections 9.10 to 9.12 of the Bulk Communications Data Code). A warrant lasts for six months (section 162). There are provisions for oversight and appeal.

The totality of the safeguards governing bulk acquisition of communications data need to be viewed as a whole. We are satisfied that they do contain adequate and effective safeguards at each stage to guard against arbitrariness and abuse in relation to the level of intrusion represented by the acquisition of such communications data. The process from application for a warrant, approval of the issuing of the warrant and of the conduct specified, for the examination of material, for storage and use, together with a system of supervision and applications to the IPT, described above do ensure adequate safeguards.

The appellant seeks to rely on observations made by the Grand Chamber in Big Brother Watch in relation to RIPA and, in particular, the comments on the need for identification of the categories or types of search terms, the need for prior internal authorisation of strong selectors, or search terms, linked to identifiable individuals and the fact that the certificate issued under section 8(4) of RIPA was expressed in general terms and was insufficiently precise to provide any meaningful restriction (paragraph 387 of the judgment in Big Brother Watch). However, the position in relation to the Act is different and, further, Chapter 2 of Part 6 deals with communications data, not interception and examination of content, and the Grand Chamber recognises that the relevant safeguards do not need to be identical in every respect to those applicable to the interception of content. The need to specify the operational purposes, and the need for the Secretary of State, and the Judicial Commissioner to consider that each specified operational purpose is necessary and that the examination of communications data is necessary for those specified operational purposes will act as a constraint upon the examination of such material and does ensure an adequate degree of control over the range of communications data that may be selected for examination. The need for the examination of communications data to be necessary is emphasised again by the Bulk Communications Data Code. There is no provision for prior internal authorisation of strong selectors but the context here is the examination of communications data not content. Furthermore, the duty in section 2, and the provisions of the Bulk Communications Data Code, emphasise the need to consider whether the level of protection to be applied is higher because of the particular sensitivity of the information involved. In all the circumstances, we are satisfied that the totality of the safeguards applicable in relation to the bulk acquisition of communications data is sufficient to guard against the risk of arbitrariness and abuse. They are based in domestic law, are accessible and foreseeable. The interference is therefore in accordance with law for the purposes of Article 8 of the Convention.

Bulk equipment interference warrants authorise the interference with any equipment for the purpose of obtaining communications or equipment data or other information and the selection for examination of material in any manner described in the warrant (section 176).

The grounds upon which such a warrant can be obtained are set out in section 178, namely that the warrant is necessary in the interests of national security (or on that ground and for the purpose of preventing or detecting serious crime or in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to national security). The circumstances in which a warrant may be granted appear clearly from section 178 of the Act. A warrant may only be issued if the main purpose is to obtain overseas-related communications, information or equipment data. Decisions must be taken personally by the Secretary of State and the application made by or on behalf of a head of an intelligence service.

The process for obtaining such a warrant and the safeguards can be taken together. Paragraph 6.13 of the Equipment Interference Code (“the Equipment Code”) prescribes the material to be included in the application for such a warrant. That will include the background to the application, a description of the equipment to be interfered with and the communications, equipment data and other information to be obtained, a description of the conduct to be authorised, an assessment of the consequences of the conduct, an explanation of why the conduct is considered to be necessary for one of the statutory grounds which must always include an explanation of why it is necessary in the interests of national security, the operational purposes for which communications data may be selected for examination, consideration of whether the material may be made available to overseas authorities, an explanation of why the conduct to be authorised by the warrant is considered proportionate and why it could not be achieved by less obtrusive means and certain assurances. That material will, therefore, be available to the decision-makers.

The Secretary of State must be satisfied that the main purpose is to obtain overseas-related communications, information or equipment data and that the warrant is necessary in the interests of national security, either alone or together with one or both of the other two grounds if applicable (section 178). The Secretary of State must consider whether the conduct authorised by the warrant is proportionate to what is sought to be achieved (section 178). That will include consideration of whether what is sought to be achieved could be achieved by less intrusive means (section 2(2)(a)). As the Equipment Code makes clear, that also includes consideration of whether the Secretary of State can foresee the extent of all the interferences to a sufficient degree properly and fully to assess the necessity and proportionality of issuing the warrant. That includes consideration of interferences in relation to all those affected, whether the intended target of the interference or those affected more accidentally. Where that can be considered, usually due to the specific identity of the target being known, or where a specific identifier relating to the target’s communications or devices can be used, a bulk equipment warrant is not appropriate (and an equipment interference warrant under Part 5 should be used instead) (paragraph 6.5 of the Equipment Code).

The bulk equipment interference warrant that provides for selection for examination must set out the specified operational purposes for which material may be examined and the application will explain why examination is considered necessary for those operational purposes. The need for the warrant to specify the operational purposes for which material may be examined will act as a significant constraint upon the use of search terms. The Secretary of State when issuing the warrant must be satisfied that each of the specified purposes is a purpose for which the examination of material is necessary.

Further, the issuing of the warrant is subject to prior independent authorisation by a Judicial Commissioner who must review the necessity for the warrant and whether the conduct authorised by the warrant would be appropriate. In addition, that process includes prior independent authorisation of the specified operational purposes for which intercepted communications and secondary data may be selected for examination. The Judicial Commissioner must consider when deciding whether to approve the decision to issue a warrant that each of the specified operational purposes is necessary and that “the examination of intercepted content and secondary data for each such purpose is necessary” (section 179). The Judicial Commissioner is also required by the Act to have regard to whether what is sought to be achieved “could reasonably be achieved by less intrusive means” (section 2(2)(a) of the Act). The Equipment Code makes it clear that the Judicial Commissioner must consider the necessity and proportionality of the warrant, including whether a targeted equipment interference warrant under Part 5 should be used rather than a bulk equipment interference warrant because the specific identity of the target is known or a specific identifier related to the target individuals’ communications or devices can be used (paragraph 6.5 of the Equipment Code). The Judicial Commissioner may also seek further information and clarification and there is an obligation on others to provide such documents as the Judicial Commissioner may need (paragraph 6.29 of the Code and section 235 of the Act).

There are further safeguards on the use of the material obtained. Communications cannot be selected for examination of intercepted content by the use of criteria referable to an individual known to be in the British Islands (section 193(4) and the definition of protected material at 193(9)). There are safeguards in relation to the storage and use of material obtained under the warrant (sections 191 and 192). There are further provisions governing copying, storage and destruction in section 9 of the Equipment Code. A warrant lasts for six months (section 184). There are safeguards in relation to the disclosure of material to overseas authorities (section 192 and paragraphs 9.22 to 9.26 of the Equipment Code). There are provisions for oversight and applications to the IPT.

The appellant seeks to rely on observations made by the Grand Chamber in Big Brother Watch in relation to RIPA and, in particular, the comments on the need for identification of the categories or types of search terms, the need for prior internal authorisation of strong selectors, or search terms, linked to identifiable individuals and the fact that the certificate issued under section 8(4) of RIPA was expressed in general terms and was insufficiently precise to provide any meaningful restriction (paragraph 387 of the judgment in Big Brother Watch).

The provisions in the Act and the Equipment Code provide a different, strengthened means of ensuring that there are adequate safeguards in relation to bulk equipment interference warrants. There is a need for prior independent authorisation of the warrant. The warrant must specify the operational purposes and the Secretary of State and the Judicial Commissioner must consider whether the examination of material is necessary for those operational purposes. Furthermore, in the context of this statutory regime, we do consider that the fact that the Secretary of State and the Judicial Commissioner will have to consider the nature of the interference authorised by the warrant, and whether less intrusive means (such as a targeted equipment interference warrant) would be sufficient, is significant. That will particularly apply where the specific identity of the target is known, or the warrant relates to a specific identifier related to the targeted individuals’ communications devices. The arrangements for authorisation and, importantly, prior independent authorisation, build in a need for consideration of whether the application for a bulk equipment interference warrant is concerned with known specific targeted individuals or their communication devices and, if so, whether it is appropriate to use a targeted equipment interference warrant instead. That safeguard will, therefore, provide for consideration of whether it would be more appropriate to issue a targeted equipment interference warrant which will be limited to those individuals rather than granting a bulk equipment interference warrant which would permit a wider interference in respect of those who are not the targets of the surveillance but might be affected incidentally. Further, the use of criteria for selecting communications for examination which are referable to an individual within the British Islands is not permitted. The fact that there is a difference in relation to secondary data, which may be examined using criteria referable to an individual within the British Islands does not render the scheme as a whole incompatible. As a general rule, as the Divisional Court observed, at paragraphs 172 to 178 of the Convention Judgment, the examination of content (rather than secondary data) raises greater privacy concerns. Those safeguards ensure a considerable degree of control over the circumstances in which the communications of an identifiable person can be selected for examination.

The appellant submits that the safeguards do not provide for the specification of categories or types of search terms or the prior internal authorisation of search terms linked to an identifiable individual and differ from the safeguards applied in relation to bulk interception warrants. We are satisfied that, overall, the safeguards put in place do meet the underlying aims identified in the Big Brother Watch judgment in this regard. The safeguards in place, together with the need for prior independent authorisation and the duties on the Judicial Commissioner to consider necessity, proportionality and the question of whether the aims could be achieved by less intrusive means, fulfil essentially the same aim in this context. Furthermore, it is not for this court to determine which arrangements would be preferable and to consider whether the regime used for bulk interception warrants should also be used for bulk equipment interference warrants.

The issue for this court is whether viewed in totality, the safeguards governing bulk equipment interference warrants are in accordance with law and contain adequate and effective safeguards against the risk of abuse and arbitrariness. We are satisfied that the safeguards are based in domestic law, and are accessible and foreseeable. We are also satisfied that the safeguards are sufficient. At the very least, given that the position under the Act is very different from RIPA, and given in particular the significantly strengthened safeguards governing Chapter 3 of Part 6 of the Act, we doubt that a domestic court could be fully confident that the absence of particular features referred to in Big Brother Watch (notably the absence of a requirement for prior internal authorisation for search terms linked to identifiable individuals) was such a deficiency as to mean that the regime was not in accordance with, or prescribed by, law for the purposes of Articles 8 and 10 of the Convention.

Part 5 of the Act deals with targeted equipment interference warrants. Such warrants authorise a person to obtain communications, equipment data and other information. The subject matter of such warrants is set out in section 101(1) of the Act. They may relate, essentially, to equipment of a particular person or organisation, or of a group of persons who share a common purpose or carry on a particular activity, or equipment in one location, or equipment of more than one person or one group or in one location where the interference is for a single investigation or operation. Section 115 of the Act provides that the warrant must include specific details. Where, for example, the warrant relates to equipment belonging to, used by or in the possession of a particular person or organisation, that person or organisation must be named (or a description of the organisation given). Similarly, where the equipment belongs to, or is used by or is in the possession of persons who form a group which shares a common purpose or activity, the warrant must include a description of the activity and the name, or a description of, as many of the persons as it is reasonably practicable to name or describe. Where a warrant relates to equipment where the interference is for a single investigation or operation, the warrant must include a description of the nature of the investigation or operation and the name, or a description of, as many of the persons or organisations as it is reasonably practicable to name or describe. Where the equipment is in a particular location, that location must be named in the warrant.

The grounds upon which a targeted equipment interference warrant may be sought are set out at section 102 of the Act (and s 106(3) in relation to the purpose of preventing death or injury or damage to a person’s mental or physical health). It must be necessary in the interests of national security, for the purpose of preventing or detecting serious crime or in the interests of the economic well-being of the United Kingdom so far as that is relevant to the interests of national security. The circumstances in which a person’s equipment may be the subject of such a warrant appears sufficiently from section 101 of the Act as described in the previous paragraph.

The Equipment Code prescribes the material which must be included within an application for a targeted equipment interference warrant (paragraph 5.34). That reflects the details that must be included in the warrant by reason of section 115 as discussed above. That information will provide considerable detail about the names of persons or organisations to be the subject of the warrant, or the location of equipment, or the description of the investigation or operation (and a name or description of as many of the persons or organisations as it is reasonably practicable to describe).

The Secretary of State must consider that the warrant is necessary for the grounds for which such a warrant is sought and that the conduct authorised is proportionate. The issuing of a warrant is subject to prior approval by a Judicial Commissioner who must be satisfied that the warrant is necessary and that the conduct authorised is proportionate. The Judicial Commissioner will need to comply with the general duties under section 2 of the Act. There are safeguards in relation to storage and disclosure of material (section 129 and paragraphs 9.27 to 9.32 of the Equipment Code). There are safeguards in relation to the disclosure of information to overseas agencies (section 130 and paragraphs 9.22 to 9.26 of the Equipment Code). Warrants last for 6 months. There are provisions for oversight and applications to the IPT.

We are satisfied that the regime governing targeted equipment interference warrants is in accordance with law. The regime is based on domestic law, is accessible and foreseeable. Viewed in totality, the statutory regime provides adequate and effective safeguards against the risk of abuse or arbitrariness. The application for the warrant will provide detailed information about the names and organisations to be subject to the warrant and those details must be included in the warrant itself. There is prior independent authorisation by a Judicial Commissioner of the warrant. The Judicial Commissioner will be provided with the information on the names of persons or organisations, or the details of the single investigation or operation, and can ask for further information or clarification. The Judicial Commissioner will consider if the warrant is necessary for the statutory grounds and also if the conduct authorised is proportionate. The Judicial Commissioner will, therefore, have decided to authorise conduct involving the obtaining of communications, equipment data and other information from named individuals or organisations that are named or described. The examination of material referable to individuals will, therefore, have been the subject of prior independent authorisation. We have no doubt that the safeguards provide adequate and effective guarantee against the risk of abuse or arbitrariness in the use of targeted equipment interference warrants.

The appellant relies on the absence of any need to specify categories or types of search terms at the point of authorisation or prior internal authorisation of search terms referable to identifiable individuals, as referred to by the Grand Chamber in Big Brother Watch. That submission, however, fails to have regard to the fact that the type of bulk interception powers that the Grand Chamber were dealing with were very different from the kind of targeted equipment interference powers in issue in relation to Part 5 of the Act. Further, the legal regime now in place is very different from that applicable under RIPA. There is prior independent authorisation of the warrant and that involves consideration of the necessity for and proportionality of the warrant. That decision will be taken by the Judicial Commissioner on the basis of the information required to be supplied in the application, and included in the warrant, which includes the names of persons and the names or descriptions of persons to whom the warrant relates. When material is selected for examination, the identity of the persons affected and who will suffer interference will have been considered and approved by the Judicial Commissioner. We do not consider that the description of some of these warrants as thematic assists the legal analysis. We do not see any basis for considering that the regime for Part 5 targeted equipment warrants is deficient.

The submissions on this issue were made by Mr Jaffey and Mr Jude Bunting KC for the Intervener. First it is submitted that the provisions of the amended Chapter 1 of Part 6 did not meet the requirements of Big Brother Watch. The provisions which provide for prior independent authorisation of selection of journalistic material did not apply where it was known that selectors were connected to a journalist or where it was likely that confidential journalistic material would be selected for examination, only where that was intended or highly probable, contrary to paragraphs 525 to 528 of Big Brother Watch. There was no express requirement set out in the legislation itself that there be an overriding requirement in the public interest.

Secondly, it is submitted that the definitions of journalistic material and confidential journalistic material in the Act would cut back the protections afforded to confidential journalistic material in a way that was incompatible with Articles 8 and 10. The definition of “journalistic material” in section 264(2) was limited to material created or acquired for journalism. The exclusion of material created with the intention of furthering a criminal purpose meant that material that was obtained from a source who provided it to a journalist would not be protected.

Thirdly, it is submitted that the Secretary of State was wrong not to accept that the remedial arrangements made for bulk interception warrants in Chapter 1 of Part 6 also need to be applied to Parts 3, 4, 5, and Chapters 2 and 3 of Part 6. Mr Jaffey submits that, if any of these powers could lead to the identification of a journalist’s source, it could lead to the consideration of the same material as might be obtained under a bulk interception warrant. The fact that the material was obtained by a different method of surveillance did not justify the absence of such safeguards. Mr Bunting took the Court through a series of European Court, and domestic cases. He submits that the underlying principle in the case law was the Court should concentrate on the effect of what was done. If the effect of the exercise of any of the powers was to result in information being obtained which was likely to disclose a journalist’s source, the principles identified by the case law, up to and including the Grand Chamber in Big Brother Watch, applied.

Sir James Eadie for the respondents submits that on a proper reading of the judgment in Big Brother Watch the concern identified by the Grand Chamber was that, in the context of bulk interception warrants, material might be obtained which was known to be connected to a journalist. That would occur if it was intended to obtain such material or it was highly probable that that would be the result. That needed to be the subject of prior independent authorisation.

Sir James Eadie submits that the requirement that there be an overriding requirement in the public interest was not a free-standing, separate legal obligation which had to be written into the statutory scheme. Rather that reflects the importance accorded to the protection of journalistic material in the context of press freedom and that has to be considered when assessing whether any interference is necessary and proportionate. Further, the definitions relating to journalistic material do not improperly restrict the protection of journalistic sources or confidential material. Not all material in the possession of a journalist is required to be accorded protection. Material in the possession of a journalist but not acquired for a journalistic purpose does not merit additional protection simply because it might be used at some stage in the future for some journalistic purpose. Similarly, the exclusion of material that is created or acquired for a criminal purpose is not inconsistent with Article 10. Further, properly interpreted, a journalist’s source did not lose protection if that source had acquired the information unlawfully.

Finally, Sir James submits that the requirements in relation to bulk interception powers could not be applied, or read across, to other types of surveillance powers. Those powers operate in a different way and involve different levels of intrusion. He submits that it may be necessary to have evidence as to how bulk equipment interference warrants operate to assess whether they are comparable to other types of warrants. In relation to the retention and acquisition of data under Parts 3 and 4, or bulk acquisition warrants in Chapter 2 of Part 6, there is nothing in Big Brother Watch to suggest that there had to be prior independent authorisation of the acquisition of communications data. The regime governing Part 5 is a different legal regime, with different powers and adequate and effective safeguards. Similarly, the regime in Chapter 3 of Part 6 operates differently from that in relation to bulk interception powers.

We are satisfied that the amended section 154 of the Act will satisfy the requirements of Article 10.

Sections 154(1) and (2) provide for prior independent authorisation, by the Investigatory Powers Commissioner, where information obtained under a bulk interception warrant is to be selected for examination where:-

Further, section 154(3) as amended will provide that:

Those provisions will ensure compliance with Article 10 of the Convention. Reading Big Brother Watch as a whole, the concern in relation to bulk interception warrants was to address circumstances where the intention of the intelligence services is to access confidential material, for example, through the deliberate use of a search term connected to a journalist or where as a result of the choice of search terms, there is a high probability that such material will be selected. In those circumstances, there needed to be prior independent authorisation (paragraph 448). The Grand Chamber went on to apply that approach to the facts of that case, as appears at paragraph 456 to 458 of the judgment. That approach is replicated in the amended section 154 of the Act. The reference in paragraph 525 of the judgment to “likely” must be read fairly and in context. The Grand Chamber was assessing the safeguards in the relevant code of practice governing the acquisition of communications data under RIPA and noted that those provisions “only applied where the purpose of the application for the warrant was to determine a source: they did not apply in every case where there was a request for the communications data of a journalist or where such collateral intrusion was “likely”. In paragraph 448, the Grand Chamber was referring to “the deliberate use” of selectors connected to a journalist. The Grand Chamber was not seeking to lay down any general principle, or interpretation of Article 10, which required prior independent authorisation where the request was likely to result in the communications data of a journalist being obtained. It was not seeking to depart from the general approach to this issue described in detail in paragraphs 447 to 450, nor the actual application of that approach to the situation governed by RIPA described at paragraph 456 of the judgment.

Similarly, the requirements of the amended section 154(3) make it clear that the Investigatory Powers Commissioner must consider whether the public interest in obtaining the information outweighs the public interest in the confidentiality of journalistic material or sources. That has to be read, of course, in the light of the general duties in section 2(2) which requires a public authority to have regard to whether the level of protection in relation to particular information is higher because of the particular sensitivity of the information, and gives as examples of that material which identifies or confirms a source of journalistic information.

The amended section 154 also deals with material where the person considers that obtained material contains confidential journalistic material or material identifying or confirming a journalistic source. The person must notify the Investigatory Powers Commissioner who will order the destruction of the material unless satisfied that the public interest outweighs the interest in confidentiality.

Nor are the definitions relating to the protection of journalists such as to reduce inappropriately the protection required. We agree with the Divisional Court that Article 10 of the Convention does not require that any documentation held by a journalist is protected and that the definition in the Act with its reference to material created or acquired for the purposes of journalism is sufficiently broad to ensure the requisite degree of protection under Article 10 (paragraphs 342 to 344 of the Convention judgment). Nor does the exclusion of material created or acquired for the purpose of furthering a criminal purpose undermine the proper scope of the protection afforded to freedom of the press by Article 10 and, like the Divisional Court, we do not consider that exclusion creates any difficulty with the compatibility of the definition, taken as a whole, with Convention rights (paragraph 352 of the Convention judgment).

Finally, we do not consider that that exclusion, contained in section 264(5) of the Act is intended to apply to, or qualify the definition of, a source of journalistic information. Such a source may provide material which he or she has obtained unlawfully to a journalist and the exception would not apply to that material. It is clear from the context of section 264 that it is dealing with material which the journalist has created or acquired with the intention of furthering a criminal purpose. It is not intended to apply to or affect the definition of a source of journalistic information (defined in section 261) who is an individual who acquires information (whether lawfully or unlawfully) and supplies it to a journalist for the purposes of journalism.

For completeness, we should say that we do not accept the submission of Mr Bunting that the case law indicates that the sole question is whether any provision has an effect on journalists. It is not necessary, and would be disproportionate, to lengthen this judgment with an analysis of the domestic case law and the Strasbourg case law on which he relied. Those decisions were fully analysed by the Divisional Court and we agree with its analysis. In short, those cases all involved a very different factual context. The questions in this appeal really depend on the application of the decision in Big Brother Watch in relation to bulk interception warrants and whether the principles identified in that context can be applied to other types of warrants.

Bulk data acquisition warrants under Chapter 2 of Part 6 are concerned with the acquisition of communications data. Such warrants do not authorise the interception and examination of the content of communications. Furthermore, as paragraph 3.1 of the Bulk Communications Data Code recognises, such warrants normally provide for the provision of communications data generated in bulk by a telecommunications operator rather than being targeted at a specific operation. Generally, it is the examination of communications data which might indicate with whom a journalist has been communicating and when, and that, conceivably, may be material that could be used as part of a process of identifying or confirming the identity of a journalist’s source. That is likely, if anything, to be the stage in the process which is capable of giving rise to a more significant interference.

Paragraphs 6.24 to 6.31 of the Bulk Communications Data Code recognise that issues surrounding the infringement of the right to freedom of expression may arise if communications data is selected for examination for the purpose of identifying the communications data of a journalist, an identified source or where it is done for the purpose of identifying or confirming the identity or role of an individual as a journalist’s source. Paragraph 6.25 emphasises the strong public interest in protecting a free press and freedom of expression and where the intention is to select communications data for examination in order to identify a source of journalistic information “the public interest requiring such selection must override any other public interest”. Paragraph 6.28 says that:

There is also a recognition that even if access to communications data obtained in bulk is not intended to identify a journalist’s source, there is a risk that that might occur when examining a journalist’s communications data. Paragraphs 6.30 and 6.31 of the Bulk Communications Data Code, therefore, provide that:

We are satisfied that the arrangements made for the examination of communications data in the exceptional circumstances where it is to be used to identify or confirm a journalist’s identity or source are sufficient to satisfy the requirements of Article 10. They meet the concerns identified by the Grand Chamber in Big Brother Watch in relation to the acquisition of communications data (there, under Chapter 2 of RIPA). We are satisfied that the risk of collateral intrusion is safeguarded against by the obligations imposed by section 2(2)(b) of the Act and the provisions of the Bulk Communications Data Code. We are satisfied that the arrangements relating to the protection of confidential journalistic material provide adequate safeguards.

Bulk equipment interference warrants may be authorised under Chapter 3 of Part 6. There may be cases, however, where communications have been obtained by means of a bulk equipment interference warrant and the intelligence services wish to examine those communications in circumstances which might reveal a journalist’s sources or involve the examination of confidential journalistic information. That is dealt with in paragraphs 9.81 to 9.83 of the Equipment Interference Code. In essence, a senior official must be notified where an authorised person intends to select for examination material obtained under a bulk equipment interference warrant in order to identify or confirm a journalist’s source or which is believed to contain confidential journalistic material. The senior officer must approve the selection of the material before the authorised person can examine it and can only do so if satisfied that there are arrangements in place for handling, retaining, using and destroying such material. Where material is not destroyed after examination, that must be reported to the Investigatory Powers Commissioner. There is no requirement, however, that there be prior independent authorisation of the examination of such material.

The Grand Chamber in Big Brother Watch recognised the importance of the protection of journalists’ sources in the context of Article 10 and guaranteeing freedom of expression. The Grand Chamber referred to the need for review by a judge or other independent and impartial decision-making body with a power to determine whether the public interest overrides the principle of protection of journalistic sources prior to the handing over of such material in order to prevent unnecessary access to information capable of disclosing the identity of a journalist’s sources (see paragraph 445 of its judgment). Section 2 of the Act also recognises the need to have regard to whether the level of protection is higher because of the particular sensitivity of the information, including information identifying a journalist’s source or confidential journalistic material.

The question is, therefore, whether the absence of a requirement under Chapter 3 of Part 6 of prior independent authorisation of the use of criteria for examining communications identifying a journalist’s source or examining confidential journalistic material is compatible with Article 10. Given the unusual way in which this case has proceeded, we have no judgment from the Divisional Court on this issue. Further, the respondents submit that it may be necessary to have evidence as to how bulk equipment interference warrants operate to assess whether they are comparable to other types of warrant and whether the safeguards identified by the Grand Chamber in relation to the protection of journalists’ sources are needed in the context of bulk equipment interference warrants. We bear in mind that we do not have any evidence or information about how equipment interference warrants operate in practice which would enable us to assess these matters. Nor did the Divisional Court have such evidence. In those circumstances, the appropriate course is to remit the question of whether the provisions in Chapter 3 of Part 6 are compatible with Article 10 as they do not include provision for prior independent authorisation of the examination of confidential journalistic material and information capable of identifying a journalist’s sources where that material has been obtained by use of a bulk equipment interference warrant. The respondent can determine whether it wishes to seek to adduce evidence in relation to those matters or whether it wishes to litigate the issue without such evidence.

Parts 3 and 4 of the Act can conveniently be taken together. They concern the giving of a notice requiring retention of communications data and obtaining that data. They are not concerned with obtaining or examining the contents of communications. In the context of protection of confidential journalistic material, a notice given under Part 4 requiring a telecommunications operator to retain communications data is less likely of itself to amount to a significant interference under Article 10 of the Convention.

Section 60A of the Act provides that the Investigatory Powers Commissioner may authorise a person to obtain communications data where that is necessary for a specific investigation or a specific operation and the conduct authorised is proportionate. In addition, the Investigatory Powers Commissioner is obliged to have regard to whether there is a need for higher protection in circumstances involving, amongst other things, information confirming a journalist’s source (section 2(2)(b) of the Act). Those arrangements provide adequate safeguards to protect journalistic sources when an Investigatory Powers Commissioner authorises the obtaining of data. Section 61 provides for a designated senior officer to grant authorisations for the purpose of a specific investigation or specific operation. Section 77 provides that where such an authorisation is granted in relation to obtaining communications data for the purpose of identifying or confirming a journalist’s source, that authorisation cannot take effect until approved by a Judicial Commissioner. The Judicial Commissioner will have to have regard to the public interest in protecting a source of journalistic information and the need for there to be another overriding public interest before a public authority can seek to identify a source of journalistic information (section 77(6)). The Judicial Commissioner is also under the duty imposed by section 2(2)(b) to have regard to the higher level of protection to be applied to sensitive information including information confirming a journalist’s source or confidential journalistic information.

We are satisfied that those provisions will ensure adequate safeguards against the risk of abuse or arbitrariness. Part 3 deals with the obtaining of communications data not content. The legislative regime taken as a whole does provide adequate safeguards against the risk of abuse or arbitrariness in that context. Authorisations may only be granted where necessary for a specific investigation or a specific operation. The need for prior authorisation by an Investigatory Powers Commissioner, and the specific protection requiring the approval of a Judicial Commissioner when a senior designated official authorises the obtaining of communications data for the purpose of identifying or confirming a journalist’s source do provide adequate safeguards in relation to the protection of confidential journalistic material and journalistic sources. The appellant suggests that there may be cases where a senior official grants an authorisation for purposes other than the obtaining information to confirm a journalist’s source but where the communications data obtained might reveal such a source and that situation is not expressly dealt with. We do not consider this to be realistic viewing the legislative regime as a whole. Authorisation is to be granted where necessary for a specific investigation or specific operation and the conduct to be authorised is proportionate. If the investigation or operation involves obtaining communications data to identify or confirm a journalist’s source, that is subject to independent authorisation. The regime as a whole is structured to ensure that there are adequate safeguards against the risk of abuse and are in accordance with, and prescribed by, law of the purposes of Articles 8 and 10.

Targeted equipment interference warrants are related to equipment belonging broadly to, or used by, a particular person or organisation or for a single investigation or operation. In that context, sections 113 and 114 of the Act provide that an application for such a warrant must state if one of the purposes is the obtaining of communications which the applicant believes will contain confidential journalistic material or a source of journalistic material. The Secretary of State may only issue the warrant if, amongst other things, he or she is satisfied that the warrant is necessary and the conduct authorised is proportionate and that there are appropriate safeguards relating to the retention, use and disclosure of such material (sections 102, 113 and 114). The decision to issue a warrant requires prior independent approval by a Judicial Commissioner. We are satisfied that the arrangements relating to the protection of confidential journalistic material and a journalist’s source in the context of a targeted equipment interference warrant are adequate and effective to guard against the risk of abuse or arbitrariness and are in accordance with, and prescribed by, law for the purposes of Articles 8 and 10.

The appellant submits that there is a deficiency as the safeguards only apply where one of the purposes of the warrant is to determine the source of journalistic information and not to other cases where that may occur. We do not consider this to be realistic, viewing the legislative regime as a whole. A warrant may be granted in relation to a particular person group or organisation or for a single investigation. Where that includes accessing communications believed to contain confidential journalistic material or for identifying or confirming a journalist’s source, that must be stated in the application. There will need to be prior independent approval of that as described. The regime as a whole is structured to ensure that there are adequate safeguards against the risk of abuse and are in accordance with, and prescribed by, law of the purposes of Articles 8 and 10.

Mr Jaffey submits that the arrangements governing the transmission of material to overseas authorities must have certain requirements as set out in paragraph 362 of Big Brother Watch. In relation to Parts 5 and 6, however, the relevant provisions of the Act provide that the Secretary of State must make arrangements to such extent if any as the Secretary of State considers appropriate. That would permit the Secretary of State to reduce the protections to nil as a matter of discretion and that is not in accordance with law for the purposes of Articles 8 and 10 of the Convention.

Sir James Eadie submits first that the requirements were identified in Big Brother Watch in connection with the transmission of communications obtained by bulk interception to overseas authorities and could not necessarily be applied to transmission of material obtained under other powers. Secondly, the regime under RIPA was held by the Grand Chamber to be compatible with Article 8 as appears from paragraphs 395 to 399 of its judgment. The regime governing transmission overseas of material obtained under the powers conferred by Parts 5 and 6 were either strengthened or materially equivalent to the position under RIPA. In those circumstances, there was no incompatibility with Articles 8 or 10 of the Convention.

Dealing first with the transmission of material obtained under a bulk interception warrant under Chapter 1 of Part 6, section 151 provides that the Secretary of State “must ensure” that arrangements are in force securing that any material “is handed over to overseas authorities only if” the requirements of subsection (2) are met. That subsection provides so far as material that:

The requirements referred to are those governing disclosure, copying and retention, and examination for specified operational purposes and where necessary and proportionate. Those statutory provisions must be read in the context of the Act as a whole, including section 1(5) which provides that protections for privacy exist by virtue of the Human Rights Act 1998 (which require public authorities to act compatibly with Convention rights).

Paragraphs 9.26 to 9.29 of the Interception Code deal with safeguards relating to disclosure of material obtained pursuant to a bulk interception warrant to overseas authorities. Paragraph 9.27 provides that the appropriate issuing authority “must ensure” that material is only handed over to overseas authorities if requirements relating to the minimisation of the extent to which content or secondary data is disclosed, copied, distributed, retained or examined. Paragraphs 9.28 and 9.29 provide that:

We are satisfied that the arrangements providing for the transmission of material obtained under a bulk interception warrant to overseas authorities are in accordance with or prescribed by law, and contain adequate safeguards against abuse. The statutory framework requires the Secretary of State to ensure that there are arrangements in place relating to disclosure, copying, retention, and examination. The reference to making arrangements to such extent as the Secretary of State considers appropriate has to be read in context. Properly interpreted the power must be used in a way which gives effect to the statutory purpose. The provision is not intended to give the Secretary of State an unfettered discretion as to whether, or what, arrangements are to be made. It is not to be read as giving the Secretary of State power to do whatever he or she thinks appropriate. Rather the purpose of the provision is to require the Secretary of State to ensure that adequate arrangements apply when overseas authorities deal with the material as they do when the material is dealt with by the authorities in the United Kingdom. The requirements must be such as the Secretary of State considers appropriate to achieve that statutory purpose. If there were any doubt about that (which there is not), the Secretary of State is required by section 6 of the HRA, to exercise powers in a way which is compatible with Articles 8 and 10 as recognised by sections 1(5) and 2(4) of the Act. The Secretary of State is, therefore, required by statute to ensure that arrangements are in place which achieve the required protection under the Convention. The Secretary of State could not lawfully consider the arrangements to be appropriate unless they contained adequate arrangements relating to disclosure, copying, retention and examination such as would apply if the material was being dealt with by the authorities in the United Kingdom.

That, again, is reinforced by the provisions of the Interception Code which provides that the issuing authority must ensure that arrangements corresponding to those applicable in the United Kingdom are applied. As paragraph 9.28 recognises, most sharing takes place with overseas authorities with whom the United Kingdom has a long and well-established intelligence sharing relationship and those overseas authorities apply corresponding safeguards. On occasions when that is not the case, the issuing authority will need to consider the arrangements “that should be in place to regulate such disclosure”.

The arrangements are on any analysis materially similar to those considered to provide adequate safeguards by the Grand Chamber in Big Brother Watch. The precautions to be taken when communicating intercept material to overseas authorities are sufficiently clear and afford sufficiently robust guarantees against abuse (see paragraphs 395 to 399).

Similar provisions apply in relation to the transmission to overseas authorities of communications data obtained under a bulk acquisition warrant (section 171(9) and paragraphs 9.10 to 9.12 of the Communications Code) and communications obtained under a bulk equipment interference warrant (section 192 and paragraphs 9.33 to 9.35 of the Equipment Interference Code). Similar provisions apply to targeted equipment interference warrants (section 130 and the material parts of the relevant code). We consider, therefore, that the arrangements under Parts 5 and 6 do provide adequate safeguards against abuse and that those safeguards are in accordance with or prescribed by law as they have a basis in domestic law, are accessible and foreseeable.

Mr Jaffey submits that the provisions governing access to legally privileged communications, that is, essentially, lawyer-client communications, are insufficient to provide adequate safeguards against abuse. In particular, there is no requirement of prior independent authorisation before selectors or search terms identifying legally privileged information were used. He submits that the need for such a requirement can be seen from the case-law dealing with surveillance. The European Court recognised that Article 8 afforded “strengthened protection to exchanges between lawyers and their clients” (paragraph 118 in Michaud v France (2014) 59 EHRR 9). He further relied on observations in Szabo and Vissy v Hungary (2016) 63 EHRR 3, particularly at paragraph 77 indicating that prior authorisation was in general required in surveillance regimes. He also relied on observations made in Kopp v Switzerland (app No 13/1997/7971000) expressing surprise that the task of determining which communications were legally privileged should be left to an official in the Post Office’s legal department.

Sir James Eadie submits that the extent of the safeguards required depends upon the degree of interference with respect for a person’s private life, relying on RE v United Kingdom (2016) 63 EHRR 2. The safeguards in the legislation were adequate and effective and recognised the importance of maintaining the confidentiality of lawyer-client exchanges. The case law does not establish any requirement for independent prior authorisation for examination of privileged material.

We can deal with this ground of appeal relatively shortly as we consider that the appellant has not demonstrated that the assessment of the Divisional Court at paragraphs 271 to 292 in the Convention judgment is wrong. Further, there is nothing in the judgment of the Grand Chamber in Big Brother Watch addressing the question of legally privileged material and no basis for considering that anything said in that judgment undermines the reasoning of the Divisional Court.

First, as the Divisional Court observed at paragraph 271, public authorities (which include the issuing authority, the Judicial Commissioner, and the Investigatory Powers Commissioner) must have regard to “whether the level of protection to be applied in relation to any obtaining of information…is higher because of the particular sensitivity of the information” (section 2(2)(b)). Such particularly sensitive information includes “items subject to legal privilege” (section 2(5)(a)). Thus, as the Divisional Court says, “the need to treat such items as sensitive is a principle which suffuses the entire regime in the …Act”.

Secondly, the Act does have specific protection for legally privileged material. In relation to bulk interception warrants, the significant interference would be the examination of the content of communications containing legally privileged information. Where the purpose of the criteria to be used for selecting intercepted content for examination is to obtain legally privileged material, that must be authorised by a senior official acting on behalf of the Secretary of State. That official must have regard to the public interest in the confidentiality of items subject to legal professional privilege and may only authorise criteria for selecting such material for examination if there are exceptional and compelling circumstances which outweigh the public interest in confidentiality. There are further safeguards if material is examined which is found to contain legally privileged information (whether that was the purpose of the examination or whether that appears on examination of material for other purposes). The Investigatory Powers Commissioner must be notified. He will direct that the item be destroyed unless satisfied that the public interest in retention outweighs the public interest in the confidentiality of material subject to legal privilege, and if retained, may impose conditions on its use (section 153 of the Act). So far as secondary data is concerned, which falls outside content, that last safeguard applies. Similar provisions apply in relation to material obtained pursuant to bulk equipment interference warrants under Chapter 3 of Part 6 (section 194). In addition, the regimes ensure safeguards in relation to storage, copying and disclosure of material as discussed above.

We agree with the Divisional Court that those safeguards are adequate and effective guarantees against the risk of abuse in both Chapters 1 and 3 of Part 6. Further, we do not consider that there has to be prior independent authorisation of the use of criteria for examination of such material. None of the case law establishes that as a requirement. In relation to Szabo, on which the appellant places particular reliance, that case dealt with secret intelligence gathering powers including covert house searches, recording and opening mail, and recording individuals’ electronic communications. It was in that context that the European Court made its general observations in paragraph 77 as to the preferred method of ensuring against the risk of abuse (and even then, did not say that in every case and in every respect, prior independent authorisation was necessary). In relation to Kopp, as the Divisional Court noted, that case concerned a situation where the private and professional telephones of a lawyer and his wife were tapped. There had been prior judicial authorisation which stated that “lawyers’ conversations were not to be taken into account”. It was in that context that the European Court considered the problems with the fact that Swiss law did not state how, under what conditions, and by whom, the distinction between matters connected to a lawyer’s work and other matters was to be assessed. The European Court found it astonishing that, in practice, that task should be left to an official in the Post Office legal department. Consequently, the European Court found that Swiss law did not indicate with sufficient clarity the scope and manner of exercise of the authorities’ discretion and there had been a violation of Article 8 (paragraphs 73 to 75 of Kopp). The decision does not establish that there must be prior independent authorisation of the examination of legally privileged material in all cases.

Dealing with communications data under Chapter 2 of Part 6, as the Divisional Court rightly observed a bulk data acquisition warrant does not authorise the acquisition, examination or disclosure of the content of the communication. Whilst the communications data may reveal “when a communication occurred, between which devices and for how long, it will not reveal what was discussed or the subject matter. It will not touch upon the central purpose of legal privilege, namely to enable a client to disclose what he wishes to disclose in order to obtain legal advice, without the fear of the material being disclosed to others without his consent” (paragraph 291 of the Convention Judgment). The same is true of the retention and acquisition of communications data under Parts 3 and 4 of the Act. The general safeguards already discussed in relation to the powers concerning communications data are therefore adequate to ensure that the interference represented by the acquisition and examination of communications data is guarded against.

So far as targeted equipment interference warrants under Part 5 are concerned, these operate in a very different way. They are aimed at particular individuals, groups or organisations, or a single investigation or operation. We have described above the range of information that must be provided in an application for such a warrant. In addition, the application must state if one of the purposes of the warrant is to obtain items subject to legal privilege. The person issuing the warrant must have regard to the public interest in confidentiality of items subject to privilege, and only authorise the warrant if there are exceptional and compelling circumstances which make it necessary to authorise the equipment interference for that purpose. Arrangements must be in place relating to handling, retention, use and destruction of such items (section 112 of the Act). The safeguards are adequate and effective to guard against the risk of abuse.

For those reasons, we agree with the Divisional Court conclusion in relation to Parts 3, 4, 5 and 6 (we deal with Part 7 below) at paragraph 292 of its Convention Judgment that:

The powers conferred by Part 7 are very different in nature and purpose from those provided under the Parts of the Act considered in this judgment. For that reason, it is appropriate to deal with Part 7 separately and to consider the first five grounds of appeal as they apply to the provisions of Part 7.

Mr Jaffey submits in relation to ground 4 that the scope of application of Part 7 is so wide and its provisions on retention, use and destruction so discretionary, that it fails to provide the citizen with any indication of what data the state may retain and how it might be used and so does not satisfy the requirement for foreseeability. There is no provision requiring the deletion of data or safeguards relating to disclosure and copying. He relies upon the decision of the Grand Chamber in Marper v United Kingdom (2009) 48 EHRR 50, especially at paragraph 99. In relation to Ground 2, he submits that three significant safeguards identified as necessary by the Grand Chamber in Big Brother Watch are absent in relation to Part 7 of the Act. In relation to Ground 1, there is no provision governing access to bulk personal datasets in relation to confidential journalistic material or a journalist’s source. In relation to Ground 3, there are no safeguards in relation to sharing material with overseas authorities. In relation to Ground 5, the safeguards in relation to legally privileged information are inadequate. Consequently, Mr Jaffey submits that the provisions of Part 7 are not in accordance with law for the purposes of Article 8, are not prescribed by law for the purposes of Article 10 (in relation to confidential journalistic material and a journalist’s sources) and did not justify any interference with the rights guaranteed by those Articles.

Sir James Eadie submits that the powers conferred by Part 7 are different in kind from bulk interception powers. They do not concern the power to obtain personal data at all, but regulate the way in which the security intelligence agencies dealt with information that they had obtained from a variety of sources and imposed additional safeguards on material that had already been obtained. There are clear, detailed rules and safeguards governing the retention, use and destruction of such information. Bulk personal datasets can only be retained under a warrant and those warrants ceased to have effect at the end of a specified time. In those circumstances, the datasets had to be destroyed as there was no legal basis for retaining them. There are requirements in the relevant code of practice governing bulk personal datasets which minimised the disclosure and copying of information.

It is important to consider the regime governing bulk personal datasets in its entirety. First, the provisions in Part 7 do not authorise the interception or obtaining of bulk personal datasets. These are datasets which include personal data relating to a number of individuals most of whom will not be of interest to the intelligence services. The datasets will have been compiled by other persons and obtained by the security services under other powers. The provisions in Part 7 apply when an intelligence service, after an initial examination, decides to retain the set for the purpose of its functions (section 199). Part 7 is therefore intended to control and regulate the use that may be made of bulk personal datasets.

Secondly, an intelligence service may not retain or examine a bulk personal dataset unless the retention of the dataset is authorised by a warrant under Part 7 (section 200). There are two kinds of warrant, namely a class bulk personal data warrant and a specific bulk personal data warrant.

Thirdly, there are restrictions on what may be retained and examined by means of a class bulk personal data warrant. They cannot be used in relation to protected data. Protected data is data which is not systems data, identifying data or data which is not private information. In essence, therefore class bulk personal data warrants cannot be used for the retention or examination of content (the extent to which secondary material may include content is discussed above). In addition, bulk personal datasets cannot be retained or examined under a class bulk personal data warrant if they include health records or a substantial proportion comprises sensitive personal data (section 202).

Fourthly, the more significant interference will therefore occur when the retention or examination of data occurs under a specific bulk personal data warrant. That will enable the retention and examination of a bulk personal dataset where the personal data includes private information about an individual.

In summary, the arrangements governing specific bulk personal data warrants are as follows. The application for such a warrant must include a description of the bulk personal dataset and, where authorisation to examine is sought, the operational purpose must be specified (section 205). The Secretary of State must consider the application personally (section 211) and must decide if the warrant is necessary in the interests of national security, for the purposes of preventing or detecting serious crime or the interests of the economic well-being of the United Kingdom so far as relevant to national security. The Secretary of State must also consider that the warrant is proportionate to what is sought to be achieved. He or she must be satisfied that operational purpose itself is necessary and that examination of the bulk personal dataset is necessary for each of the specified purposes (section 205). There are additional safeguards in relation to health records. An application must state if one of the purposes of the warrant is to authorise the retention and examination of health records or if the head of the intelligence service considers that the bulk personal data dataset includes or is likely to include health records. The Secretary of State may only issue the warrant if there are exceptional and compelling circumstances that make it necessary to authorise the retention and examination of health records. Warrants cease to have effect after 6 months (section 213).

There is a requirement for prior approval of a decision to issue a specific bulk personal data warrant (or a class bulk personal data warrant). A Judicial Commissioner must review whether the warrant is necessary for the specified grounds, the conduct authorised is proportionate and whether each specified operational purpose, and examination of data for that operational purpose, is necessary (section 208).

There are also additional safeguards if a purpose of the criteria to be used for selecting data for examination is to identify any items subject to legal privilege, or if the criteria are likely to identify such items. If the relevant criteria are referable to an individual known to be in the British Islands, the Secretary of State must approve them and that is subject to approval by the Judicial Commissioner. In other cases, a senior official must approve the use of the criteria (section 222). If such an item is retained after examination, the Investigatory Powers Commissioner must be informed. He must direct that the item be destroyed unless the public interest in retention outweighs the public interest in confidentiality in which case he must impose conditions as to the use or retention of the item (section 223).

There are requirements relating to storage and access (paragraphs 7.1 to 7.37 of the Intelligence Services’ retention and use of Bulk Personal Datasets Code of Practice (“the BPD Code”)). There are provisions dealing with disclosure and copying (paragraphs 7.50 to 7.52 of the BPD Code). There are provisions governing confidential journalistic material and journalists’ sources (paragraphs 7.38 to 7.48 of the BPD Code). The approval of a person holding the rank of Director is required where the intention is to select material for examination in order to identify a journalist’s source and may only be granted where the public interest in selection overrides any other public interest. Confidential journalistic protected data, and data identifying a journalist’s source, should only be retained where it is necessary and proportionate to do so, and must be destroyed when retention is no longer necessary.

Furthermore, the Secretary of State, the Judicial Commissioner and the Investigatory Powers Commissioner are subject to the duties imposed under section 2(2) designed to protect privacy, including the need to consider whether what is sought to be achieved could reasonably be achieved by less intrusive measures, and whether the level of protection in relation to obtaining information is higher because of the particular sensitivity of the information. The oversight arrangements in Part 8 of the Act apply and there are rights of appeal.

We consider first the case law such as Marper. Those authorities deal with the retention and use of data from databases. Marper in fact dealt with the retention of DNA and fingerprints. In considering whether the relevant statutory requirements were in accordance with law for the purpose of Article 8, the European Court observed that there would have to be clear, detailed rules governing the scope and application of measures, as well as minimum safeguards concerning matters such as duration, storage, use, and preservation of the integrity and confidentiality of the data in issue. It indicated that other contexts, such as telephone tapping, secret surveillance and covert intelligence gathering would need to have such rules. In that case, the European Court did not need to reach a view as to whether the relevant legislation in that case satisfied the quality of law requirement of Article 8(2) of the Convention.

We consider that the relevant statutory provisions, and the BPD Code, do provide clear and detailed rules governing the matters relevant to the context here (which does not involve the interception or obtaining of information but the imposition of safeguards on the retention and use of bulk personal datasets compiled by others). The provisions provide clear rules on the need for authorisation for retention and examination of data. There are detailed safeguards provided including, in particular, the need for prior judicial authorisation, which will involve consideration of the necessity for and proportionality of a warrant authorising the retention and examination of datasets. The warrants are limited in duration and it is clear that the data must be destroyed once a warrant expires – the warrant is required for the retention to be authorised and ceases to have effect at the end of a specified time limit. In those circumstances, the data could not lawfully be held and would have to be destroyed. The BPD Code deals with matters such as storage and access.

Dealing with the judgment in Big Brother Watch, particular care needs to be taken in applying the principles in that case to the situation dealt with in Part 7. Big Brother Watch was concerned with bulk interception warrants. Part 7 is not concerned with intercepting communications. Rather it is a set of rules, including safeguards, to regulate the retention and use of datasets compiled by others and obtained by the intelligence services under other powers. In that context, viewed as a whole, the totality of the rules do have a basis in domestic law, they are foreseeable and accessible, and they provide appropriate safeguards.

As we have explained, the circumstances in which bulk personal datasets can be retained and examined are set out in the legislation. The process for applying for a warrant, and the procedure for granting it are set out. The application for a specific bulk personal dataset warrant must contain relevant information including the operational purposes for which the material is to be retained and examined. The Secretary of State must be satisfied as to necessity, and the proportionality of the conduct to be authorised. There is, significantly, a need for prior judicial authorisation. The legislation does not refer to the application specifying the types or categories of search terms, and there is no requirement for prior internal authorisation of search terms linked to an identifiable person. However, the need to specify operational purposes, and for the Secretary of State and the Judicial Commissioner to be satisfied that those purposes are necessary and that examination for each of those purposes is necessary, essentially provides a sufficient degree of control over the examination of the bulk personal datasets (bearing in mind that these are datasets already compiled by others for other purposes and the warrant does not authorise interception of communications or interference with equipment). There are adequate protections for legally privileged information and the protection of journalists’ sources. Confidential journalistic material is unlikely to be included in the bulk personal datasets compiled by others but, if and in so far as it is, the Secretary of State and the Judicial Commissioner have a duty to have regard to the need for higher protection for particularly sensitive material. There are provisions in the BPD Code providing further safeguards. Protected data (which is, effectively, the same as the content of communications) cannot be examined under a class bulk personal dataset warrant and requires a specific warrant authorised in the way described above (sections 202 and 203). The protections afforded are materially equivalent to those applicable in other areas where particular types of warrants prohibit the examination of the content of communications of a person within the British Islands. There are oversight arrangements and rights of appeal. Viewed as a whole, those arrangements have a basis in domestic law, they are foreseeable and accessible and provide adequate and effective safeguards against the risk of abuse.

The one area that causes us concern is the transfer of data from personal bulk datasets to overseas authorities. Part 7 of the Act itself does not address this issue. There are safeguards elsewhere. Personal data cannot be transferred outside the United Kingdom or to an international organisation unless that is a necessary and proportionate measure carried out for the authority’s statutory functions (section 109 of the Data Protection Act 2018). The Grand Chamber in Big Brother Watch indicated however, that the transferring state must ensure that the receiving state has safeguards in place for storing data and restricting onwards disclosure although that does not mean the safeguards must be comparable to that in the transferring state (paragraph 362 of the judgment). If the intelligence services transfer data to overseas authorities (something they neither confirm nor deny) they will in fact apply adequate safeguards in practice. These safeguards are set out at paragraph 62 of the judgment of the IPT in Privacy International v Secretary of State for Foreign and Commonwealth Affairs and others [2018] UKIPTrib 15 110 CH (dealing with RIPA but the same arrangements apply it seems to the disclosure of data from bulk personal datasets). Those would ensure that there are adequate arrangements in place to ensure that the transfer of data would not lead to any substantive breach of Article 8. However, the arrangements are not accessible or foreseeable. For that reason and in that respect only, we consider that the failure to make the arrangements publicly accessible would be seen by the European Court as involving a violation of Article 8 of the Convention. We note that there is no prohibition on the transfer of data to overseas authorities. The deficiency identified could be easily remedied in a number of ways, including, for example, amendments to legislation, amendments to the BPD Code, or by making a publicly available statement of the safeguards. We will hear submissions on whether or not any remedy is necessary or appropriate.

For those reasons, and subject to this one caveat concerning the transfer of data from bulk personal datasets to overseas, the interference represented by retention and examination of bulk personal datasets is in accordance with law for the purposes of Article 8 of the Convention.

Grounds 6 to 8 raise three issues of retained EU law and can be taken together. Mr Jaffey submits that Parts 3, 4, 5 and 6 provide for the general and indiscriminate retention of data within the meaning of retained EU law. Consequently, they require additional safeguards. Further, he submits that the Divisional Court was wrong to find that Part 7 of the Act did not fall within the scope of retained EU law. Some bulk personal datasets are gathered under powers conferred by the Act and directions then given that the provisions of Part 7 apply. To that extent, they fall within retained EU law and involve general and indiscriminate retention of data.

In relation to ground 7, Mr Jaffey submits that the Divisional Court was wrong to find, in relation to access to data obtained under Parts 3, 4, 5, 6 and 7, that the requirement for prior approval for access in the context of examining data for purposes other than national security was satisfied by prior independent authorisation at the stage of issuing a warrant. Rather, applying Watson, prior independent authorisation is required each time access is sought to examine material.

Finally, Mr Jaffey submits that the requirements of Articles 7 and 11 of the Charter provide equivalent protection to equivalent Convention rights. Where the Act is incompatible with the Convention, it will therefore involve a breach of Articles 7 and 11 of the Charter and a remedy could, accordingly, be granted.

Sir James Eadie submits first that the Divisional Court was correct to find that none of the relevant powers in the Act are general and indiscriminate in nature within the meaning of EU retained law. Further, the Divisional Court was correct to hold that Part 7 does not fall within the scope of retained EU law. Secondly, Sir James Eadie submits that Watson does not require there to be prior independent judicial authorisation each time that data is selected for examination. Finally, Sir James Eadie submits that the Divisional Court was correct to find that the decision of the Grand Chamber is not binding on the CJEU.

We can consider Grounds 6 and 7 relatively shortly as we see no basis for considering that the Divisional Court was wrong on its central conclusions on these issues.

First, as the Divisional Court pointed out, the CJEU in Watson was dealing with Swedish legislation which required the general retention of all manner of electronic communications and data for all subscribers and registered users, without differentiation or limitation. The Swedish legislation was not qualified by either a necessity or a proportionality test (paragraphs 121 and 126 of the first EU Judgment).

Secondly, the Divisional Court set out at paragraphs 127 to 134 of its first EU Judgment why it considered the provisions of Part 4 of the Act were not general and indiscriminate. We have set those at out paragraphs 82 to 83 above. We consider that that reasoning is correct. The Divisional Court held that the same reasoning applied to Parts 3, 5 and 6 of the Act. We agree. Nor do we consider that that reasoning is affected by anything said by the CJEU in C-623/17 Privacy International v Secretary of State for Foreign and Commonwealth Affairs. The regimes in that case are very different to the regimes in the present case. Parts 3, 4, 5 and 6 do not involve the general and indiscriminate retention of data. Rather, the amount of data retained will be the outcome of applying the statutory regime which in turn, involves consideration of questions of necessity and proportionality.

So far as Part 7 is concerned, we agree with the Divisional Court that where data is obtained under powers outside the Act, and the safeguards in Part 7 are applied to that data, those situations do not fall within the scope of retained EU law for the reasons given at paragraph 139 of its second EU Judgment set out at paragraph 99 above. There may be an issue as to whether particular bulk datasets acquired under provisions of the Act and made subject by direction to the Part 7 safeguards fall within the scope of retained EU law. But we are satisfied that even if that is the case, the retention of the data would not be general and indiscriminate. The retention of such bulk personal datasets must be authorised by a warrant under Part 7. The application of the Part 7 regime involves the application of tests of necessity and proportionality to determine whether bulk personal datasets can be retained or whether they must be destroyed. Bulk personal datasets are not retained in a general and indiscriminate manner. As none of the regimes involve the general and indiscriminate retention of data, it is not necessary to deal with the other issues raised by the appellant in this regard.

In relation to ground 7, the Divisional Court set out at paragraph 145 of the second EU Judgment why it did not consider that Watson required prior independent authorisation each time data was accessed and it was sufficient if the initial prior independent authorisation of a warrant authorised access. That paragraph is set out at paragraph 100 above. We agree. Here, retention and access are dealt with at the same time and there is prior independent authorisation of access. There is no requirement under EU law to obtain independent authorisation again. Nothing in the second EU Judgment is inconsistent with that. Nor is that analysis altered by Opinion 1/15 of 26 July 2017 and subsequent CJEU case law. They simply deal with very different factual contexts.

Ground 8 essentially concerns remedies. If legislation involves a violation of a Convention right, the only available remedy would be a declaration of incompatibility under section 4 of the HRA. If the legislation also involves a breach of a provision of the Charter, the possibility arises of a remedy directed at disapplying the legislation at least in so far as it breached a provision of the Charter. It is correct that the decision in Big Brother Watch would not bind the CJEU. However, there is a different question, which is whether the Charter guarantees equivalent rights.

Article 52(3) of the Charter provides that the relevant articles of the Charter are to be given the same effect as the Convention. So far as the matters raised in this appeal in relation to Parts 3, 4, 5 and 6 are concerned, and given that we have considered the legislation as it is proposed to be amended, we have not found any breach of the Convention. There has been no suggestion that the matters complained of in relation to Parts 3, 4, 5 or 6 of the Act would breach any provision of the Charter for any other reason. In the circumstances, Ground 8 does not call for the grant of any remedy in this appeal in relation to those matters.

So far as Part 7 is concerned, the only issue that arose under the Convention concerned the publication of adequate safeguards in relation to the transfer of data from bulk personal datasets to overseas authorities (see above paragraph 202). However, where data is obtained under powers outside the Act, this would not fall within the scope of EU law. The appellant said in argument that on a small number of previous occasions, bulk personal datasets were obtained under the Act and then a direction given under section 225 of the Act that Part 7 applied. These judicial review proceedings, and this appeal, were not intended to review particular transfers that have occurred in the past. We were not shown any evidence or any directions dealing with these instances. It is, therefore, neither necessary nor appropriate, to consider any remedy in relation to past events that may have happened. In relation to the future, the United Kingdom has ceased to be a member of the European Union and the provisions of the Charter would not be applicable to any future transfers as it is not part of any retained EU law. No remedy is needed therefore, so far as the Charter is concerned, in relation to Part 7 of the Act.

We have set out our conclusions at paragraph 12 above. This appeal will be dismissed for the reasons set out above, subject to two matters. First, the arrangements governing the transfer of material from bulk personal datasets to authorities in other states are not in accordance with law, and so not compatible with Article 8 of the Convention, because the safeguards governing such transfers are not contained in any legislation, code or publicly available policy or other document. We will invite written submissions on the appropriate remedy on this matter. Secondly, we will remit the following issue to the Divisional Court for its determination: whether the provisions of Chapter 3 of Part 6 are sufficient to provide adequate safeguards for the protection of a journalist’s sources or confidential journalistic material in relation to communications obtained by means of a bulk equipment interference warrant.

GENERAL PRIVACY PROTECTIONS – PART 1 OF THE ACT 1

BULK INTERCEPTION, ACQUISITION AND EQUIPMENT INTERFERNCE WARRANTS –

TARGETED/THEMATIC EQUIPMENT INTERFERENCE WARRANTS UNDER PART 5 19

BULK PERSONAL DATASET WARRANTS — PART 7 21

ACQUISITION AND RETENTION OF COMMUNICATIONS DATA – PTS 3 AND 4 OF THE ACT...... 26

OVERSIGHT ARRANGEMENTS – PART 8 OF THE ACT 29

This document presents an overview of the regime introduced by the Investigatory Powers Act 2016 (the “Act” or, where clarity requires, the “2016 Act”), and certain other relevant legislative provisions. It is intended to be an introduction to the structure and operation of the legislation. It does not refer to all of the relevant provisions for the purposes of the claim.

GENERAL PRIVACY PROTECTIONS – PART 1 OF THE ACT

The Act sets out “the extent to which certain investigatory powers may be used to interfere with privacy”: s.1(1).

Part 1 of the Act contains both general “duties in relation to privacy” and other protections including offences and penalties: s.1(2)-(3).

S.2 of the Act contains “general duties” in relation to privacy in s 2(2). The duties apply where a public authority1 is deciding whether to issue, renew or cancel a warrant under Parts 2, 5, 6 or 7 (as the Secretary of State may do: see below), to approve such a decision (as a Judicial Commissioner may do: see below), to grant, approve or cancel an authorisation under Part 3, or to give a notice under Part 4: s.2(1).

In exercising the specified functions, s.2(2) provides that the public authority must have regard to:

The ‘have regard’ duties in s.2(2) apply so far as is relevant in the particular context, and subject to the need to have regard to other considerations that are also relevant in that context: s.2(3). Section 2(4) provides that those other considerations may include:

Part 1 of the Act also contains certain criminal offences, namely, intentional “unlawful interception” (s.3) and knowingly or recklessly “unlawfully obtaining communications data” (s.11).

Unlawful interception occurs where (a) a person intentionally intercepts3 a communication in the course of its transmission by a public or private telecommunications system or a public postal service, (b) the interception is carried out in the UK and (c) the person lacks “lawful authority” to do so: s.3(1). So far as is material to the present claim, lawful authority will exist (inter alia) where the interception is carried out in accordance with a bulk interception warrant under Pt 6, Ch 1 of the Act: s.6(1)(a)(ii). The offence of unlawful interception is

Unlawfully obtaining communications data occurs where, without lawful authority4, a relevant person5 knowingly or recklessly obtains communications data from a telecommunications operator or postal operator: s.11(1). It is a defence if the person can show that s/he acted in the reasonable belief that s/he had lawful authority to obtain the communications data. The offence of unlawfully obtaining communications data is also triable ‘either way’, and, on conviction on indictment, a person guilty of it is liable to up to 2 years’ imprisonment or a fine (or both): s.11(4)(d).

BULK INTERCEPTION, ACQUISITION AND EQUIPMENT INTERFERNCE WARRANTS – PART 6

This claim concerns, inter alia, the ‘bulk warrant’ provisions in Part 6. In that regard:

The key provisions are set out below (bulk personal datasets, under Pt 7 of the Act, are considered separately).

Bulk interception warrants (Pt 6 Ch 1)

A bulk interception must satisfy the following two cumulative conditions:

A bulk interception warrant also authorises any conduct which it is necessary to undertake in order to do what is expressly authorised or required (s.136(5)).

“Communication” by s 261(1) relevantly includes “anything comprising speech, music, sounds, visual images of data of any description” and “signals serving either for the impartation of anything” between persons or things (or both) “or for the actuation or control of any apparatus”. A communication may therefore be or contain “content” and/or “secondary data” (see immediately below).

“Content” by s 261(6) means relevantly “any element of [a] communication, or any data attached to or logically associated with [a] communication, which reveals anything of what might reasonably be considered to be the meaning (if any) of the communication, but — (a) any meaning arising from the fact of the communication or from any data relating to the transmission of the communication is to be disregarded, and (b) anything which is systems data is not content.” (By s 157(1), “intercepted content” in relation to a bulk interception warrant means “any content of communications intercepted by an interception authorised or required by the warrant”.)

“Secondary data” by s 137 means either of the following:

Bulk acquisition warrants (Pt 6 Ch 2)

Bulk acquisition warrants authorise the obtaining, imposition of a requirement to

Specifically, a bulk acquisition warrant authorises or requires its addressee to secure, by any conduct described in the warrant, any one or more of (see s.158(5) and (6)):

“Communications data” (“CD”) is defined in s.261(5), as follows:

Bulk acquisition warrants again authorise any conduct necessary to undertake what is expressly authorised or required and any conduct by a person required to assist giving effect to the warrant (s.158(7)).

Bulk equipment interference warrants (Pt 6 Ch 3)

A bulk equipment interference warrant (s.176(1)):

A bulk equipment interference warrant (s.176(4)):

Again, bulk equipment interference warrants authorise any conduct necessary to undertake what is expressly authorised or required and any conduct by a person required to assist giving effect to the warrant: s.176(5).

Criteria for approval of bulk intercept, acquisition and equipment interference warrants by the Secretary of State

In the case of all three types of bulk warrant in Part 6, the power to issue a warrant resides with the Secretary of State, and is exercisable only following an application made by or on behalf of the head of an intelligence service (s.138(1), s.158(1) and s.178(1)).

In each case, the Secretary of State may only issue the warrant if s/he considers that:

In the case of bulk interception warrants and bulk equipment interference warrants only, the Secretary of State must additionally consider that:

Detailed provision as to the format of, and the matters that must be included in, warrant applications under Part 6 Chs 1-3 of the Act appears at: §§6.17-6.20 of the Interception of Communications Code of Practice (the “Interception CoP”) (bulk interception warrants); §§4.1-4.5 of the Bulk Acquisition of Communications Data Code of Practice (the “Bulk Acquisition CoP”) (bulk acquisition warrants); and §§6.10-6.13 of the Equipment Interference CoP (the “EI CoP”) (bulk equipment interference warrants).

In relation to all three types of bulk warrant, the decision to issue a warrant must be taken personally by the Secretary of State, and the warrant must be signed by the Secretary of State (s.141, s.160, s.182)13.

Each of the three forms of bulk warrant under Pt 6 Chs 1-3 must, as issued, contain a provision stating that it is a bulk warrant of that kind and it must be addressed to the head of the intelligence service by whom or on whose behalf the warrant application was made; and it must describe the conduct that is authorised by the warrant (s.142(1)- (2), s.161(1)-(2), s.183(1)-(2)14). It must also specify the operational purposes for which any material obtained under the warrant may be selected for examination: see under “Operational Purposes” below.

Necessity and proportionality

Warrants under Pts 6 Ch 1-3 of the Act may only be issued where the Secretary of State considers a warrant to be necessary for the specified statutory purposes (i.e. national security,

Operational purposes

The Secretary of State may not issue a bulk warrant under Pt 6 Ch 1, 2 or 3 unless s/he considers that (i) each of the “specified operational purposes” is a purpose for which the examination of material obtained under the warrant is or may be necessary, and (ii) the examination of material for each such purpose is necessary on any of the grounds on which the Secretary of State considers the warrant to be necessary: s.138(1)(d), s.158(1)(c), s.178(1)(d).

In that regard, a bulk warrant under each of Pt 6 Chs 1-3 must “specify the operational purposes for which any [material] obtained under the warrant may be selected for examination” (s.142(3), s.161(3), s.183(4)).

By ss.142(4)-(11), 161(4)-(11) and 183(5)-(12):

Interception CoP §§6.61-6.67 makes further provision relating to operational purposes.15

Existence of safeguards

Warrants in respect of the bulk powers in Pt 6 Chs 1–3 may only be issued if the Secretary of State considers that satisfactory “safeguards” are in place in respect of a number of matters: s.138(1)(e), s.158(1)(d), s.178(1)(e). Again, the relevant safeguards are largely the same in relation to each of the three key bulk powers.

Safeguards relating to retention, copying and disclosure

In relation to every bulk (Pt 6) warrant, the Secretary of State must ensure that arrangements are in force for securing that:

As to (a), the meaning of “necessary for the authorised purposes” is elucidated in the same terms for each of the three bulk powers: see s.150(3), s.171(3) and s.191(3)19.

it is, or is likely to become, necessary in the interests of national security or on any other grounds falling within section 138(2),

it is necessary for facilitating the carrying out of any functions under this Act of the Secretary of State, the Scottish Ministers or the head of the intelligence service to whom the warrant is or was addressed,

it is necessary for facilitating the carrying out of any functions of the Judicial Commissioners or the Investigatory Powers Tribunal under or in relation to this Act,

it is necessary to ensure that a person (“P”) who is conducting a criminal prosecution has the information P needs to determine what is required of P by P’s duty to secure the fairness of the prosecution, or it is necessary for the performance of any duty imposed on any person by the Public Records Act 1958 or the Public Records Act (Northern Ireland) 1923.”

However, where material obtained under a warrant (or a copy) has been provided to any overseas authority, these safeguards do not apply: s.150(8), s.171(8) and s.191(8). Instead, the Secretary of State must ensure that requirements corresponding to those immediately above and immediately below apply “to such extent (if any) as the Secretary of State considers appropriate”: see s.151(1) and (2)(a), s.171(9) and s.192(1)-(2).20

Pt 6 Ch 1 and Pt 6 Ch 3 contain statutory duties not to make “unauthorised disclosures” (s.156 and s.197), including disclosure of any material obtained under bulk interception or bulk equipment interference warrants, save where the disclosure is an “excepted disclosure” (including a disclosure authorised by the warrant, a disclosure to oversight bodies, etc.). It is a criminal offence to make an “unauthorised disclosure” of this kind21. Under Pt 6 Ch 2, s.174 makes it an offence for the telecommunications operator required to assist with the warrant (or a person employed or engaged for its business) to disclose the existence or contents of the warrant itself, but there is no offence of disclosing what is collected under a bulk acquisition warrant.

Each relevant CoP contains provisions addressing retention, copying and disclosure: Interception CoP §§9.15-9.31; Bulk Acquisition CoP §§9.4-9.13; EI CoP §§9.1-9.35.

Safeguards relating to selection for examination

The Act also requires the Secretary of State to ensure that safeguards relating to the examination of material are in force before issuing a bulk interception warrant, a bulk acquisition warrant or a bulk equipment interference warrant (ss.150(1)(b) and 152; ss.171(1)(b) and 172; and ss.191(1)(b) and 193)). Specifically, s/he must ensure that:

Because an operational purpose may be included in a warrant for any of the purposes for which a warrant is issued, “selection for examination” may occur for “operational purposes” considered necessary for any of “national security”, “preventing or detecting serious crime” or “the economic well-being of the United Kingdom” insofar as relevant to

In relation to bulk interception warrants and bulk equipment interference warrants, the Secretary of State must also ensure that the selection for examination of respectively “content” and “protected material” meets any of the “selection conditions” (s.152(1)(c) and s.193(1)(c)) (the “British Islands safeguard”.) The selection conditions are as follows (s.152(3) and s.193(3)):

The relevant Codes of Practice make further provision in relation to selection for examination: Interception CoP §6.71 et seq, Bulk Acquisition CoP §6.14 et seq; EI CoP

Enhanced safeguards – special cases

Basic position: As to legally privileged material, the basic position for bulk interception and bulk equipment interference warrants is that:

Communications furthering a criminal purpose: Where the (or a) purpose of the use of criteria for selection for examination of “intercepted content” / “protected information” (but not other material obtained under a warrant) is to identify communications / information that would be subject to legal privilege if they were not made / created or held with the intention of furthering a criminal purpose, one of the “selection conditions” is met (see above) and the warrant addressee considers that the items are “likely to be communications made with the intention of furthering a criminal purpose”, the selection for examination may occur only if a “senior official” has approved the criteria: ss.153(6)-(7), 194(6)-(7). Approval may be given only if the official “considers” that the items “are likely to be” made / held or created “with the intention of furthering a criminal purpose”: ss.153(8), 194(8).

Where targeted examination warrants are required and the purpose is to select privileged items: Where a targeted examination warrant is required in order to select for examination items subject to legal privilege24 and the (or a) purpose is to authorise the selection for examination of items subject to legal privilege, s.27 and s.112 provide that: the warrant application must state that purpose; the person determining the application must have regard to the public interest in the confidentiality of items subject to legal privilege; and the person determining the application must issue a warrant only if s/he considers that (i) there are exceptional and compelling circumstances that make it necessary to select such items for examination and (ii) the relevant safeguards include specific arrangements for the handling, use, retention and destruction of such data (s.27(2)-(4), s.112(2)-(4)). The same definition of exceptional and compelling circumstances is used in s.27(6) and s.112(6).

Retention following selection for examination: Where an item subject to legal privilege is retained following its examination for a purpose other than its destruction, the addressee of the warrant must inform the Investigatory Powers Commissioner (“IPC”) as soon as is reasonably practicable. The IPC must, unless he considers that the public interest in retaining the item outweighs the public interest in its confidentiality, and that retaining the item is necessary in the interests of national security or for the purpose of preventing death or significant injury, direct that the item is destroyed or impose conditions as to the use/retention of the item: ss.153(9)-(12), 194(9)-(12).

Definition of “legal privilege”: “Items subject to legal privilege”, in relation to England and Wales, has the same meaning as in s.10 Police and Criminal Evidence Act 1984; other definitions apply to Scotland and Northern Ireland: see s.263.

CoP provision: The safeguards applicable to the selection for examination of legally privileged material are explained at §9.48 et seq of the Interception CoP and §9.55 of the EI CoP. Among other matters, pursuant to the Interception CoP and Bulk EI CoP:

Relevant statutory safeguards apply to (i) “confidential journalistic material” (as defined in s.26425); and (ii) “sources of journalistic information” (as defined in s.263).

In relation to confidential journalistic material, where such material is retained following its examination for a purpose other than its destruction, the addressee of the warrant must inform the IPC as soon as is reasonably practicable: ss.154, 195.

Additional statutory safeguards apply where a targeted examination warrant is required26 and the (or a) purpose is the selection for examination of “journalistic material” which the authority believes is “confidential journalistic material”. The warrant application must contain a statement that the purpose is to select such material for examination; and the person to whom the application is made may issue the warrant only if they consider that the arrangements under s.150 or s.191 (as the case may be) include specific arrangements for the handling, retention, use and destruction of communications containing confidential journalistic material: see s.28(2), s.113.

The same applies, mutatis mutandis, where an application is made for a targeted examination warrant for the (or a) purpose of identifying a source of journalistic information i.e. the application must so state; and the person issuing the warrant must consider that appropriate arrangements are in place: s.29, s.114.

Under the Codes:

The Bulk Acquisition CoP contains specific protections for the selection of data for examination in such cases:

Offences

The Act creates specific criminal offences that apply where a person deliberately selects material for examination that breaches the examination safeguards referred to above, knowing or believing that doing so will breach the safeguard: see ss.155, 173, 196. Such an offence is punishable on conviction on indictment by imprisonment for up to 2 years or an unlimited fine.

Requirement for independent approval of warrants by a Judicial Commissioner

General position (non-urgent warrants)

In the case of all three types of bulk warrant in Part 6, the Secretary of State’s power to issue a warrant is subject to a requirement to obtain independent approval by a Judicial Commissioner (ss.140, 159, 179). The Judicial Commissioner is required to review the Secretary of State’s conclusions as to:

The Judicial Commissioner must apply the same principles as would be applied by a court on an application for judicial review and must consider matters with a sufficient degree of care as to ensure that s/he complies with the general duties in relation to privacy imposed by s.2.

Where a Judicial Commissioner refuses to approve a decision to issue a warrant, s/he must give written reasons to the Secretary of State, and the Secretary of State may in that case ask the IPC (unless he was the Judicial Commissioner who gave the refusal) to decide whether to approve the decision to issue the warrant.

Judicial Commissioner approval of bulk equipment interference warrants in urgent cases

As set out above, in relation to bulk equipment interference warrants only, the Secretary of State is not required to obtain advance approval from a Judicial Commissioner in urgent cases: s.178(1)(f).

In such a case, the Secretary of State must inform a Judicial Commissioner that a warrant has been issued, following which that Judicial Commissioner must (before the end of the third working day after the day on which the warrant was issued) decide whether to approve the decision to issue the warrant, and notify the Secretary of State of that decision. If the Judicial Commissioner refuses to approve the decision, the warrant ceases to have effect (unless already cancelled) and may not be renewed: s.180. Where this occurs, the person to whom the warrant was addressed must, so far as is reasonably practicable, secure that anything in the process of being done under the warrant stops as soon as possible: s.181(2). The Judicial Commissioner may (a) authorise further interference with equipment for the purpose of enabling the person to secure that anything in the process of being done under the warrant stops as soon as possible, (b) direct that any material obtained under the warrant is destroyed; and/or (c) impose conditions as to the use or retention of any of that material: s.181(3). In exercising these functions, the Judicial Commissioner may require an ‘affected party’ (being both the Secretary of State and the addressee of the warrant) to make representations, and must have regard to any representations made by an affected party (whether or not such representations were required): ss.181(4)-(5).

The Secretary of State may ask the IPC to review a decision made by any other Judicial Commissioner under s.181(3), whereupon the IPC may confirm the decision or make a fresh one: s.181(7).

Nothing in ss.180 or 181 affects the lawfulness of anything done under a warrant before it ceases to have effect, or anything being done under a warrant when it ceases to have affect before that thing could be stopped or that it is not reasonably practicable to stop: s.181(8).

Duration, modification and cancellation of bulk warrants

As to duration, bulk interception warrants, bulk acquisition warrants and bulk equipment interference warrants (unless already cancelled) cease to have effect at the end of the period of 6 months beginning with (a) the day on which the warrant was issued, or (b) in the case of a warrant that has been renewed, the day after the day at the end of which the warrant would have ceased to have effect if it had not been renewed: ss.143, 162, 184(1) and (2)(b)28.

As to renewal, the Secretary of State may renew a bulk interception warrant, bulk acquisition warrant or a bulk equipment interference warrant at any time during the period of 30 days ending with the day at the end of which the warrant concerned would otherwise cease to have effect, provided that certain “renewal conditions” are met. The relevant renewal conditions in each case are as follows:

As to modification, the provisions of bulk interception warrants, bulk acquisition warrants and bulk equipment interference warrants may be modified at any time in order to add, vary or remove any specified operational purpose or to provide that the warrant no longer requires or authorises specified activities: ss.145, 164 and 186. The addition or variation of a specified operational purpose is designated as a “major” modification, which is subject to a separate requirement for Judicial Commissioner approval (except in urgent cases, where Judicial Commissioner approval of a major modification must be sought and obtained within three working days): ss.145(5), 146- 147; ss.164(5), 165-166; ss.186(6), 187-188.

As to cancellation, the Secretary of State (or a senior official acting on his/her behalf) may cancel a bulk interception warrant, bulk acquisition warrant or bulk equipment interference warrant at any time. Moreover, s/he must cancel such a warrant where certain conditions are met, viz. that the warrant is no longer necessary in the interests of national security29, the conduct authorised by the warrant is no longer proportionate to what is sought to be achieved by that conduct, or the examination of material obtained under the warrant is no longer necessary for any of the specified operational purposes (ss.148, 167, 189). Where a warrant is cancelled, the addressee of the warrant must, so far as reasonably practicable, secure that anything in the process of being done under the warrant stops as soon as possible (ss.148(5), 167(5) 189(5)). A warrant that has been cancelled may not be renewed (ss.148(6), 167(6) and 189(6)).

TARGETED/THEMATIC EQUIPMENT INTERFERENCE WARRANTS UNDER PART 5

In addition to the bulk powers in Pt 6 Chs 1–3 of the Act, this claim concerns the lawfulness of aspects of the equipment interference regime in Part 5 of the Act.

The only aspects presently in issue are the provisions described in the Act as “targeted equipment interference warrants” (being warrants which authorise or require the addressee to secure interference with any equipment for the purpose of obtaining communications, equipment data or any other information (s.99(2)) where the subject matter of warrant falls within s.101(1)(b)-(h) of the Act (commonly referred to as “thematic equipment interference warrants”)30:

Several of the requirements for the issue of a targeted/thematic equipment interference warrant are similar to those that apply in relation to bulk warrants under Pt 6 Chs 1-3 (see above).

Thus, following an application made by an intelligence service, the Secretary of State may issue a targeted/thematic equipment interference warrant if:

Additional safeguards apply where the purpose of an equipment interference warrant is to obtain items subject to legal privilege: s.112 of the Act. These mirror the safeguards applicable to the selection for examination of material obtained under a bulk warrant (see e.g. s.153 in relation to bulk interception warrants).

Further, where an application is made for a targeted equipment interference warrant and the purpose, or one of the purposes of the warrant, is to obtain confidential journalistic material or to identify / confirm a source of journalistic information, the application must contain a statement to that effect and a warrant may be issued only if specific arrangements are in place for the handling, retention, use and destruction of communications or other items of information containing such material: ss.113 – 114.

In contrast to the bulk powers, Part 5 of the Act also makes provision for the issue of targeted equipment interference warrants by the Scottish Ministers (s.103), by the Secretary of State to the Chief of Defence Intelligence (s.104) and by certain “law enforcement chiefs” to appropriate law enforcement officers (s.106-107). The requirements for the issue of warrants in these instances are similar, but not identical, to the requirements in s.102 of the Act (issue of a targeted equipment interference warrant by the Secretary of State to the head of an intelligence service).

S.115 of the Act makes detailed provision for, inter alia, the details that must be included in a targeted equipment interference warrant, which depends on the subject matter of the warrant. For instance, where the subject matter of such a warrant is equipment belonging to (etc.) persons who form a group which shares a common purpose or carries on a particular activity, the warrant must contain a description of the purpose / activity and the name of, or a description of, as many of the persons as it is reasonably practicable to name or describe: s.115(3).

Sections 116-125 make detailed provision for the duration, renewal, modification and cancellation of warrants (including targeted equipment interference warrants) issued under Pt 5 of the Act.

BULK PERSONAL DATASET WARRANTS — PART 7

Under s.199(1) of the Act, an intelligence service retains a bulk personal dataset (“BPD”) where: (a) it obtains a set of information that includes personal data relating to a number of individuals; (b) the nature of the set is such that the majority of the individuals are

An intelligence service may not exercise a power to retain a BPD unless its retention is authorised by either a “class BPD warrant” (authorising an intelligence service to retain, or retain and examine, any BPD of a class described in the warrant) or a “specific BPD warrant” (authorising an intelligence service to retain, or retain and examine, any BPD described in the warrant): s.200.

Part 7 does not itself contain any power to obtain a BPD. Rather, the requirement for a BPD warrant concerns the retention and any subsequent examination of a BPD obtained by other means. Such means may include a warrant issued under s.5 of the Intelligence Services Act 1994 (“ISA”), other exercise of the intelligence services’ “information gateway” powers under the ISA and Security Service Act 1989, and the other powers under the Act (except for Pt 6 Ch 2).

In the case of both a class BPD warrant and a specific BPD warrant, the decision to issue must be taken by the Secretary of State personally: s.211.

The requirement for the authorisation of retention of a BPD by way of a warrant under

Class BPD warrants

On an application by the head of an intelligence service (or a person acting on his or her behalf), the Secretary of State may issue a class BPD warrant if (see s.204):

A BPD may not, however, be retained, or retained and examined, pursuant to a class BPD warrant if the head of the intelligence service considers that the BPD consists of or includes, “protected data”34 or “health records”35 or that a substantial proportion of the BPD consists of “sensitive personal data”36: s.202(1) and (2).

Further, an intelligence service may not retain, or retain and examine, a BPD pursuant to a class BPD warrant if the head of the intelligence service considers that the nature of the BPD or the circumstances of its creation are such that its retention, or retention and examination, raises novel or contentious issues which ought to be considered by the Secretary of State and a Judicial Commissioner on an application for a specific BPD warrant.

Specific BPD warrants

A specific BPD warrant may be sought by the head of an intelligence service (or a person acting on his or her behalf) where (see s.205(1)-(3)):

Subject to those points, the basic criteria for the issue of a specific BPD warrant by the Secretary of State are the same as those for the issue of a class BPD warrant, save that advance Judicial Commissioner approval need not be obtained in urgent cases: see s.205(6)(a)-(e). Provision for post hoc Judicial Commissioner approval of specific BPD warrants in urgent cases is made at ss.209 – 210 (in terms which mirror the provision for such approval in relation to bulk equipment interference warrants in urgent cases).

Additional safeguards apply to applications for specific BPD warrants in relation to:

Duration, renewal, modification and cancellation of BPD warrants

Sections 213-219 make provision for the duration, renewal, modification and cancellation of BPD warrants. The provision made largely mirrors the provision for the duration, etc., of bulk warrants under Pt 6 Chs 1-3 (including the requirement for Judicial Commissioner approval of “major modifications”).

One different provision is s.219, which provides that, where a BPD warrant ceases to have effect because it expires without having been renewed or is cancelled:

Safeguards relating to the examination of BPDs

S.221 requires the Secretary of State to ensure that arrangements are in force for securing that:

The Secretary of State must also ensure, in relation to every specific BPD warrant in which conditions in relation to the selection for examination of data under s.207 (see above) are imposed, that arrangements are in force for securing that any selection for examination of protected data on the basis of criteria referable to an individual known to be in the British Islands at the time of the selection is in accordance with the conditions specified in the warrant.

As with the bulk powers in Pt 6 Chs 1-3, enhanced safeguards apply to the selection for examination pursuant to a specific BPD warrant of items subject to legal privilege (which differ depending on whether it is the / a purpose of the warrant to obtain privileged items, this is likely, or the addressee of a warrant considers that the data is not privileged because it or any underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose): s.222.

It is a criminal offence, punishable on conviction on indictment by a prison term of up to 2 years or an unlimited fine, to deliberately select data for examination under a class BPD warrant or a specific BPD warrant, knowing or believing that the selection of that data is in breach of certain specified safeguards (e.g. that any such selection is carried out only so far as is necessary for the operational purposes specified in the warrant, and so on): s.224.

Application of Pt 7 to BPDs obtained under other powers in the Act

Section 225 provides that the Secretary of State may, on an application by the head of the intelligence service, give a direction that the intelligence service may retain, or retain and examine, a BPD that has been obtained under a warrant issued under another provision of the Act (except a bulk acquisition warrant under Pt 6 Ch 2). In such a case, the power under which the BPD was obtained ceases to apply, and the intelligence service thereafter requires the authorisation of either a class BPD warrant or a specific BPD warrant. Such a direction may provide for any “associated regulatory provision” specified in the direction to continue to apply in relation to the BPD (meaning any provision which is made by or for the purposes of the Act (other than Pt 7) that applied immediately prior to the direction). A direction under s.225 may only be given with the approval of a Judicial Commissioner, and it may not be revoked (it may be varied, but only for the purpose of altering or removing any provision included in the direction).

ACQUISITION AND RETENTION OF COMMUNICATIONS DATA – PTS 3 AND 4 OF THE ACT

Parts 3 and 4 of the Act were the subject matter of the February 2018 hearing. However, certain amendments to those Parts of the Act have taken effect since the Court gave its judgment in these proceedings on 27 April 2018.

Part 4 relates to the procedure for requiring telecommunications providers to retain communications data and Part 3 relates to the procedure for authorisation for relevant public authorities to obtain communications data. Those Parts of the Act are supplemented by the Communications Data Code of Practice (November 2018) (the “CD CoP”), which provides guidance on the procedures to be followed when acquisition of communications data takes place under Part 3 and when communications data is retained under Part 4.

Retention of communications data – Part 4

Section 87 provides that the Secretary of State may, by notice (a “retention notice”) require a telecommunications operator to retain relevant communications data if (a) the Secretary of State considers that the requirement is necessary and proportionate for one or more of the

Since the Court’s judgment in February 2018, the specified purposes (in s.87(1)) have been amended37. They are now restricted to retention that is necessary and proportionate: (i) in the interests of national security, (ii) for the applicable crime purpose (see s.87(10A)), in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,

As the Court noted in paragraphs [129] to [138] of its 27 April 2018 judgment:

Acquisition of communications data – Part 3

Applications to acquire communications data can be authorised by three separate categories of individual, depending on the circumstances:

Under s.60A(1), the IPC may grant an authorisation, on an application made by a relevant public authority, where he considers that: (a) it is necessary for the relevant public authority to obtain communications data for a specified purpose falling within subsection 60A(7); (b) it is necessary for the relevant public authority to obtain the data

Similar conditions of necessity and proportionality apply for authorisations under s.61 and 61A (with the additional requirement of urgency in s.61A).

Ss.62-66 have been moved and grouped together under a new heading “Further provision about authorisations”. They impose additional restrictions on acquisition of communications data, including:

Further safeguards are put in places by ss.76 and 77, in particular:

RIPA Part 1 Chapter 2

The regime for the acquisition of communications data under Regulation of Investigatory Powers Act 2000 Pt 1 Ch 2 has not yet been repealed. It operates alongside IPA Pts 3–4 for some public authorities. The provisions have been amended to provide that “traffic data” and data about the use of any postal service, telecommunication service or part of a telecommunication system (see s.21(4)(a)-(b)) can only be acquired in relation to “serious crime”.

OVERSIGHT ARRANGEMENTS – PART 8 OF THE ACT

Part 8 makes provision for a series of oversight arrangements in relation to the exercise of the range of investigatory powers under the Act. In particular, Part 8:

The IPC and the Judicial Commissioners

The IPC replaces and consolidates the functions of a series of pre-existing oversight bodies, all of which were all abolished by the Act: s.240.

Section 227(1) requires the Prime Minister to appoint the IPC and such number of other Judicial Commissioners as the Prime Minister considers necessary for the carrying out of the Judicial Commissioners’ functions. The IPC and the Judicial Commissioners must hold or have held a high judicial office: s.227(2). The current (and first) IPC is the Rt Hon Lord Justice Fulford (appointed February 2017). His Deputy is the Rt Hon Sir John Goldring. The IPC is supported in his role by the Office of the Investigatory Powers

The IPC’s main oversight functions are set out in s.229, and include (so far as is material):

Error reporting and notification to victims

Under s. 235(6) a public authority, telecommunications operator or postal operator must report to the IPC any “relevant error” (as defined in s. 231(9)). A “relevant error” means an error (a) by a public authority in complying with any requirements which are imposed on it by virtue of the Act or any other enactment and which are subject to review by a Judicial Commissioner and (b) of a description identified for this purpose in a code of practice specified under Schedule 7: s.231(9). The IPC must also keep under review the definition of “relevant error”: s.231(9).

Under the Interception CoP §10.17, EI CoP §10.19, Bulk Acquisition CoP §10.15 and BPD CoP §8.11, relevant errors must be notified to the IPC “as soon as reasonably practicable, and no later than ten working days after it has been established by appropriate internal governance processes that a relevant error has occurred”. Under CD CoP §24.26, the requirement is to report the error to the authority’s senior responsible officer and then to the IPC “within no more than five working days of it being established that an error has occurred”.

Under s.231(1) of the Act, the IPC must39 inform a person of any “relevant error” relating to that person of which the Commissioner is aware if the Commissioner considers that

When informing someone of an error, the IPC must also (s.231(6)):

Annual reporting by the IPC

The IPC must also, as soon as reasonably practicable after the end of each calendar year, make a report to the Prime Minister about the carrying out of the functions of the Judicial Commissioners (s.234(1)), including the detailed matters specified in s.234(2), which include statistics on the use of investigatory powers, information about the results and impact of such use, information about the operation of the safeguards under the Act, and so on. A report under s.234(1) must also include information about the number of relevant errors of which the IPC has become aware during the year to which the report relates, the number of such errors which the IPC has decided were serious errors, and the number of persons who have been informed of such errors: s.231(8).

On receipt of a report from the IPC under s.234(1), the Prime Minister must publish the report and lay a copy before Parliament: s.234(6)41. The IPC also has a discretion, where he considers it appropriate, to make a report to the Prime Minister on any matter relating to the functions of the Judicial Commissioners: s.234(4). A report under s.234(1) or (4) may, in particular, include such recommendations as the IPC considers appropriate about any matter relating to the functions of the Judicial Commissioners. The IPC is also required to make any report to the Prime Minister which the Prime Minister has requested: s.234(3).

Judicial Commissioners’ functions

The main relevant functions of Judicial Commissioners under the Act concern the giving of authorisations for warrants and notices issued by the Secretary of State in respect of

Under s.229(6)-(7), when exercising functions under the Act, a Judicial Commissioner must not act in a way that s/he considers to be contrary to the public interest or prejudicial to national security, the prevention or detection of serious crime or the economic well-being of the United Kingdom, and must in particular ensure that the Commissioner does not jeopardise the success of an intelligence, security or law enforcement operation, compromise the safety or security of those involved, or unduly impede the operational effectiveness of an intelligence service, police force, government department or Her Majesty’s forces. However, these general duties do not apply in relation to certain of the Judicial Commissioners’ functions, including deciding whether to approve the issue, modification or renewal of a warrant (s.229(8)(b)) and deciding whether to approve the grant, modification or renewal of a retention notice (s.229(8)(e)(i)).

Under s.235, the Judicial Commissioners have powers in relation to the carrying out of investigations, inspections and audits, including a power to obtain documents and information and to require assistance (including access to apparatus, systems, facilities and services) from “relevant persons”, including any person who holds (or has held) an office, rank or position with a public authority and any telecommunications or postal operator who is, has been or may become subject to a requirement imposed by virtue of the Act (s.235(7)).

The IPT

The Tribunal was established by s.65(1) of the Regulation of Investigatory Powers Act 2000 (“RIPA”). Members of the Tribunal must either hold or have held high judicial office or be a qualified lawyer of at least 7 years’ standing (§1(1) of Sch. 3 to RIPA). The President of the Tribunal must hold or have held high judicial office (§2(2) of Sch. 3 to RIPA).

The Tribunal has exclusive jurisdiction to consider claims under s.7(1)(a) of the HRA brought against any of the Intelligence Services or any other person in respect of any conduct, or proposed conduct, by or on behalf of any of the Intelligence Services (ss.65(2)(a), 65(3)(a) and 65(3)(b) of RIPA).

The Tribunal may also consider and determine any complaints by a person who is aggrieved by certain conduct42 which s/he believes to have taken place (in relation to him, to any of his property, to any communications sent by or to him, or intended for him, or to his use of any telecommunications service or system, and to have taken place in “challengeable circumstances” or to have been carried out by or on behalf of the intelligence services (ss.65(2)(b), 65(4) of RIPA). Conduct takes place in “challengeable circumstances” when either it is the conduct of a public authority and it takes place with the (purported) authority of (inter alia) a warrant under Pts 5, 6 or 7 of the 2016 Act, an authorisation or notice under Pt 3 of the 2016 Act, or a retention notice under Pt 4 of the 2016 Act, or the circumstances are such that it would not have been appropriate for the conduct to take place without at least

Any person, regardless of nationality, may bring a complaint to the Tribunal. The IPT considered the scope of its jurisdiction and the extent of the knowledge or evidence of the use of investigatory powers required to make a claim in Human Rights Watch v Secretary of State for Foreign and Commonwealth Affairs [2016] UKIPTrib_15_165-CH.

Complaints are investigated and then determined by the Tribunal “by applying the same principles as would be applied by a court on an application for judicial review” (s.67(3) of RIPA). S.68(6) of RIPA gives the Tribunal powers to order production of materials by, among others, every person holding office under the Crown. Further, under s.232(1) of the 2016 Act, a Judicial Commissioner must give the IPT all such documents, information and other assistance as the IPT may require in connection with the investigation,

Subject to any provision in its rules, the Tribunal may — at the conclusion of a claim — make any such award of compensation or other order as it thinks fit, including, but not limited to, an order quashing or cancelling warrants, authorisations, notices and directions given under the 2016 Act and an order requiring the destruction of any records of information which have been obtained in exercise of any power conferred by a warrant, authorisation or notice under the Act, or which are held by any public authority in relation to any person: s.67(7) of RIPA.

S.242 of the 2016 Act introduced a new s.67A of RIPA, which provided (for the first time) for a right of appeal on a point of law from final decisions of the IPT which are not procedural to the Court of Appeal. A decision of the Tribunal is subject to judicial review: R (Privacy International) v Investigatory Powers Tribunal [2019] UKSC 22.