State Surveillance and Data Privacy: What Now?
It’s hard to believe that the Snowden Files were leaked some five years ago. Despite the passing of time, and the seismic happenings in world politics, the fallout rumbles on – as last week’s ruling against GCHQ demonstrates.
Although hailed by privacy campaigners as a “landmark judgement”, in turn vindicating Snowden’s whistleblowing, the ruling relates to the UK’s surveillance system that existed in 2013.
Given that new legislation is now in place, what impact will this ruling actually have – and should we still be concerned about government snooping?
‘RIPA, DRIPA and IPA’ are shorthands for the various laws that have governed state surveillance since 2000.
RIPA – the Regulation of Investigatory Powers Act 2000 – is the framework under which GCHQ conducted its mass surveillance programme, as exposed by Snowden.
It is therefore the basis of the recent ruling by the Human Rights Court in Strasbourg, last week.
Given the digital advancements of the previous decade, by 2013, many in law enforcement considered RIPA to be outdated and inadequate – an alleged hindrance to their ability to monitor the communications of suspected terrorists.
However, an attempt by then home secretary Theresa May to introduce a new law granting even wider surveillance powers – the Communications Data Bill, the first incarnation of the so called ‘Snooper’s Charter’ – was unsuccessful, blocked by coalition partners the Liberal Democrats.
What followed was a piece of emergency legislation known as “DRIPA” (The Data Retention and Investigatory Powers Act), which was passed in 2014. Although it expired in 2016, the Court of Appeal has since ruled that its remit also breached human rights law.
That leaves the Investigatory Powers Act (“IPA”), the current law governing, and authorising, the Government’s surveillance system. It came into force in December 2016, despite opposition from privacy campaigners.
Although the ruling of the Human Rights Court relates to RIPA, the old framework, many of the principles apply to the current IPA – a law described as “even more intrusive” by the likes of Amnesty, Liberty and Big Brother Watch.
Their concerns include, sweeping retention powers, bulk interception and hacking powers and bulk datasets, which are explained in more detail below.
The IPA allows ministers to issue ‘retention notices’ to communication companies and service providers, requiring their retention of our communications data (when, where, how and with whom we’re communicating) for up to 12 months. This includes records of our internet browsing history – the websites we visit, although not individual webpages.
Controversially, this data can be obtained by public authorities for reasons unrelated to the prevention of serious crime – for example, to collect taxes and fines. Authorisation by an independent person, such as a judge, isn’t required.
Liberty has already succeeded in challenging this part of IPA; in April 2018, the High Court ruled that such widesweeping, and unchecked, retention powers violated the right to privacy. In doing so, it echoed the Court of Appeal’s previous criticism of DRIPA.
As well as targeted snooping, the IPA allows ‘bulk warrants’ to be granted.
These give the state access to our communications en masse – this is done either by intercepting them directly during transmission or by forcing communication companies to hand swathes of data over.
A bulk warrant can also be given to authorise the widespread hacking of our electronic devices.
These warrants can only be granted to the UK’s intelligence agencies, upon the approval of both a minister and judge, and – in the case of interception and hacking warrants – only for the purpose of revealing the content of data going to, or coming from, abroad.
