GCHQ violated privacy rights with mass data interception, European court rules

However, the decision to operate such scheme did not itself breach the European convention on human rights, it says

The grand chamber of the European Court of Human Rights (ECHR) ruled on Tuesday that the Britain's spy agency Government Communications Headquarters (GCHQ) violated fundamental human rights by intercepting and processing vast amounts of people's private online communications.

The court said in its ruling that the regime for bulk data collection was unlawful, although it noted that the decision to operate such scheme did not itself breach the European convention on human rights.

The court also found that the spy agency's processes for sharing digital intelligence with foreign agencies were not illegal.

The case challenging the government's bulk interception regime was brought in 2013 by civil liberties groups, including Big Brother Watch, Amnesty International and Liberty.

It followed NSA whistle-blower Edward Snowden's revelation that the GCHQ was secretly intercepting and harvesting the private communications of millions of people on a daily basis, through secret Tempora programme.

The campaigners complained that the spy agency's mass surveillance regime was unnecessary and did not follow due process.

The British government argued in the court that bulk interception was necessary for national security and that it had enabled law-enforcement agencies to uncover serious threats to the country.

The government also said that the earlier law that allowed GCHQ bulk interception of communication had since been replaced by 2016 Investigatory Powers Act (IPA), providing greater oversight.

In a landmark 5-2 decision in 2018, the ECHR ruled that mass spying regime did "not meet the 'quality of law' requirement" and was "incapable of keeping the 'interference' to what is 'necessary in a democratic society'".

A 6-1 vote also saw the court rule that the UK's regime for obtaining communications data from service providers "was not in accordance with the law".

In Tuesday's judgement, the grand chamber of ECHR said: "In order to minimise the risk of the bulk interception power being abused, the court considers that the process must be subject to 'end-to-end safeguards', meaning that, at the domestic level, an assessment should be made at each stage of the process of the necessity and proportionality of the measures being taken; that bulk interception should be subject to independent authorisation at the outset, when the object and scope of the operation are being defined; and that the operation should be subject to supervision and independent ex post facto (retrospective) review."

Commenting on the ruling, Liberty's lawyer Megan Goulding said that mass surveillance powers allow governments to collect data that can reveal a lot of confidential information about any individual, such as their "political views" or "sexual orientation".

"Today's decision takes us another step closer to scrapping these dangerous, oppressive surveillance powers, and ensuring our rights are protected," Goulding said, according to The Guardian.

The group said that the latest decision would allow Liberty's challenge to the IPA to proceed in the British courts, which had been stayed pending the chamber's decision.

A government spokesman said that Britain has one of the most transparent oversight regimes for the protection of personal data across the world, setting a new benchmark for how the law can protect both privacy and security at the same time.

Notably, ECHR's ruling come about two months after Wired reported that two internet providers in the UK were secretly testing a surveillance tool that could collect the web browsing history of all internet users in the country.

The report alleged that the unnamed ISPs were conducting the tests in association with the National Crime Agency, as part of a Home Office exercise, and that the purpose of the exercise was to determine if it's possible to roll out a bulk surveillance system on a country-wide scale, for the purpose of law enforcement and national security.

A spokesperson for the Investigatory Powers Commissioner's Office (IPCO) confirmed the trials and said that the IPCO conducts regular reviews to ensure the data collected remains 'necessary and proportionate'.