THE QUEEN (on the application of NATIONAL COUNCIL FOR CIVIL LIBERTIES (LIBERTY)) v SECRETARY OF STATE FOR THE HOME DEPARTMENT & Anor

This Divisional Court considered the remaining retained EU law challenges to provisions of the Investigatory Powers Act 2016 (IPA), principally Parts 3 and 4 (communications data) and the bulk powers in Parts 5, 6 and 7. The court applied retained CJEU jurisprudence (notably Privacy International and La Quadrature) and the EU Charter together with relevant ECtHR authority (Big Brother Watch) as part of the domestic legal framework in these proceedings.

The court rejected challenges that Parts 3 and 4 require notification to persons affected, that accessed data must be retained within the EU/UK, and that the IPA fails to meet the CJEU requirements concerning automated processing (including the non-discrimination point from La Quadrature). However, the court held that Part 3 is incompatible with retained EU law to the extent that section 61 permits internal (non-independent) authorisation by security and intelligence agencies to access retained communications data for the “applicable crime purpose” without prior independent review; the CJEU’s requirement for prior review by a court or independent administrative body applies to such access outside the national security context and cannot be satisfied by internal authorisation. The claim otherwise failed and the court adjourned consideration of remedies.

This judicial review (third procedural stage) concerned whether various powers in the Investigatory Powers Act 2016 are compatible with retained EU law (including the e-Privacy Directive and the EU Charter) and related legal principles carried over after the UK left the EU. The Claimant sought declarations of incompatibility and related relief in respect of Parts 3 and 4 (retention and acquisition of communications data) and Parts 5-7 (bulk powers).

Background and parties: The proceedings began in 2017 and this Court had previously given two judgments dealing with other aspects of the IPA ([2018] EWHC 975 (Admin) and [2019] EWHC 2057 (Admin)). The Claimant relied on CJEU judgments delivered prior to the end of the UK implementation period (notably Privacy International and La Quadrature) and on the ECtHR Grand Chamber judgment in Big Brother Watch. The Defendants were the Home Secretary and the Foreign Secretary.

Nature of the application: Judicial review of the compatibility of IPA provisions with retained EU law and related obligations under the EU Charter and e-Privacy Directive; relief sought included declarations of incompatibility and consequential orders.

Issues framed: (i) Whether Parts 3 and 4 breach retained EU law as to notification to persons affected by access to data; (ii) whether data accessed must be retained within the EU/UK; (iii) whether automated processing safeguards required by La Quadrature are met; (iv) whether prior independent authorisation is required outside national security for access to retained data; (v) whether bulk powers (Parts 5-7) fall within EU law and meet EU law safeguards; and (vi) the effect of Big Brother Watch.

Reasoning and conclusions: The court held that notification to affected persons is not required as an additional general obligation by EU law given the IPA safeguards (the Investigatory Powers Commissioner Office/OCDA, the Investigatory Powers Tribunal, the Code of Practice and section 231) and ECtHR authority accepting that effective remedies can exist without routine notification. The court accepted that Watson CJEU and related retained case law remain binding where applicable, but read Watson consistently with EU data protection law so that there is no absolute requirement that retained data be kept within the EU/UK when transfers are subject to adequate safeguards (eg, Data Protection Act 2018 and UK adequacy findings). The court found Part 3 authorisation and safeguards adequate as to automated processing and most other matters. Critically, however, the court concluded that section 61’s internal authorisation by security and intelligence agencies for the ‘applicable crime purpose’ is incompatible with retained EU law because it avoids prior independent review required by Watson where the function is for fighting crime rather than national security. The court rejected the Claimant’s challenges to bulk powers (Parts 5-7) under EU law, explaining that Part 7 falls outside the e-Privacy Directive scope and that the overall IPA safeguards for bulk warrants satisfy EU-law like requirements. The court also explained why it would not apply the ECtHR Grand Chamber judgment in Big Brother Watch to produce additional EU-law based obligations beyond those it derived from retained CJEU case law.

The court granted the Claimant success on the single discrete point (the incompatibility of section 61 in the described respect), dismissed the other EU-law grounds, and adjourned consideration of remedies and any consequential applications.

The claim is allowed in part. The court held that Part 3 read with Part 4 of the IPA is incompatible with retained EU law to the extent that section 61 permits internal (non-independent) authorisation by security and intelligence agencies to obtain access to communications data for the “applicable crime purpose” without prior independent review; that departure from the Watson CJEU requirement could not be justified. All other challenges on the EU-law grounds (notification, retention within EU/UK, automated processing safeguards, and the bulk powers in Parts 5-7) were dismissed for the reasons given: retained EU case law and domestic safeguards were sufficient or the provision fell outside the scope of EU law. The court adjourned remedies for written submissions.

These proceedings were commenced 28 February 2017 and have been litigated in stages before this Court. This Court gave earlier judgments on related issues: the first-stage EU-law judgment on Part 4 ([2018] EWHC 975 (Admin); [2019] QB 481) and a second-stage judgment on ECHR issues including an application for a section 4 HRA declaration ([2019] EWHC 2057 (Admin); [2020] 1 WLR 243). Permission to appeal in respect of the 2019 judgment was later granted in part and an appeal is pending in the Court of Appeal. The present decision resolves the remaining retained EU law issues and adjoins a remedies hearing (directions given for further written submissions).