National Council for Civil Liberties, R (on the application of) v Secretary of State for the Home Department & Anor

The Court of Appeal considered wide-ranging challenges to Parts 3–7 of the Investigatory Powers Act 2016 under Articles 8 and 10 ECHR and under retained EU law. The court applied the framework developed in Big Brother Watch and carried out an "end-to-end" assessment of the statutory schemes and Codes of Practice. It concluded that, save for two limited matters, the statutory regimes as amended and accompanied by Codes provide a domestic-law basis, foreseeable rules and adequate safeguards against arbitrariness and abuse.

• Bulk interception (Part 6, Chapter 1): the "double-lock" (Secretary of State decision plus Judicial Commissioner approval), the requirement to specify operational purposes in warrants, and the Codes together afford adequate end-to-end safeguards for Article 8 and Article 10 purposes (including confidential journalistic material once the remedial amendments to s.154 are taken into account).
• Bulk acquisition of communications data (Part 6, Chapter 2) and retention/acquisition regimes (Parts 3–4): the courts held these regimes are not 'general and indiscriminate' retention within the meaning of retained EU law (Tele2/Watson) and that necessity, proportionality and judicial scrutiny provide adequate safeguards.
• Targeted equipment interference (Part 5) and bulk equipment interference (Part 6, Chapter 3): in general the statutory safeguards, prior Judicial Commissioner approval and Codes suffice; however the court remitted the specific question whether Chapter 3 as drafted provides adequate safeguards for protection of journalists' sources/confidential journalistic material, because the factual and evidential material about operation of bulk equipment interference powers was insufficient before the court.
• Bulk personal datasets (Part 7): Part 7 provides a detailed warrant regime (class and specific BPD warrants) with prior judicial authorisation, duration limits and handling safeguards and was held compatible with Articles 8 and 10. The court identified one discrete defect: safeguards for onward transfers of material from BPDs to overseas authorities were not contained in legislation, Codes or other publicly accessible instruments, and that lack of publicly accessible safeguards is not consistent with the "in accordance with the law" requirement under Article 8.
• Legally privileged material: the Act provides layered safeguards (senior official authorisation for selection criteria, IPC review and power to direct destruction or impose conditions) and these were sufficient in the court's view.
• Retained EU law (Charter/Directive): the court rejected arguments that Parts 3–6 and Part 7 amount to general and indiscriminate retention under Watson/Tele2; it also rejected arguments that Watson requires independent authorisation each time retained data is accessed, holding prior judicial approval of a warrant that governs retention and access satisfies that requirement.

The appellant, the National Council for Civil Liberties (Liberty), brought judicial-review challenges to Parts 3–7 of the Investigatory Powers Act 2016, arguing that the bulk and other investigatory powers were incompatible with Articles 8 and 10 ECHR and, when applicable, with retained EU law (including the e-Privacy Directive and the Charter). The claim followed multiple first-instance judgments by the Divisional Court on discrete issues: the first EU-law judgment ([2018] EWHC 975 (Admin)), the Convention judgment ([2019] EWHC 2057 (Admin)) and a later EU-law judgment ([2022] EWHC 1630 (Admin)). The litigation unfolded alongside and in the shadow of Strasbourg and CJEU jurisprudence, notably the Grand Chamber judgment in Big Brother Watch v United Kingdom, and CJEU authorities (Privacy International (C-623/17), Tele2/Watson and La Quadrature).

The appellant sought declarations of incompatibility and other relief, advancing multiple grounds: insufficient safeguards for confidential journalistic material and sources, lack of adequate constraints on selectors/search-terms and prior internal authorisation for 'strong selectors', inadequate safeguards against misuse and against transfers overseas, impermissible breadth of Part 7 bulk personal dataset powers, insufficient protection of lawyer-client privileged communications, incompatibility with retained EU law (including alleged 'general and indiscriminate' retention), and that failure to meet Convention requirements would also breach the Charter.

The Court of Appeal analysed the statutory text, the Interception / Bulk Acquisition / Equipment Interference / Bulk Personal Dataset / Communications Data Codes of Practice and the oversight structure (Investigatory Powers Commissioner, Judicial Commissioners and the Investigatory Powers Tribunal). The court emphasised the Act's "double-lock" for many warrants (Secretary of State decision plus prior Judicial Commissioner approval) and the detailed requirements for warrant applications (including specification of operational purposes and necessity/proportionality reasoning). The court applied the approach in Big Brother Watch: identify the stages of the bulk process, ask whether the domestic framework contains clear rules and adequate "end-to-end" safeguards, and examine actual supervision and remedies.

Reasoning on principal issues:

• Bulk interception (Part 6 Ch 1): the court found that the requirement to specify operational purposes in warrants, the Judicial Commissioner’s role in reviewing necessity and proportionality, Codes provisions, the restriction that selection criteria must not be referable to persons known to be in the British Islands, and the new remedial provisions for confidential journalistic material (amendment to s.154) together produce adequate safeguards. The court concluded the scheme is "in accordance with law" for Article 8 and Article 10 purposes.
• Bulk acquisition (Part 6 Ch 2) and Parts 3–4 (retention and authorisation for communications data): differences between content and communications data justified different but adequate safeguards; the court rejected the submission that the regimes effect 'general and indiscriminate' retention: retention powers are exercised via necessity/proportionality tests and judicial approval of retention notices/authorisations.
• Bulk equipment interference (Part 6 Ch 3) and Part 5 targeted equipment interference: the court considered statutory and Code safeguards adequate in general; but because of lack of evidence on how bulk equipment interference operates in practice, it remitted the question whether Chapter 3 provides adequate safeguards for journalists' sources/confidential journalistic material to the Divisional Court.
• Bulk personal datasets (Part 7): the court held the Part 7 warrant regime (class and specific warrants), duration limits and judicial oversight provide clear rules and safeguards; however, the court identified a discrete shortcoming: safeguards governing onward transfer of material from bulk personal datasets to overseas authorities are not contained in any legislation, Code or publicly available policy, and that lack of published safeguards is incompatible with the Article 8 "in accordance with law" requirement. The court invited submissions on remedy.
• Legally privileged material: statutory safeguards (senior-authorisation condition, IPC notification and power to direct destruction or impose conditions) were adequate; no general requirement for prior independent authorisation of the use of selection criteria was established by Strasbourg case law.
• Retained EU law: the court agreed with the Divisional Court that the Act does not permit general and indiscriminate retention of data (Tele2/Watson), and that prior Judicial Commissioner approval of the warrant regime satisfies the need for independent authorisation required by EU case-law.

Outcome: the Court dismissed the appeal overall, remitted the specific Chapter 3/journalists' sources issue to the Divisional Court for determination, and identified a remedial point (publication of safeguards for transfers from bulk personal datasets to overseas authorities) on which it invited written submissions.

Appeal dismissed. The Court of Appeal upheld the Divisional Court's overall conclusion that the challenged provisions of the Investigatory Powers Act 2016 are, with one discrete exception and subject to one remitted issue, compatible with Articles 8 and 10 ECHR and with retained EU law. Rationale: the Act, together with amended provisions (notably as to confidential journalistic material) and the Codes of Practice, establishes a domestic-law basis, foreseeable rules and sufficient "end-to-end" safeguards (including the Judicial Commissioner "double-lock", operational-purpose limits, necessity/proportionality assessments, duration limits, and oversight) to guard against arbitrariness in the bulk and related regimes. Two limited matters required further steps: (i) safeguards for transfers from bulk personal datasets to overseas authorities were not publicly available in statute, codes or policy (incompatible with Article 8) and the court invited submissions on remedy; and (ii) the question whether Part 6 Chapter 3 affords sufficient protection for journalists’ sources/confidential journalistic material in relation to communications obtained by bulk equipment interference warrants was remitted to the Divisional Court for determination due to lack of appropriate factual material before the Court of Appeal.

The claim originated in judicial-review proceedings in the Divisional Court (King's Bench Division). The Divisional Court handed down three principal decisions: the first EU-law judgment [2018] EWHC 975 (Admin) (Part 4/EU issues), the Convention judgment [2019] EWHC 2057 (Admin) (HRA/Convention issues) and a later EU-law judgment [2022] EWHC 1630 (Admin). Permission to appeal was granted in respect of multiple grounds on 22 July 2022 (EU-law grounds) and on 28 April 2022 (Convention grounds). The Court of Appeal heard the consolidated appeals and delivered this judgment ([2023] EWCA Civ 926) on 4 August 2023, dismissing the appeal subject to a limited remittal and a remedial point noted for written submissions.