Author: Asaf Lubin (JSD candidate, Yale Law School and Robert L. Bernstein International Human Rights Fellow with Privacy International)

In Part I of this blog I examined four of the most troubling elements of the new Investigatory Powers Act and their compatibility with IHRL. It is, however, important to note that the IPA is only one of several electronic communications surveillance laws that have been adopted in recent years, or are currently undergoing legislative processes, across Europe (one can particularly note adopted or pending legislation in Germany, France, Poland, Italy, Austria, Romania, Belgium, and Spain, to name a few examples). In this blog post, I suggest we look at the broader implications of the IPA on the landscape of regulation of espionage in international law.

Tinker, Tailor, Hacker, Spy: The IPA and the Law on Espionage

In his recent autobiography, The Pigeon Tunnel, John le Carré laments about the “British public’s collective submission to wholesale surveillance of dubious legality”. He argues that this type of concerted wilful surrender is the “envy of every spook in the free and unfree world”. Rarely do I find myself disagreeing with le Carré, but this is one of those cases. It is not just the British, but rather the general public, worldwide, that is supportive at worst or apathetic at best to the real prospect of a 1984-type Big Brother global surveillance scheme. The revelations surrounding the British American surveillance programs, as part of their successful collaboration within the broader 5-Eyes Intelligence Alliance, have clearly had ripple effects around the world.

These ripples are causing tectonic shifts within the “law on espionage”, as a distinct body of lex lata rules within the jus gentium. If in 2007 Prof. Radsan had recommended that Academia simply succumb to the idea that “espionage is beyond the law”, the last decade of political and legal developments are pushing away from this policy position. Both the advancements in technological capacities and the prevalence of leaks and whistleblowing, have forced parliaments, courts, academics, and the media, to face the spooks head on in a way they have never done before. As the activities of intelligence agencies, once draped with a cloak of secrecy, are moving further and further into the light, customary international law (dependent by its very nature on state practice to emerge) is slowly beginning to take shape.

We should thus look at the IPA not only from the narrow perspective of UK law, European law, or even international human rights law, but rather embark on an understanding of the broader role this Act plays in the evolution of the Law on Espionage. In this regard, let me conclude with three short brief comments.

1. The Right to Spy (The Jus Ad Explorationem)– I have written elsewhere that espionage should be recognized as a sovereign right under international law. There is room to suggest that the same processes and justifications that have limited the right to use force in the early 20^th century are now taking shape to limit certain aspects of the right to spy. In that regard particular emphasis has been given to economic espionage. In 2015 the United States and China reached a “common understanding” not to conduct or support cyber espionage and intellectual property theft for the purposes of commercial gain. Similarly, Germany legislated a prohibition on “economic espionage” as part of its October 2016 “Communications Intelligence Gathering Act”. According to wikileaks, Hilary Clinton’s Campaign Manager John Pdesta, in a policy brief on U.S.-German Surveillance relations concluded that “If Germany were to propose to the US a bilateral engagement to prohibit industrial espionage as the starting point for multi-lateral agreements or standards, the response from Washington would likely be positive.” In this regard how should we interpret the IPA which allows for foreign surveillance for the protection of the “economic well-being of the United Kingdom” or the French legislation which maintains that foreign surveillance may be conducted to advance the “economic, industrial, and scientific interests of France”. These pieces of legislation are exposing different approaches as to the justifications for the right to spy, and its limitations.
2. Intelligence Sharing– As part of the IPA the U.K. had the opportunity to engage in statutory authorization of its intelligence sharing arrangements with foreign agencies, which it declined to do. The Equivalent German law which was adopted two months before the IPA, did include, in a precedential way, three provisions authorizing and limiting certain aspects of German intelligence sharing operations. The pending 10 Human Rights NGOs Case, calls on the ECtHR to establish that the principle of legality requires States to establish the powers to engage in intelligence sharing as part of accessible and foreseeable primary legislation. This is important as significant abuse can take place in the form of “circular exchanges” that is a circumvention of domestic legislation through direct access to data bases or intelligence collaboration with foreign agencies. As Professor Forcese described it in the context of certain accusations that were made about the ECHELON program as early as the late 90s: “Since privacy laws tend to restrict states’ ability to monitor their own citizens but not those located in other countries, each state’s agency allegedly was asked to spy on the other state’s citizens and, presumably, share the results”.
3. Extraterritorial Enforcement Jurisdiction in International law– In conducting cross border interception and hacking activities, Government authorities are breaking away from one of the oldest tenants of international law, the presumption against extraterritorial enforcement jurisdiction. As the U.S. Third Restatement of Foreign Relations (1987) clarifies: “A state’s law enforcement officers may exercise their functions in the territory of another state only with the consent of the other state, given by duly authorized officials of that state”. Indeed, as early as the SS Lotus Case it was established that the enforcement jurisdiction of States to investigate, prosecute, or apprehend an offender extraterritorially is limited by the territorial sovereignty of the foreign State. Whereas the sending of spies across borders was generally perceived as a tolerable violation of the enforcement jurisdiction principle, within the broader operational code of the law on espionage, the introduction of mass electronic surveillance capabilities are tilting the scales. If in the old world order we put up with, as a necessary evil, the naturally limited intrusions of human spies, a different balance must be struck now once we developed the capacity to surveil whole populations remotely and covertly. Current state practice, as reflected in the IPA, is pushing in the other direction, however, and it becoming more normal to engage in unfettered mass global surveillance with few restrictions and few raised eyebrows. This should keep up anyone who dreads for the future of the rule of law and the right to privacy and freedom of expression.

 

Author: Asaf Lubin (JSD candidate, Yale Law School and Robert L. Bernstein International Human Rights Fellow with Privacy International)

Christmas came early for the UK Government Communications Headquarters (GCHQ). Wrapped in a red ribbon and sparkling with parcel lights, Parliament handed the signal intelligence agency a gift, the Investigatory Powers Act (IPA), providing it with a statutory authorization to engage in bulk interception and retention of electronic communications’ metadata and content, both within and outside the United Kingdom. Like last-minute shoppers running up and down the cramped stores of Oxford Street, so were the Lords in a hurry to complete the IPA’s legislative process before the new year, when the sun was to set on the previous legislation, the Regulation of Investigatory Powers Act (RIPA, 2000).

Since the IPA received royal assent and became an official Act on November 29^th 2016, the legal blogosphere and general media have been buzzing over this measure and its implications (see for example: here, here, here, here, and here). Particular attention has been given to the new law’s data retention provisions, which were struck down by the European Court of Justice earlier this week, forcing an impending legal headache for legislators. Nonetheless, a number of the Act’s most troubling features have not been sufficiently reviewed from the perspective of their compatibility with the United Kingdom’s broader international obligations. As we say Rest In Peace to RIPA and usher in a new age of legalized governmental mass surveillance, the following two blog posts will take a step back and examine the new Act’s compatibility with international human rights law (IHRL) as well as its impact on the ongoing evolution of the international law of espionage.

            Within the limits of this blog post I will focus on the following four elements of the Act: (a) Thematic Warrants and Lack of Reasonable Suspicion; (b) Foreign Mass Surveillance and Hacking Powers; (c) Standards on Encryption and Direct Access; and (d) Reporting, Notification Requirements, and Gag Orders.

What’s in Santa’s Stocking? GCHQ’s new surveillance powers and their compatibility with IHRL

a. Thematic Warrants and Lack of Reasonable Suspicion

While disguised as targeted surveillance, the IPA seeks to introduce into law “thematic warrants”. These warrants delegate to the police or intelligence agencies the choice as to whose privacy will be interfered with. This, in turn, increases the risk of arbitrary decision-making and undermines the implementation of effective judicial authorization. In accordance with the Act, the Secretary of State may issue a “targeted interception warrant” (for the acquisition of content of communications) or a “targeted equipment interference warrant” (for extracting information from devices either directly or remotely, via hacking tools). These warrants are subject to the approval of a Judicial Commissioner, barring urgent matters. The warrants allow communication within the United Kingdom to be intercepted and, equipment within the United Kingdom to be interfered with; insofar as these communications or equipment  relates to: (1) people or equipment “who share a common purpose or who carry on, or may carry on a particular activity”; (2) “more than one person or organization, or more than one set of premises, where the conduct authorized or required by the warrant is for the purposes of the same investigation or operation”; (3) “equipment that is being, or may be used, for the purposes of a particular activity or activities of a particular description”; (4) the testing, maintenance or development of capabilities relating to interception or equipment interference.

     As clarified in the explanatory notes, these subject matter expansions intended to encompass, “thematic warrants”. Under a thematic warrant, the Secretary of State and a Judicial Commissioner do not approve each individual target of surveillance, but rather the security agencies can choose their targets without additional sign off. To illustrate, a thematic warrant might authorize the hacking of all mobile phones of members of the Muslim faith in Birmingham, or the interception of the communications of anyone suspected of having travelled to Turkey in the last three months.

         As the Intelligence Services Commissioner points out “the critical thing … is that the submission and the warrant must be set out in a way which allows the Secretary of State to make the decision on necessity and proportionality”. However, permission for interception of communications and hacking of networks without prior reasonable suspicion is by its very nature disproportionate. In the case of Gillan and Quinton v United Kingdom, the European Court of Human Rights (ECtHR) expressed particular concern over an intrusive power that did not require any “reasonable suspicion” (in that case the power of random stop and search individuals under s44 of the Terrorism Act 2000). Such broad discretion gave rise to a “clear risk of arbitrariness”. In S and Marper v United Kingdom, the U.K. government submitted that the retention of DNA samples from people who had not been charged or convicted of a criminal offence was of “inestimable value” and produced “enormous” benefits in the fight against crime and terrorism. The Grand Chamber of the ECtHR nonetheless held that the retention was a “disproportionate interference” with those individuals’ private lives. Central to the reasoning was the absence of any assessment of suspicion by the authorities that was sufficient to justify the retention of each individual’s DNA data. The same reasoning applies in relation to thematic warrants under the IPA. More recently in Zakharov v. Russia the ECtHR reiterated the principle that the authorization of interception of communications “must clearly identify a specific person to be placed under surveillance or a single set of premises.

b. Foreign Mass Surveillance and Hacking Powers

Part 6 of the Act authorises  the GCHQ to engage in bulk interception, acquisition, and equipment interference of “overseas-related” communications and communications systems. These comprise communications “sent or received by individuals who are outside the British Islands”. In order for the Secretary of State to issue such a bulk warrant, the warrant must be considered necessary for : (1) the national security; (2) the prevention or detection of serious crime; (3) the economic well-being of the UK. At the next stage, the examination of any such acquired data may be authorized only for one or more of the operational purposes specified in the warrant. These may include, inter alia: counter terrorism, counter proliferation, countering hostile actors, safeguarding prosperity, cyber defence operations, security of agencies’ and allies’ operational capabilities, security assurances, and the tackling of serious crime.

          The issuing process is identical for each type of bulk warrants. First, the head of an intelligence service, or any official designated by her, must submit a request to the Secretary of State. The Secretary may then issue a bulk warrant, subject to a necessity and proportionality analysis. The decision to issue a warrant is then further scrutinized by a Judicial Commissioner, before it is granted. This is known, in the UK jargon as the “double lock mechanism” (a dual executive-judicial pre-authorization process for its foreign bulk warrants).

        In essence, the law explicitly authorizes the GCHQ to engage in bulk hacking of networks and devices and to intercept communications worldwide. While the UK has taken pride in solidifying the “double lock mechanism”, in actuality the law limits the scope of review by the Judicial Commissioners to mere procedural aspects. In other words, judges will not be given actual powers to assess the merits of any proposed surveillances measures. Moreover, in the case of bulk warrants, the authorization requests will be formulated in such broad and vague terms, that the attempt to form any judicial assessments on the merits of the application will prove essentially impossible.

       Legal institutions and judicial fora may hardly be said to have fully resolved the question of what standards should apply to foreign governmental surveillance. For instance, this issue has not been sufficiently addressed by the ECtHR; although a ground-breaking pending case launched by Privacy International alongside nine other human rights NGOs invites the Court to clarify this matter specifically. The Human Rights Committee in its Concluding Observations to South Africa did note that State Parties should refrain from “engaging in mass surveillance of private communications without prior judicial authorization”. Similarly, certain Special Rapporteurs, such as Ben Emmerson, have already concluded that “the very existence of mass surveillance programmes constitutes a potentially disproportionate interference with the right to privacy” and that “shortly put, it is incompatible with existing concepts of privacy for States to collect all communications or metadata all the time indiscriminately.

c. Standards on Encryption and Direct Access

The IPA allows the Secretary of State to issue a “technical capability notice” in order to compel an operator to provide government officials with direct access to its network apparatus. Moreover, under such notices, the Secretary of State may further compel an operator to decrypt intercepted communications. The issuance of such a notice is subject to a necessity and proportionality test, which is [to be]/will be conducted by a Judicial Commissioner. Amongst other factors, the Secretary of State must further take into account the technical feasibility and likely costs of the request. Should the Judicial Commissioner refuse to approve the notice, the Secretary of State may appeal to the IP Commissioner so as to approve the notice nonetheless.

        It is on this point that the ECtHR, in Zakharov v. Russia, affirmed that “a system…which enables the secret services and the police to intercept directly the communications of each and every citizen without requiring them to show an interception authorisation to the communications service provider…is particularly prone to abuse.” It is in this context that providing government officials with direct and complete access to communications networks run by private corporate providers, is unlikely to comply with the standards of necessity and proportionality. Furthermore, as noted by the U.N. Special Rapporteur David Kaye, “national laws should recognize that individuals are free to protect the privacy of their digital communications by using encryption technology and tools that allow anonymity online… States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows.”

    The IPA, as currently drafted, does not give sufficient weight to factors against decryption. Such factors include: the importance of maintaining the integrity of networks, potential cybersecurity threats, the reputational costs for companies, and chilling effects on expression and creativity of users. By ignoring these issues, the law lacks balance and could open the door to a UK version of Apple v. FBI (which concerned the question of whether US Courts could compel manufacturers to assist in unlocking cell phones whose data are cryptographically protected).

d. Reporting and Notification Requirements

In conformity with the IPA, an individual subjected to surveillance would be informed by the IP Commissioner only when such surveillance involved a “serious error” or concerned the “public interest”. Further, the Act establishes a general reporting requirement, whereby at the end of each calendar year the IP Commissioner must report to the Prime Minister (PM) of/on the way the functions of the Judicial Commissioner have been carried out. While by default this report is to become part of public record, the PM may order otherwise. Thus, should the PM consider the publication of parts of the report as: contrary to public interest or prejudicial to – national security, the economic well-being of the State, the continued discharge of functions of public authority, or the prevention or detection of serious crime, she can decide, in consultation with the IP Commissioner, to exclude from publication those parts of the report. This is not the only way the Act leaves certain information out of the public eye. Notably, any warrants issued to a telecom company or service provider, demanding direct access to its networks or decrypt its users’ data, will be followed/accompanied by a gagging order, “forbidding the firm from discussing it” essentially squashing public debate and scrutiny.

   Independent oversight mechanisms ensuring transparency and accountability of State surveillance communications have been recognised as necessary to guarantee privacy and data protection rights. The lack of a strict reporting requirement in the IPA, due, in part, to the broad range of [security/self-judging] exceptions the Act prescribed, brings into question the degree to which transparency and accountability can effectively be achieved. Additionally, the Act only provides for notification to individuals in cases of identifiable “error”. However, as the ECtHR has affirmed, States have an obligation to provide notification to persons concerned by/with the used measure. To be sure, according to this jurisprudence, notification is due not just in cases of abuse, but rather immediately following the termination of the measures assuming “it can be made without jeopardizing the purpose of the surveillance.” Furthermore, the UN High Commissioner for Human Rights further acknowledged that notification is fundamental in ensuring individuals access to effective remedy. Under the current IPA it is unlikely that individuals will have the opportunity to seek redress where their privacy rights have been violated.

Author: Daniella Lock (PhD student at UCL Faculty of Laws). The original post was published on Just Security on 30 November 2016. 

What was formerly known as the Investigatory Powers Bill, referred to elsewhere as the “revised Snoopers’ Charter,” has received Royal Assent and, as of Nov. 29, is officially law in the UK. The Act (full text here) does introduce additional safeguards, as well as a new body of oversight and the involvement of judges in the authorization of surveillance warrants. However, the broad range of surveillance powers available to the British Government, which were exposed by the Snowden leaks, have not been scaled back but further entrenched within British law. This is despite consistent pleas to reduce the powers by parliamentarians, legal practitioners and legal NGOs, and amendments having been made to the Act by both Houses of Parliament.

The Not So New Powers 

The government’s powers exposed by the Snowden leaks were the subject of widespread fear and shock, and they will be further consolidated by this new legislation. The surveillance powers that the Act will now explicitly enshrine in law include: targeted and bulk hacking powers; bulk interception of communications (provided for under the previous UK surveillance regime); access to bulk personal datasets (BPDs); and the acquisition of communications data, both targeted and bulk, which involves the retention of web history logs (known as “Internet Connection Records”). The Act also provides for the use of thematic warrants in relation to targeted surveillance powers. These warrants, equated with general warrants in a previous Just Security post by Scarlet Kim, have the potential to be very broad in scope and may be used against “a group of persons who share a common purpose or who carry on, or may carry on a particular activity.”

All of these far-reaching surveillance powers existed in one form or other prior to the Act. However, many of them were only avowed by the UK Government in the aftermath of the Snowden leaks. For example, engagement in the bulk acquisition of communications data by the security services was first admitted in November 2015, when the then-Home Secretary, Theresa May, informed Parliament that communications data was being obtained in bulk from Communication Service Providers under the authority of the Telecommunications Act 1984. The use of hacking powers was acknowledged by the UK government through the publication of the Draft Equipment Interference Code of Practicepublished in February 2015 (containing, admittedly, unclear distinctions between bulk and targeted powers). The use of thematic warrants and BPDs were publicly avowed for the first time in March 2015 in a report by the Intelligence and Security Committee (the Parliamentary committee appointed to oversee the work of the UK’s security services). 

The Passage of the Act 

Many were hoping to prevent or obstruct the UK Government in its consolidation of these extensive powers. Since the Act was first published in bill form, there has been rigorous engagement with its provisions by legal practitioners, legal NGOs as well as tech companies. When the Act was published in draft form in November 2015 last year, over 1,500 pages of written evidence were submitted to the Joint Committee responsible for scrutinizing the bill. Written evidence was then submitted throughout the year. Legal NGOs and legal practitioners made recommendations calling for many of the powers either to be removed or subjected to much greater restriction. For example, Liberty calledfor a removal of all bulk powers contained in the bill, and the barrister (and Reader at University College London) Dr. Tom Hickman called for the scope of thematic warrants to be greatly reduced.

Official scrutiny of the Act was primarily undertaken by the Joint Committee for the Investigatory Powers Act and the Intelligence and Security Committee (ISC), who both wrote reports in response to the draft bill. These reports also conveyed skepticism about certain powers contained in the bill. For example, the  ISC expressed uncertainty over the need for bulk hacking powers, and the Joint Committee stated that it was not clear that the bulk powers of interception and hacking were compliant with the UK’s obligations under the European Convention on Human Rights.

Partly in response to concerns such as these, the government called for a review of bulk powers by the Independent Review of Terrorism Legislation. The publication of the review report was discussed in a previous blog post by Shaheed Fatima Q.C. The Independent Reviewer concluded in the report that there was a “proven operational case” with respect to three of the bulk powers which were “already in use.” These powers were bulk interception, bulk acquisition (of communications data) and BPDs. At the time of the review, the Independent Reviewer had been told by the UK’s Government Communications Headquarters (GCHQ) they had not so far engaged in bulk hacking. With regards to this power, it was found that there was a “distinct, but not yet proven, operational case” for it.

While the conclusions of the review were welcomed by the UK government, they were not accepted across the board and opposition to the reach of surveillance powers in the bill remained.  Liberty criticized the scope of the review, arguing that its lack of consideration of the necessity and proportionality of bulk powers meant that the most important question regarding their use had gone unanswered. It also criticized the short time-frame for the review, citing the lack of time that had been available for those carrying out the review to consult experts in the field. It also highlighted that no operational case with regards to internet connection records had been made, and it claimed that this power should be removed from the bill.

Despite determined efforts by many to oppose the powers in the bill, only fairly minor changes were made to them during its passage. For example, restrictions were added to class warrants for BPDs, the examination of material obtained under bulk warrant and additional safeguards were added with respect to accessing journalistic material and legally privileged material.

Changes the Act Makes to the UK Surveillance Regime as a Whole 

For those less familiar with the provisions contained in the Act, it should be noted that at the same time as ensuring the same breadth of surveillance powers are available to the government, it also introduces a new authorization process for these powers and new safeguards and body of oversight.

With respect to the authorization process, there is now a mechanism by which judges, called Judicial Commissioners, will be involved in the decision-making process for the issuing of surveillance warrants—a mechanism described as the “Double-Lock.” Judicial Commissioners will be required to approve warrants initially issued by the Secretary of State before they can be fully authorized.

A new oversight body will be set up, which merges previously existing oversight bodies. The body will be made up of an Investigatory Powers Commissioner and a group of Judicial Commissioners. It will keep under review the exercise of statutory functions by public authorities provided for in the Act. Furthermore, as stated, Judicial Commissioners will also be involved in the authorization process for surveillance warrants.

Insofar as these additions to the UK surveillance regime serve to impose robust limitations on the UK government’s use of its surveillance powers, they are clearly welcome. However, the extent to which they will impose robust limitations has been a matter of debate. One issue of controversy is that the Act expressly states that the Judicial Commissioners are to apply judicial review principles when reviewing the Secretary of State’s decision. As was discussed in an earlier blog post by Shaheed Fatima Q.C, there may still be potential for Judicial Commissioners to undertake substantive and meaningful review of the Secretary of State’s decision despite this constraint. However, this remains to be seen.

Furthermore, there are a number of other factors that may serve to constrain the Judicial Commissioners, highlighted here by Lord David Pannick, which are not acknowledged in the Act. For example, there is no clause in the Act which provides that the Judicial Commissioner would have access to all of the same information on the basis of which the Secretary of State made their decision. There is also no provision in the Act to ensure that Judicial Commissioners will be able to access a special advocate to assist them in their decision-making. Concerns have also been raised about the fact that this same oversight body, responsible for providing oversight with regards to the UK surveillance regime, is also responsible for approving surveillance warrants.

Initial Concerns with UK Surveillance Powers Still Stand 

While it is not clear how robust these restrictions will be, what is clear is that the Act does not reduce the powers available to the government. And ultimately, many of the concerns that were initially voiced about the Act still stand. For example, the problems discussed in the blog post by Scarlet Kim, in connection with the expansive hacking powers and use of thematic warrants, remain. The concerns regarding justifiability of access to Internet Connection Records, discussed in a blog post by Shaheed Fatima Q.C, are as relevant as they were last year.

Due to the extensive surveillance powers that the Act provides for, it is still not clear whether the new regime will be compliant with standards set by international law. This was expressly stated by the UN Special Rapporteur when he delivered his first report to the UN Human Rights Council in March this year. The Special Rapporteur argued that the provisions in the Act “prima facie fail the benchmarks” set in recent case law by the European Court of Human Rights (ECtHR) and the Court of Justice of the European Union (CJEU).

This view is at least plausible. As was highlighted in an earlier blog post by Carly Nyst, the ECtHR has, in the cases of Zakharov v Russia (Grand Chamber) and Szabó and Vissy v Hungary, recently emphasized the need for human rights law principles to be “enhanced” to take into account States’ increased appetite for “massive monitoring of communications.” In the case of Zakharov, it was also emphasized that interceptions must:

“clearly identify a specific person to be placed under surveillance or a single set of premises as the premises in respect of which authorization is ordered. Such information may be made by names, addresses, telephone numbers or other relevant information.”

Some have taken such commentary by the Court to be a sign that the ECtHR may be willing to take issue with the Act. Indeed, in a memorandum on surveillance and oversight mechanisms in the UK published in May, the Council of Europe Commissioner for Human Rights cited “major human rights concerns” over the then Bill. Of particular interest in the memorandum was a reference made to suggestions by surveillance experts that “the sheer breadth of a bulk warrant may have difficulties” against the “clear standard” quoted above, as set out in Zakharov. The Commissioner also commented that:

“by their nature bulk warrants place large groups of people under the menace of surveillance without any suspicion on the part of the authorities that an individual has committed a criminal offence or is of national security interest.”

Provisions in the Act may also come into conflict with certain standards set by the CJEU. The UK will be required to adhere to these standards for at least the next few years, even if the UK manages to begin the process of leaving the Union early next year.  The key issue will be the Act’s provisions on data retention. Recent decisions—such as in the joined cases of Digital Rights Ireland and Seitlinger as well in the case of Schrems —suggest that the CJEU is willing to take a more hardline approach with respect to data retention. Furthermore, in July 2016 the Advocate General of the Court of Justice published his opinion on the Tom Watson (and formerly David Davis) case, regarding the lawfulness of the UK’s Data Retention and Investigatory Powers Act 2014 (DRIPA). The Advocate General stated in his opinion that data retention should only be lawful for the purpose of investigating serious crime. This opinion is not binding, and a lot depends on what the CJEU rules in relation to DRIPA early next year. However, it may be that the provisions for data retention in the Act, which allow for data to be retained on the basis of a broad range of purposes—including for the purposes of “public health” and “assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department”—may be incompatible with EU standards.

Looking to the Future 

Legal NGOs have made it clear that they intend to challenge the Act on its compliance with international law. Liberty’s response to the passing of the Act by Parliament couldn’t have been clearer. They stated: “[t]he fight does not end here. Our message to Government: see you in Court.”

There are already challenges relevant to the Act underway. For example, Privacy International and five internet and communications providers have lodged an appeal in the ECtHR challenging the UK Government’s hacking powers (under the previous regime). An application by Big Brother Watch regarding bulk interception and intelligence sharing (under the old regime) is also waiting to be heard in Strasbourg. Many legal challenges to be made directly against the Act once it becomes law are no doubt being currently drafted.

Some will be relieved that, for now, the “fight” is not completely over. However, it seems like a sad reflection of the current state of British law-making that an Act like this could be passed in its current form, with the best chance of opposing its most questionable provisions apparently lying in the ability of pro bono lawyers to challenge it in courts.

People will point to a variety of factors to explain how we got here. One factor which has undoubtedly played a role, which other countries who may face similar legislation can hopefully learn from, is timing. It has taken just over nine months for the Act to pass through Parliament. This is an undeniably brief period of time for an Act which, at the time of being introduced to Parliament, was almost 250 pages of complex legal provisions, accompanied by 19 “overarching documents“ many of which were over a 100 pages long. The then Bill was over 300 pages long on leaving the Lords’ report stage. Nine months is insufficient time to subject so many complex provisions to proper scrutiny. Many parliamentarians would barely have had time to get their head around the implications of the first few chapters of the bill, let alone all of its nine long and technical separate parts.  The government was warned that it was “not in the nation’s interest” to pass the Act this year, when over a 100 cross-party lawmakers and campaigners signed a letter calling for a longer consultation period to “give the Bill the time it needs.”

The letter reminded the government that the new law “could lead the world” if it was done right. Indeed, this new legislation was a big opportunity to wipe the slate clean after the Snowden leaks, and to help rebuild trust in the UK government and its surveillance practices. However, the UK government has chosen to push through a law which may well be seen as only serving to enhance distrust: for it consolidates far-reaching surveillance powers which many think should never have been relied upon in the first place.

By Alexander Shea (Barrister in Training; MPhil International Relations, Oxford; BA History, LSE First Class Hons)

Last October (14 October 2015), a ‘Negligence and Damages’ Bill was introduced into Parliament. A Private Members’ Bill (PMB) sponsored by the backbench Labour MP, Andy McDonald, the Bill challenges an entrenched hierarchy in the law whereby damages for physical injury inflicted through the negligence of a third party are easier to obtain than if those injuries are psychological.

In challenging this hierarchy, the Bill reflects changing attitudes towards mental health in Britain. A 2015 survey of 1,734 adults conducted by the King’s College London Institute for Psychiatry, Psychology and Neuroscience in conjunction with the mental health charity MIND, found that ninety-one percent of Brits agree that mental illness merits increased recognition within society. British workers are also now more willing than before to disclose their own mental health conditions. As documented in The Department for Health’s annual Health Survey England report, a report that interviews ten thousand Britons each year to identify changes to their lifestyle and outlook on health, between 2003 and 2008 alone the prevailing attitude toward mental illness amongst the British populace reversed course. Whereas in 2003, respondents suggested that the overwhelming stigma attached to mental health meant they would be likely to ‘hide away’ any problems they might have, by 2008 respondents argued that they were increasingly expressing feelings attached to even low and moderate stress with friends and family. This change in attitude was seen amongst individuals from a variety of occupational sectors, from teachers to bankers, right through to the military.

Despite these changes, a historical lag exists between evolving social attitudes and case law. Whilst attitudes toward mental health are changing on a yearly basis, the referent point underpinning the law’s approach to psychological injury is still found in 1989 and the events of Hillsborough (the ‘Hillsborough Disaster’; see here for additional background). The Hillsborough Disaster refers to the event of 15 April 1989 when a human crush occurred in the Leppings Lane stand of Hillsborough Stadium in Sheffield, during an F.A. Cup  semi-final  between Liverpool and Nottingham Forest. The events resulted in 96 fatalities and over 760 injured.

Hillsborough was the worst disaster in British sporting history. It was also an event, however, that brought to a head a series of social tensions then at work within Britain- tensions that drove to the heart of mental health’s status under the law and made Hillsborough a key event in determining legal precedent. To understand this, it is important to appreciate that the aftermath of Hillsborough was played out amongst society in an acutely psychological fashion as a clash of competing media narratives and accusations. The visceral imagery, stories and trauma of the day became the subject of an acrimonious debate between the South Yorkshire Police Force, which suggested that the footage and photographs of the day indicated that drunken, ticketless fans were responsible for the crush, and the victims and their families who countered that the evidence pointed to police negligence as precipitating the crush. Hillsborough now a public scandal and with the Taylor Inquiry of 1990 broadcasting to the nation haunting stills, photographs and witness testimony of the day, the mental trauma of Hillsborough as an event rather than a mere site of physical injury became apparent to all.

As the Taylor Inquiry soon laid bare that it was police negligence that triggered the crush, and worse that the police had orchestrated a cover-up to conceal their responsibility for events and shift the blame onto football supporters, the police was encouraged to issue an apology. The Taylor Inquiry noted that the police’s position had exacerbated the mental suffering of survivors and families in both demonising Liverpool fans and denying the police’s own role in events.

Hillsborough is remembered primarily for the physical injuries it saw. Often overlooked, however, is that it also inflicted psychological damage. Family members who were seated in different sections of the stadium to their loved ones watched helplessly as the crush developed in the lower tier of the Leppings Lane stand. Broadcast live on television and radio, the trauma was transmitted directly to thousands who had family at the game. Hours after waving away family members, next of kin identified their bodies.

Many witnesses to such events developed post-traumatic stress disorder (PTSD). This PTSD was not always the result of being overwhelmed by one exceptionally traumatic event, such as identifying a loved one’s body. For many, the trauma accumulated in more gradual fashion, consequent, for example, to the daily moral attrition of coming home each night to a newly-handicapped spouse.

Hillsborough thus lay at the intersection of three developments that made the question of mental injury central to any legal analysis of it. First, the event itself was lived as a traumatic event of visceral images and sounds by those who witnessed it. Second, it was processed in a uniquely psychological manner in a clash of media narratives centred around claims of drunken, thuggish football fans. Third, it evolved at a time when mental illness was receiving increasing consideration under the law. Following Parliament’s passing of the 1974 Jurors Act and the 1983 Mental Health Act, English and Welsh common law was forced to consider mental illness as a legal category unto itself that would require its own set of case law. Hillsborough thus came at a time of ‘legal awakening’ with regard to mental illness, even if the courts’ first judgements in this area were not particularly liberal. These three developments combined, Hillsborough was to be a seminal event in legal history, the moment when case law would have to confront the question of psychiatric injury.

In the 1991 case of Alcock v Chief Constable of South Yorkshire Police [1991] UKHL 5, ten claimants sought damages for the mental injuries they incurred following Hillsborough. They made their claims as ‘secondary victims’ of that day’s event. None had been present in pens 3 and 4 of the Leppings Lane stand where the crush occurred. Their relation to the event was thus not primary, in that they were not the ones in imminent danger of being crushed. Instead they were indirect victims. Their injury was the result of processing the harm that had been inflicted on their loved ones.

Two of the claimants were at the match.  Both suffered emotional distress after seeing the crush from adjacent stands whilst knowing their brothers were in the Leppings Lower. Another claimant fell ill after identifying her son’s body just eight hours after watching him leave home. Further claimants were traumatised via television or radio, mediums that conveyed the danger their loved ones were in.

The claims of all ten were dismissed. To understand why is to understand the anachronism of today’s case law.

Providing judgement, Lord Oliver outlined four cumulative criterion that set an extremely high benchmark for any claim to succeed. Termed the ‘Alcock Principles’, to qualify for damages, a victim of mental injury sustained after witnessing harm brought upon a loved one through the negligence of a third party must:

1. Have a relationship of love and affection with the primary victim
2. Have direct perception of the event with unaided senses
3. Have proximity to the event or its immediate aftermath
4. Experience psychological injury via a single nervous shock.

“A relationship of love and affection” was presumed to exist only between parent and child and spouses.  Claimants who lost siblings, grandchildren, or others therefore were excluded.

The second clause disqualified the witnessing of events via television or radio. The UKHL judges argued that experiencing events in this mediated fashion was less traumatic as it encouraged disassociation.

‘Direct perception of the event’ meant the claimant must have actually seen their family member be injured amongst the crowd. Witnessing a crush and presuming a loved one was injured was not enough.

The third criterion reinforced the ruling’s restrictive ethos. Proximity was whether one’s injury occurred close enough in time to the event, to be determined arbitrarily by the judges. The eight hours that expired before the mother identified her son were deemed excessive.

This may appear rather odd to the layman.  When the Hillsborough Disaster is referred to as an ‘event,’ what comes to mind is a chain of developments that progressed inexorably from one to another. The massing of fans prior to kick-off, the scrambling over fencing for survival, family members arriving at mortuaries – all these constitute a single time-lapse of eight to ten hours that we consider to represent a discrete event.

In contrast, the judges interpreted the notion of an ‘event’ rather differently. Rather than accept that an event could refer to a series of interconnected developments that spun over a number of hours, the judges argued that an event could only ever refer to a single incident that occurred at a single moment in time and which must be isolated from the developments that preceded and followed it.  The judges limited police liability solely to the exact moment when the trampling of bodies occurred. Where this is the elucidation of ‘event’, damages would be awarded only to those whose psychological injuries happened at this precise time.  This excluded victims whose mental injury was sustained cumulatively. As Lord Oliver noted in his judgement, excluded was:

“psychiatric illness caused by the accumulation of gradual assaults on the nervous system.”

Often, psychological injury, its ‘flashbacks’ and symptoms only emerge cumulatively months after the event at a pace the patient can tolerate. Alcock therefore advanced a legally neat principle. But it is one that is discriminatory.

Furthermore, experiencing an event via radio or television does not safeguard from mental illness. As Amit Pinchevski notes in a 2015 article, we have known since the 1960’s that individuals develop PTSD via broadcasts. Jennifer Ahern has documented the thousands of cases of PTSD amongst those who watched 9/11 on television. Similarly, drone pilots (operators) whose active participation of the battlefield is mediated by screens nevertheless develop intense trauma (see more on this point here, here, and here).

Emphasis on direct perception of events is arbitrary. A series of cases such as Wild v Southend NHS Trust (2014) EWHC 4053 (QB) have failed due to the claimants’ trauma stemming from the mental realization of the death of a loved one rather than the direct perceiving of the death itself. In Wild, the claimant’s appeal was dismissed because it was impossible for him to have directly seen the in utero death of his stillborn child. That learning the shocking fact of the death of a loved one- as long as one does not see it- is deemed acceptable by the law is clearly unjust.

The Negligence and Damages Bill provides a corrective to Alcock. The Bill extends the relationships presumed to involve a “close tie of love and affection,” enshrines a duty of care for psychiatric wellbeing covering both sudden and gradual nervous shock and removes the requirement of proximity. However, despite having initially been scheduled to have its second reading debate in Parliament on the 22^nd of January 2016, the Bill has yet to resurface in Parliament.

This is less to do with the Bill’s inadequacies as it is to do with what the chair of the House of Commons’ Procedure Committee, Charles Walker MP, has described as a “corrupt” and “shambolic” system when it comes to hearing Private Members Bills (PMBs) in Parliament. Walker has described how ’98 percent’ of PMBs are actually “government handout bills,” outsourced to backbench MPs with full departmental support and the promise of sufficient Parliamentary time so that they reach statute. This allows the government the flexibility to make amendments to its legislative agenda, or disassociate itself from more controversial proposals that it nevertheless wishes to see discussed. The result of such practices, however, is that items such as the Negligence and Damages Bill are pushed down the agenda.  When due to reappear in Parliament on the 22^nd of January, the Bill was listed behind eight other PMBs that were accorded priority over it. The result was there was little chance that the Bill’s second reading would be heard. The identical scenario produced itself on the 16^th of April 2016 when the Bill was once again up for second reading. The 2015-2016 parliamentary year thus reached its end without the Bill receiving a ‘carry over’ motion for it to continue to receive consideration in the 2016-2017 sitting. For all intents and purposes therefore, the Bill has been shelved.

Theresa May has promised a government that will work not for the few, but for the many. Changes in public attitudes towards the mentally ill mean that the latter are no longer treated as a group apart from society, but rather as an increasingly recognised part of the body politic. If May really wishes to lay claim to the social interventionist legacy of the Victorian reformer Joseph Chamberlain, she would be well advised to address one of the law’s most entrenched injustices. It is time that the mentally injured are recognised by our courts.

 

Article 50

The procedural requirements for withdrawing from the EU are determined by Article 50 of the Treaty of Lisbon. For present purposes the relevant part of the provision reads as follows:

Article 50

1. Any Member State may decide to withdraw from the Union in accordance with its own constitutional requirements.
2. A Member State which decides to withdraw shall notify the European Council of its intention. […]

The procedure for withdrawal adopts a two-step process for getting the ball rolling: Article 50(1) decision and subsequent Article 50(2) notification. According to the ordinary meaning of Article 50, the constitutional requirement only applies in relation to the decision, not to notification. Barber et al. elide the two provisions under the heading of an Article 50 ‘declaration’ and appear to question the constitutionality of notification. While there may also be constitutional issues in relation to notification, for the strict purposes of Article 50 these are irrelevant. Thus, a constitutionally valid decision followed by an unconstitutional (perhaps ultra vires) notification could still satisfy Article 50. This is the case under the rules of international law which holds the State responsible for acts performed by its agents under apparent authority even if they are unlawful under domestic law (see Articles 3, 7, Articles on Responsibility of State for Internationally Wrongful Acts; Articles 7, 46, 47, Vienna Convention on the Law of Treaties; and, inter alia, dicta in Treatment of Polish Nationals case, pp.24-5 and ELSI case, para.73; further see Ewan Smith).

The pressing question is, therefore, whether the referendum was a decision to withdraw ‘in accordance with [our] constitutional requirements’.

‘Plainly wrong?’

Common-sense dictates that the referendum, in response to a specific question on whether the UK should leave/remain in the EU, constitutes a decision to withdraw from the EU. Richard Ekins makes the point (outside the context of Article 50): ‘Parliament made clear that the decision about whether to leave the EU was to be settled by referendum’.

Elliott’s response is to concede that the referendum was a ‘decision’ but that not a ‘“decision” for the purpose of Article 50’. Elliott reasons that

‘[t]his is so because the referendum – legally speaking – was purely advisory. The legislation that allowed the referendum to take place did not invest the outcome of the referendum with any sort of legal effect. The UK Government is therefore not legally obliged by the referendum to trigger the Article 50 process, either at any particular point in time or at all.’

In support of his argument, Elliott might have cited the difference between the EU Referendum Act 2015, which says nothing of its legal effect, and the AV Referendum Act 2011, which had certain self-executing effects and engendered a legal obligation on the executive to perform specific acts. On Elliott’s view, a referendum is only binding in the latter case.

Except that this argument is flawed. As a matter of domestic law, there is no need for a referendum to have self-executing effects for it to be a decision to withdraw. Could the executive now decide to remain? Such a decision would seem to render the 2015 Act nugatory. If Parliament delegated the decision to the electorate, this would suggest that it has removed the power to decide from the executive (cf. Laker Airways Ltd. v Department for Trade [1977] 1 QB 643).

The issue is what Parliament intended when enacting the 2015 Act. It seems a common-sense construction that Parliament intended to give the decision over whether we withdraw to the electorate. Moreover, a glance at Hansard will find no reference to ‘advisory’ but reveals repeated statements about giving the people the ‘final say’. The Foreign Secretary, Philip Hammond MP, presented the Bill to Parliament in the following terms: “whether we favour being in or out, we surely should all be able to agree on the simple principle that the decision about our membership should be taken by the British people not by Whitehall bureaucrats, certainly not by Brussels bureaucrats; not even by Government Ministers or parliamentarians in this Chamber. The decision must be for the common sense of the British people.”

That the absence of express terms as to the legal effect of a referendum result can nevertheless produce a legally effective decision is also supported by persuasive Supreme Court authority. In Moohan v Lord Advocate [2014] UKSC 267, the court was faced with a human rights challenge to the franchise for the Scottish Referendum. Like the 2015 Act, the Scottish Referendum Act 2013 contained no express term as to its legal effect. One of the arguments put to the Supreme Court was that the referendum was ‘purely consultative’ as a result. Lord Kerr rejected this, stating at [72]-[73]:

Both the United Kingdom and Scottish governments had agreed that the result of the referendum would be binding […]

Similarly Lord Wilson stated on the same question (at [91]):

[it] could not be said of the Scottish referendum [that it was ‘purely consultative’].

These statements contradict Elliott’s assertion and fatally undermine the case that it is impossible for the referendum to satisfy Article 50(1) simply because it does not state its legal effect on its face. Instead there is a good case for saying that Parliament intended that the referendum was a decision for the purpose of Article 50. The only power left to the executive, therefore, is when to leave the EU, not whether to do so.

Is it a reversible decision?

If the argument above is correct, this does not entail that the decision as a matter of domestic law is so binding that it is irreversible. It is trite law that Parliament cannot be bound by the decision. Parliamentary sovereignty vests Parliament with the power to overturn any decision (even notwithstanding that it had been taken by a previous Parliament) (see Lord Neuberger at [46]-[47] in Moohan) even if doing so might be ‘far-fetched’ (per Lord Wilson at [91]; cp. dictum of Lord Sankey LC in British Coal Corporation v King [1935] AC 500, p.520).

The question must instead be over whether the decision is reversible under Article 50. There is an argument to be had, beyond the scope of this post, over whether the process for withdrawal following notification is reversible. The question here is: whether the withdrawal decision is reversible prior to notification?

Article 50(2) says that the state ‘shall notify’ which at first glance might appear to create a binding obligation once the decision is made to issue the notification, suggesting that the decision is irreversible for the purposes of Article 50. However the term is more ambiguous than it first appears (see also Professor Besselink’s post). The two main purposes of Article 50(2) notification are that (1) notification obliges the EU to negotiate a withdrawal agreement with the departing state; (2) it enables the departing state to leave after two years without the agreement of other states (Article 50(3)). As a matter of general international law, a state who decided to withdraw from a treaty would ordinarily be unable to do so except by agreement with the other treaty parties (Articles 54-6 VCLT). Therefore, Articles 50(2)-(3) enable the withdrawing state to force the issue; in this respect, the notification procedure exists for the benefit of the withdrawing state.

A teleological interpretation would suggest that Article 50(2) ought not to be read so as make the decision irreversible. It would defeat the purpose of the sovereign right of unilateral withdrawal if Article 50 were read so as to enable the EU to force a state, which has changed its mind prior to initiating the withdrawal process, to leave the EU.

Conclusion

To say that the referendum result is obviously not a decision to leave the EU for the purposes of Article 50 seems untenable. It is an arguable proposition, both in principle and as a matter of authority that Article 50(1) has been satisfied by the referendum result and the UK could now issue a notification under Article 50(2) that could result in the UK leaving the EU by 2018. But as a matter of both domestic and EU law, until that notification is served, Parliament retains the power to keep us in the EU, no matter how politically ‘far-fetched’.