Press Notice: Unprecedented Opportunity For PI To Cross Examine GCHQ In Open Court
Hearing: Cross examination of senior GCHQ official about Intelligence Agencies’ use of massive databases of information about everyone in the UK
When: Monday 26 February 2018, 3.15pm
Where: Royal Courts of Justice, Court 28, Strand, London WC2A 2LL
Summary
This is the first time GCHQ have given open evidence in the Investigatory Powers Tribunal (The Tribunal). It is also the first time they will be cross examined by Privacy International on serious misleading errors they provided in evidence to the Tribunal in relation to databases that contain information on all of us, ranging from our health records through to our bank accounts.
This is an open hearing.
Background to the case
The challenge to the acquisition, use, retention, disclosure, storage and deletion of ‘Bulk Personal Datasets’ (BPDs) and Bulk Communications Data (BCDs) by the UK Intelligence Agencies was commenced by Privacy International on 10 September 2015. The existence of the BPD and BCD regimes was initially secret. The BPD regimes was first publicly acknowledged in March 2015, and the BCD regime in November 2015. Until this case, there was no public knowledge that GCHQ was gathering information about all of us through a wide range of databases that they requisition from a wide range of telecommunications operators, companies and public bodies.
On 17 October 2016 the Investigatory Powers Tribunal held that the Intelligence Agencies had breached Article 8(2) of the European Convention of Human Rights in respect of both the BPD and BCD regimes, from their commencement over a decade earlier, until their public avowal in 2015. The Tribunal held that, during this period, there was not sufficient foreseeability or accessibility of the existence of the BPD and BCD regimes, nor of the nature of controls over them; in consequence, the regimes could not be said to be “in accordance with the law.”
A number of outstanding issues remained with subsequent hearings in June 2017 and October 2017.
The June 2017 hearing concerned whether the regimes were in compliance with EU law. On this matter, on 8 September 2017, the Investigatory Powers Tribunal decided to refer questions to the Court of Justice of the European Union concerning the collection of BCD by the Security Intelligence Agencies from mobile network operators.
Proceedings and evidence submitted at the October 2017 hearing will be the subject of the cross-examination of the GCHQ witness on Monday.
The misleading evidence
In October 2017 a hearing took place to determine four issues including the legality sharing of BCD and BPD with private companies. The adequacy of safeguards governing the sharing of data from the Agencies to commercial companies and industry partners were examined. Evidence was served on these issues including witness statements from GCHQ which showed earlier evidence served by this witness contained serious misleading errors, including who can access these databases.
What are BDPs and BCDs?
Bulk Personal Datasets (BPDs) and Bulk Communications Data (BCDs) are intrusive and comprehensive databases and datasets of information about all of us. These datasets contain personal data about individuals, the majority of whom are unlikely to be of intelligence interest. Current BPDs held by the Agencies include social media data**, bulk travel data, bulk untargeted communications metadata, anonymised financial records, databases obtained by hacking and internet network management data and logs***. BCD’s are acquired under s.94 Telecommunications Act 1984, and include the “who, when, where and how” of both telephone and internet use and the subsequent use of this data. Current BCD collection includes location information and call data for everyone’s mobile telephones in the UK for 1 year****.
Supplementary information
Privacy International successfully applied for permission to cross-examine the GCHQ witness regarding errors in GCHQ witness evidence provided during this litigation. In agreeing to the cross-examination, the Tribunal has noted its concern that the GCHQ witness has had to make a number of corrections to his earlier statements in relation to s.94 directions*.
The cross-examination relates to evidence and submissions raised at the hearing in October 2017 which concerned:
- The adequacy of safeguards governing the transfer of data from the Intelligence Agencies to commercial companies / industry partners;
- Whether s.94 Directions for GCHQ are worded such as to delegate the power to request BCD, and the form of BCD requested, to the Director of GCHQ or any person so authorised by him to make relevant directions;
- Following the Tribunal’s judgment that s.94 Directions made before avowal were ultra vires (i.e. void), whether collecting BCD became lawful not upon avowal, but when revised s.94 Directions were issued on 14 October 2016 (after the judgment had been provided to the parties in draft).
For more information please contact camilla@privacyinternational.org
- ENDS-
Notes
All disclosure and documents can be found here: https://privacyinternational.org/legal-proceedings/bulk-personal-datasets-bulk-communications-data-challenge
*section 94 Directions refers to directions issued under section 94 Telecommunications Act 1984 requiring telecommunications operators to provide BCD to the Agencies in bulk.
**http://www.bbc.co.uk/news/technology-41651840
****Amended Security Service Witness Statement, §§25 and 130
October 2016 judgment: https://privacyinternational.org/legal-case-instance/1135/bpdbcd-judgment-october-2016
Reference to CJEU: https://privacyinternational.org/legal-case-instance/1134/bpdbcd-reference-cjeu