Privacy International v. The Commissioner for HM Revenue and Customs
August 2012
In August 2012, Privacy International began an investigation into Gamma International, a UK-based surveillance company that was exporting the invasive spyware FinFisher to repressive regimes with dismal human rights records.
After seeking more information regarding FinFisher's export from the UK government, the Department of Business Innovation and Skills confirmed to Privacy International in that products in Gamma’s ‘FinSpy’ suite of hacking software do fall within the scope of the UK’s export control regime. They informed the company of this fact on 2nd August 2012. Despite the fact that FinSpy had by that point been on the market for six years, and that companies are legally obliged to request export licence classifications, Gamma had only submitted a Control List Classification enquiry (CLC) asking the government whether or not they needed export licences for the product in July 2012.
Privacy International then submitted a 186-page dossier of evidence against Gamma to HM Revenue and Customs, the body responsible for overseeing the enforcement of exports regulations, and called for an investigation. Despite this overwhelming evidence, HMRC categorically refused to provide any details regarding any investigation into Gamma’s export practices, arguing it is statutorily barred from releasing information to victims or complainants. As a result, Privacy International filed for judicial review of HMRC's decision, arguing that the body acted unlawfully, either because it misconstrued the law to justify its evasive practices, or because it issued a blanket refusal without considering the facts of the case at hand.
The judicial review was heard in court in March 2014. In May 2014, the Administrative Court declared that HMRC acted unlawfully and “irrationally” in issuing blanket refusals into the status of any investigation into the potentially illegal export of the FinFisher. The decision marked a significant turning point in Privacy International's effort to bring transparency and accountability to the surveillance industry.
The ruling found that HMRC had committed a serious error in not providing information about whether it was investigating British company Gamma International for illegal exporting spyware to repressive regimes. Describing the actions of HMRC as “irrational” and “simply inconsistent with the legislation”, the judgment quashed HRMC’s decision and ordered it to again consider Privacy International’s request.
The judgment provides clear authority that the public is entitled to know what HMRC is doing to investigate and if appropriate prosecute companies that are sending dangerous surveillance technologies to countries where it is likely to be used for human rights abuses. It also establishes the important principle that NGOs and pressure groups such as Privacy International, just like the press, “act as guardians of the public conscience” and play a significant role in ensuring transparency and enforcing legal rights in court. As such, Mr Justice Green remarked, “the rationale which justifies the provision of information by HMRC to the press applies in large measure to disclosure of information to pressure groups and other NGOs”.