On 16 May 2016, the Investigatory Powers Tribunal, which was established under the Regulation of Investigatory Powers Act 2000 (RIPA) and provides oversight of public authorities in the United Kingdom (UK), released its decision in Human Rights Watch & Others v The Secretary of State for the Foreign & Commonwealth Office & Others (HRW v Secretary of State). The applicants claimed that UK public authorities unlawfully intercepted, stored and used their information and communications, thereby interfering with their right to respect for private and family life, and their right to freedom of expression, as guaranteed under the European Convention on Human Rights (ECHR). This post will examine the Tribunal’s decision, and offer some suggestions relevant for consideration should further claims be made to challenge the Tribunal’s decision. There is no possibility of an appeal against the Tribunal’s decision, but complainants can take claims further to the European Court of Human Rights (ECtHR), and these issues have been laid out in light of that possibility.
In its decision, the Tribunal differentiated between those applicants who were resident in the UK, and those applicants who were not, at any material time, resident in the UK. In this case, ‘residence’ is used as a proxy for physical presence. With regards to applicants who were resident in the UK, the Tribunal implicitly acknowledged its jurisdiction but dismissed their claims as frivolous and unsustainable unless further submissions are provided (see para 64 of the decision). As for the other applicants who were not, at any material time, resident (or present) in the UK, the Tribunal concluded that the UK did not have jurisdiction over them and that as they did not claim to enjoy a private life in the UK, the UK has no obligation to secure their rights. The Tribunal’s decision rests on an assumption that individuals have to be physically present in UK territory for it to have jurisdiction, and it used residency to determine the physical location of the individual. In effect, the Tribunal rejected its jurisdiction over applicants who were not physically present in the UK at the time of the alleged interference, and so rejected the possibility of extraterritorial jurisdiction in relation to surveillance activities.
As Marko Milanovic has discussed, the Tribunal’s determination that those situated outside of the UK do not fall within its jurisdiction and, accordingly, do not enjoy rights under the ECHR, rests on an over-reliance on Bankovic v Belgium and a conservative view of the case law. In Scarlet Kim’s scrutiny of the Tribunal’s decision, she provided a sketch of the context to the judgment and suggested that jurisdictional issues are at the heart of the dispute, highlighting that this requires analysis of the jurisdictional issues arising when interference is conducted remotely. Indeed, the decision did not adequately address the key jurisdictional questions, namely:
- Can interference with communications give rise to jurisdiction?
- How meaningful are territorial boundaries given the distributed architecture of our communications networks?
- Does the location of the affected individual matter for determining jurisdiction if the interference was conducted by UK public authorities?
Communications on the Internet are deliberately distributed throughout the network; this is a feature intended to ensure that the Internet can still function, even if part of the infrastructure is disabled. In practice, this means that communications frequently pass through (a number of) third States en route to their destination. Even when the two entities communicating are in the same State, routing through third States may occur. This architectural feature of the Internet means that communications that merely pass through a State should not necessarily concern that State. However, it is suggested that this mere transmission of information must be distinguished from communications that a State (in this case the UK) actively interferes with, i.e. through collection, storage, amalgamation, or analysis. This distinction is not clearly drawn in the Tribunal’s decision. As will be discussed below, the critical factor is that a State interferes with a communication, and thus with an individual’s human rights (such as the right to privacy). In this regard the place of interference is largely irrelevant, as it is the individual’s rights that are of concern. Accordingly, if the individual is within the State, the question is one of territorial jurisdiction. If the individual is outside the territory of the State, the question is one of extraterritorial jurisdiction.
As covert surveillance conducted by State intelligence agencies (or other entities) pose a range of dangers, it is important (for the ECtHR or other human rights bodies) to clarify the applicability of extraterritorial human rights obligations to prevent a protection gap and a negation of human rights.
State jurisdiction is primarily based on the principle of territoriality. However, as States (and their agents) frequently engage in acts outside their territory, it has become increasingly recognised that acts of State agents abroad may give rise to extraterritorial jurisdiction. The determination of jurisdiction does not necessarily depend on the location of an individual vis-à-vis the State, but rather, on the exercise of authority and control of the State over the individual.
As it stands, the case law of the ECtHR has not established a clear answer regarding the potential applicability of the ECHR to extraterritorial electronic communications surveillance. However, there appears to be a trend towards the recognition that extraterritorial jurisdiction can be established under certain circumstances. This post will highlight how the ECtHR has done so, and what relevant obligations apply under the ECHR as a result.
Al-Skeini v UK was a landmark judgment on the extraterritorial application of international human rights law. In Al-Skeini, the ECtHR recognised two forms of extraterritorial jurisdiction – (1) State agent authority and control, and (2) effective control over an area. For the purposes of this post, only the former is relevant.
Extraterritorial jurisdiction on the basis of State agent authority and control occurs when State agents’ acts establishing authority and control are performed, or produce effects, outside the State’s own territory (see Al-Skeini, para 131). This State agent authority and control does not, however, result in the applicability of the full spectrum of human rights law obligations. Instead, extraterritorial obligations are contextual, ‘divided and tailored’ such that only those rights relevant to the situation of the individual are applicable. The exercise of State agent authority and control over certain rights of the individual results in jurisdiction thereto, and consequently obligations under international human rights law in relation to those rights.
State agent authority and control is most clearly demonstrated in detention operations where physical authority and control is exercised. This may occur either in formal detention centers (such as in Al-Skeini, where the detention of the applicant by British forces and his death in British-controlled facilities engaged the UK’s responsibilities under the ECHR), or outside formal detention centres (such as in Öcalan v Turkey, where the applicant was detained by Turkish security forces in Kenya, effectively bringing him under Turkish authority and jurisdiction).
However, the ECtHR has developed that reasoning further and recognised that extraterritorial jurisdiction on the basis of State agent authority and control is not restricted to situations where State agents have physical custody of individuals. For example, in Jaloud v the Netherlands, Mr Azhar Sabah Jaloud died when his vehicle was fired at whilst passing through a checkpoint manned by personnel under the command and direct supervision of a Netherlands Royal Army officer. Despite not having physical custody of Mr Jaloud, the Dutch agents exercised authority and control over his right to life as he passed through the checkpoint they manned. This gave rise to extraterritorial jurisdiction and, thereby, ‘divided and tailored’ obligations, in particular with respect to the right to life.
Another example is the case of Pad v Turkey. Although this case was declared inadmissible due to the failure to exhaust domestic remedies, it is important to consider it together with the reasoning relating to extraterritorial jurisdiction adopted in Jaloud, as it offers an insight into how the European Court may address issues of authority and control. The Court held that Turkey exercised jurisdiction because the victims were killed by fire discharged from a Turkish helicopter. This meant that the physical proximity between the State agents and the affected individual was not critical. Instead, the effective exercise of authority and control over the individuals’ right to life, even remotely, established the extraterritorial jurisdiction. This effective exercise of authority and control over their right to life could have amounted to a violation, should the case have been admissible.
It appears that the ECtHR is moving towards an understanding that exercising authority and control over an individual’s rights gives rise to extraterritorial jurisdiction and obligations in relation to those affected rights. Jurisdiction in this regard is not based on a tenuous connection with distant effects. It is based on the actual exercise of authority and control.
Scope of jurisdictional obligations in the context of extraterritorial surveillance?
In the present case, the allegations relate not only to communications that are simply passing through the UK, but the applicants also claim that the UK has intercepted, stored, and used their information and communications. If the UK has intercepted, stored or used the data of those individuals who are not in the country, the State has effectively exercised authority and control over the affected individuals’ right to privacy (see Shimovolos v Russia, para 65; Maximillian Schrems v Data Protection Commissioner, para 94). Carly Nyst has suggested that such a situation can be determined as an interference-based jurisdiction over the right to privacy. As previously established, this exercise of jurisdiction gives rise to the State’s extraterritorial obligations in so far as the affected rights are concerned.
ECHR Article 8 states that ‘Everyone has the right to respect for his private and family life, his home and his correspondence’. Liberty v UK clarified that ‘telephone, facsimile and e-mail communications are covered by the notions of ‘private life’ and ‘correspondence’ within the meaning of Article 8’ (para 56). Furthermore, in the digital age, not only is content information relevant to the protection of the right to privacy, but communications data (or metadata) can also allow very precise conclusions to be drawn about private lives, as the European Court of Justice has affirmed in Digital Rights Ireland v Minister for Communications (para 27), and Copland v UK (para 43). Communications data is distinct from communications content, but is equally relevant to the issue of the right to privacy in the digital age.
The ECtHR has also clarified that the following can constitute an interference with the right to private and family life: (1) The collection and storage of personal information (including telephone, email and Internet usage), without the knowledge of the individuals whose information is being collected and stored (Copland v UK, para 44); and (2) regardless of whether the personal data is subsequently used, the ‘mere storing of data relating to the private life of an individual’ (S. and Marper v UK, para 67).
It has been established that the interception of the content of communications and/or of communications data is an exercise of authority and control over an individual’s right to privacy, capable of giving rise to extraterritorial jurisdiction. Indeed, if extraterritorial jurisdiction is not established, there is a risk that intelligence agencies may exploit this gap to circumvent Convention protections through the use of intelligence sharing arrangements. Effectively, if extraterritorial jurisdictional obligations do not apply, and as a result international human rights safeguards are not in place, it circumvents existing limits on domestic surveillance and renders affected individuals without an avenue of redress (since they cannot claim against the interfering State or their territorial State).
The ECtHR has made it clear that collecting and storing personal data about individuals amounts to an interference with the right to privacy. Such interference with individual communications is an exercise of authority and control by the interfering State over the affected individual, and thus gives rise to jurisdiction. Should this extraterritorial jurisdiction be disputed and dismissed, it permits States that are interfering with communications to do so without subjecting them to international human rights law obligations and the safeguards prescribed therein, which is undesirable to say the least.
Disclaimer: The views expressed herein are the author(s) alone.