• United States



Senior Writer

Tribunal rules MI5 acted unlawfully when retaining intercepted personal data

Jan 31, 20234 mins

A panel of three judges has ruled that “widespread corporate failure” led to the UK spy agency and the Home Office not taking its legislative obligations for data retention seriously.

Can your employer spy on your iPhone or Android phone?
Credit: Thinkstock

An independent tribunal has ruled that UK spy agency, MI5, unlawfully kept people’s intercepted data for almost five years, and condemned “serious failings in compliance” and “unlawful” collection of information from as far back as 2014.

The ruling relates to a lawsuit filed in January 2020 by data privacy organisations Privacy International and Liberty, which sued the intelligence agency over its mass surveillance practices, resulting in the case being brought before the Investigatory Powers Tribunal (IPT).

The IPT is an independent panel of judges that hears complaints about surveillance carried out by public bodies. It was established in 2000 by the Regulation of Investigatory Powers Act (RIPA) and replaced the Interception of Communications Tribunal, the Security Service Tribunal, and the Intelligence Services Tribunal.

The lawsuit at the centre of this most recent judgement focuses around the powers granted by the security services under the RIPA and the Investigatory Powers Act (IPA), also known as the Snooper’s Charter.

The RIPA is concerned with the regulation of surveillance and other intelligence gathering by public authorities, providing a statutory framework that is consistent with the Human Rights Act 1998 and the European Convention on Human Rights.

The IPA addresses the extent to which certain investigatory powers may be used to and provides a statutory framework for the lawful  interception of communications, equipment interference and the acquisition and retention of communications data.

The aim of RIPA and the IPA is to provide a balance between preserving people’s right to privacy and enabling enforcement agencies to gather evidence for effective enforcement action, meaning that under these laws, there are certain restrictions around how the data should be handled.

In a statement on Liberty’s website outlining its case, the watchdog argued that the safeguards in the Snoopers’ Charter are insufficient to protect UK citizens’ rights and that MI5 and the Home Office were not taking its legislative obligations around the handling of data seriously.

“Under current powers, any communication we make, even the data we just store on our phones, can be collected, saved and used against us. MI5 and the Home Office’s failings violate everybody’s right to privacy and freedom of expression,” the statement read.

In its ruling on January 30, the IPT said that there were “serious failings in compliance with the statutory obligations of MI5 from late 2014 onwards, and those failings ought to have been addressed urgently by the management board [of MI5].”

From late 2014 until April 2019, the tribunal found that MI5 unlawfully held large amounts of data because at least one of the agency’s technology systems lacked proper retention, review and deletion (RRD) safeguards, but failed to disclose this to the Home Office or the Investigatory Powers Commission.

Tribunal cites government failure to investigate MI5

It also ruled that the Home Office, and numerous Home secretaries, had overlooked and failed to investigate MI5’s breaches, instead continuing to issue bulk surveillance warrants despite having information that indicated that MI5 was acting unlawfully from as early as 2016.

The judges said the failings were a result of “widespread corporate failure,” but added that it would be “unfair to single out individuals who have been identified in these proceedings” as a source of blame.

Megan Goulding, a lawyer at Liberty, said the organisation was pleased with the tribunal’s findings.

“For years, MI5 knowingly broke the rules and failed to report it, the internal oversight body did not detect it and the Government failed to investigate clear red flags,” she said. “Instead, the Home Office continued to issue unlawful warrants, and MI5 kept information from the authorities about it mishandling our data.”

Goulding added that the “so-called safeguards are totally ineffective” in protecting citizens’ rights and holding those in power to account. “Now is the time for the Government to step up and create restrictions that protect our privacy rights,” she said.

A spokesperson for the Home Office said: “MI5 consistently work to a high standard in challenging circumstances and treat the protection of personal information with the utmost seriousness. Substantial action has been taken over a number of years to address the concerns raised in this case.

“We accept the judgment delivered and will continue to drive forward work to ensure we and our partners remain fully compliant with the law.”