Britain’s spy agencies violated the privacy rights of two foreign nationals living outside the UK as part of the UK’s programme of bulk surveillance, the European Court of Human Rights ruled.
The court upheld a complaint from an IT professional and a security and privacy researcher living outside the UK that GCHQ had breached their privacy rights under its bulk interception programme.
The ruling has established that the UK can be held accountable for breaches of human rights if it unlawfully spies on the electronic communications of people living outside the UK’s borders.
Joshua Wieder, a US based IT professional and Claudio Guarnieri an Italian privacy and security researcher based in Berlin, complained to the Strasbourg court that their privacy rights had been breached.
They made the complaint after the UK’s Investigatory Powers Tribunal refused to investigate their case, leaving them with no right of redress in the UK.
The human rights court found that, based on a ruling by the court in 2021, which found that GCHQ’s bulk surveillance regime had operated unlawfully, there had been a violation of Wieder and Guarnieri’s privacy rights.
Because their communications had been interfered with in the UK their rights to privacy also fell within the territorial jurisdiction of the UK, the court found.
Commenting on the case, Ilia Siatitsa, senior legal officer at campaign group, Privacy International, said the court’s ruling meant that States will be held accountable for surveillance beyond their borders.
“States can no longer assume digital surveillance comes without consequences or that they can evade accountability by targeting people outside their borders,” she said.
The ruling “emphatically underscores that security and intelligence agencies must be held responsible for the effects of their actions no matter where they occur,” she added.
Snowden revelations sparked compliant
Wieder and Guarnieri argued that their communications were unlawfully intercepted and accessed by UK intelligence agencies in a complaint submitted to the European Court of Human Rights in November 2016.
They made the allegations following revelations by whistleblower Edward Snowden over the extent of surveillance programmes run by the US National Security Agency and the UK’s GCHQ.
The complainants said they “reasonably believed” that their communications had been intercepted or processed by the UK intelligence agencies.
Wieder describes himself as an IT professional and independent researcher. According to his website, he identified malicious scripts embedded in leaked document from the defence contractor Stratfor, on the Wikileaks website.
Guarnieri has received bylines on two articles covering the Snowden papers, and the capabilities of GCHQ and the NSA published by the Intercept and Der Speigel.
The UK government claimed that Wieder and Guarnieri did not have a case before the European Court as they had failed to exhaust all the domestic remedies in the UK by failing to seek a judicial review of the Investigatory Powers Tribunal’s decision not to investigate their case.
The UK claimed that the interception of communications did not fall in the UK’s jurisdiction when either the sender or the recipient complaining about a breach of their privacy rights were outside the UK.
Wieder and Guarnieri claimed that there was no rational basis for the government’s arguments in view of the fact that the “proliferation of online communications had deprived national borders of their meaning”.
They were supported Media Defence, an international human rights organisation which presented written legal arguments.
Privacy violation occurred in UK
The court rejected the UK government’s arguments, finding that the applicants privacy had been breached in the UK, even though they were living overseas.
It drew an analogy between interference in peoples’ privacy rights through surveillance and interference of their personal property.
“It could not be seriously suggested that searching a persons home would fall out of jurisdiction if a person was abroad when the search took place,” it said.
The court found in a 35 page judgment that in the light of its ruling in Big Brother Watch and others v UK in 2001 there had been a breach of Wieder and Guarnieri’s privacy rights under Article 8 of the European Convention on Human Rights.
The Court found their communications had been interfered with in the UK and that their rights to privacy must also fall within the territorial jurisdiction of the UK.
The applicants made no claim for damage, stating that a public finding that the European Convention on Human Rights had been breached would be just satisfaction.
The court awarded them costs and expenses of €33,155 to be paid for by the UK government.