Big brother may continue watching you

On 13 September 2018, more than five years after Edward Snowden revealed the existence of electronic (mass) surveillance programmes run by the intelligence services of the United States of America and the United Kingdom, the European Court of Human Rights (‘ECtHR’) found two UK data collection regimes – one of which will not be discussed here – to violate Article 8 of the ECHR. A third one, being part of the information sharing arrangements between these so-called “Five Eyes” countries was, on the contrary, considered to involve a justified interference with the right to respect for private life While the long-awaited Big Brother Watch and Others v. UK judgment, which joined three actions, signifies another victory for civil liberties and privacy advocating non-profit organisations and activists – no less than 16 being the applicants in this case – some serious matters of concern remain. Indeed, the ECtHR did not regard a number of the most intrusive aspects of these highly contested surveillance practices to be problematic: interception of communications and related communications data in bulk continues to be possible (both by intelligence and law enforcement authorities) and information gathered by the US’s National Security Agency (‘NSA’) under its infamous PRISM and Upstream programmes can still lawfully be requested and further processed by the UK’s Government Communications Headquarters (‘GCHQ’). A comparison with relevant case-law of the Court of Justice of the European Union (‘CJEU’), who has, in a number of landmark judgments relating to surveillance by government authorities (i.e. Digital Rights Ireland, Schrems, Tele2 Sverige and Opinion 1/15), set rather high privacy and data protection standards, will help to put this judgment into perspective: the extensive safeguards established in Luxembourg should remain the point of reference within Europe. Strasbourg should not be lowering these thresholds instead. While it is true that the cases before the CJEU all concerned the processing of personal data for law enforcement purposes, the cited case-law is nevertheless relevant in the context of the assessment of secret surveillance conducted by intelligence services. Despite a recent formal contestation of the Court of Justice’s competences in that regard, it is clear from its decision in Schrems, in which it invalidated the Safe Harbour Decision in view of the clear inadequacy of the United States’ data protection regime following the Snowden revelations on the NSA run PRISM and Upstream programmes, that it already assessed intelligence practices