The Grand Chamber today handed down its judgment in Big Brother Watch and Others v the United Kingdom, a landmark case brought by civil liberties campaigners in 2013 following Edward Snowden’s revelations about the extent of bulk surveillance in the UK and USA.

The ruling concerns the UK’s regime for bulk interception and obtaining communications data from communication service providers under the Regulation of Investigatory Powers Act 2000, which has since been replaced by the Investigatory Powers Act 2016.

The court held unanimously that there had been violations of Article 8, on the right to respect for private and family life/communications, and Article 10, on freedom of expression, in respect of both the bulk intercept regime and the regime for obtaining communications data from communication service providers.

However, it held by a 12-5 majority that there had been no violation of either Article 8 or Article 10 in respect of the UK’s regime for requesting intercepted material from foreign governments and intelligence agencies.

The court also rejected arguments that bulk interception is inherently unlawful because of “the proliferation of threats that states currently face from networks of international actors, using the Internet both for communication and as a tool, and the existence of sophisticated technology which would enable these actors to avoid detection”.

However, it said any bulk interception regime had to be subject to “end-to-end safeguards”, including that an assessment should be made at each stage of the process of the necessity and proportionality of the measures being taken; that bulk interception should be subject to independent authorisation at the outset, when the object and scope of the operation were being defined; and that the operation should be subject to supervision and independent ex post facto review.

Under the 2000 Act, bulk interception was authorised by the Secretary of State rather than a body independent of the executive, categories of search terms defining the kinds of communications that would become liable for examination had not been included in the application for a warrant, and search terms linked to an individual (that is to say specific identifiers such as an email address) had not been subject to prior internal authorisation.