MI5 law breaking triggers Liberty and Privacy International legal action

• Security service lawlessness revealed in two separate legal cases
• MI5 kept its law-breaking secret from the surveillance watchdog
• Groups demand MI5 reveal full extent of its unlawful handling of personal data

Liberty, the human rights organisation, and Privacy International, today announced a joint legal action against MI5 following revelations the intelligence agency has systematically broken surveillance laws for years and kept it secret from the surveillance watchdog.

The details of MI5’s lawlessness emerged last summer in two legal cases – Liberty’s challenge to the Snoopers’ Charter (the Investigatory Powers Act 2016) and Privacy International’s challenge to state powers to collect and store ordinary people’s data.

In Liberty’s challenge to the Investigatory Powers Act 2016 (IPA), the Government revealed that MI5 had been unlawfully retaining and mishandling the public’s data for years.

As part of that case, the Government disclosed a number of documents to the court, including correspondence between the security service and the Investigatory Powers Commissioner’s Office (IPCO, the body responsible for overseeing state surveillance practices), correspondence between the security service and the Home Secretary, and reports of inspections carried out by IPCO after they learnt of MI5’s failings.

Liberty, the human rights organisation, and Privacy International, have announced a joint legal action against MI5 following revelations the intelligence agency has systematically broken surveillance laws for years and kept it secret from the surveillance watchdog.

The documents reveal that MI5 not only broke the law, they failed to report this to IPCO, despite knowing about their non-compliance for years. They also gave IPCO false information in order to obtain warrants. These revelations led the then Investigatory Powers Commissioner, Lord Justice Fulford, to conclude that the UK security service had held and handled our data in an “undoubted unlawful manner”.

In a remarkable admission to the Commissioner, a senior MI5 official acknowledged that personal data collected by MI5 might be stored in “ungoverned spaces”, while an MI5 review in 2016 found “a high likelihood [of material] being discovered when it should have been deleted”.

Liberty and Privacy International have today launched a legal bid to get MI5 to disclose the full extent of its unlawful conduct. The groups are asking the court to rule that MI5 violated our rights to privacy and free expression by unlawfully retaining and mishandling our data. The groups are also demanding that surveillance warrants granted during this unlawful activity are quashed and all record of the public’s illegitimately obtained or retained data is destroyed.

Liberty lawyer Megan Goulding said: “It’s clear we need to know the extent of MI5’s lawlessness as these court cases have revealed how our surveillance laws are not fit for purpose as well as MI5’s disregard for our rights. MI5 has unprecedented and dangerous power to spy on any one of us and collect our sensitive private information.

“It’s clear that the so-called safeguards in our surveillance laws are totally ineffective in protecting our rights. The Snoopers’ Charter needs to be torn up and the Government must create a targeted surveillance regime that protects us while respecting our rights and freedoms.”

Privacy International’s Legal Director Caroline Wilson Palow said: “For more than a decade, MI5 has been building massive datasets by systematically collecting our personal information. Such practices are a serious interference with our right to privacy and threaten democratic values. We were promised that robust safeguards were in place so that such data would never be abused. Yet it turns out that those safeguards were in some cases illusory – that MI5 held significant data in ungoverned spaces without any effective oversight. We are bringing this challenge together with Liberty to ensure that MI5 does not continue to operate outside of the law.”

What we know of MI5’s wrongdoing so far

• Illegal actions: The Investigatory Powers Commissioner concluded that the way MI5 was holding and handling people’s data was “undoubtedly unlawful”. MI5 breached IPA safeguards relating to how long data is held for, how often it is copied, the number of persons to whom and extent to which material is disclosed, and how data is stored securely. The exact details of MI5’s breaches are yet unknown, but Liberty and Privacy International hope this new legal case will reveal more.
• Senior people at MI5 knew for six years before informing IPCO: Issues with MI5’s legal compliance were known to the MI5 Board in 2013, but were only brought to IPCO’s attention in February 2019.
• MI5 misled judges: Senior judges (known as Judicial Commissioners) issued surveillance warrants on the understanding that MI5’s data handling obligations under the IPA were being met – when they were not, in fact MI5 gave false information to obtain the warrants. The Investigatory Powers Commissioner has pointed out that warrants would not have been issued if IPCO had been aware about the breaches. The Commissioner states that “it is impossible to sensibly reconcile the explanation of the handling of arrangements the Judicial Commissioners were given in briefings…with what MI5 knew over a protracted period of time was happening.”

The “bulk” powers Liberty challenged in the case against the Snoopers’ Charter allow MI5 to scoop up the public’s personal data en masse, regardless of whether they are suspected of any wrongdoing. It is therefore unclear how many people may have had their personal information unlawfully retained and mishandled, without their knowledge, by the security service.