IPT finds serious and wide-ranging errors by MI5 in respect of warrants for authorised data


On 30 January 2023 the Investigatory Powers Tribunal handed down its judgment in a challenge brought by Liberty and by Privacy International against MI5 and the Home Secretary.  The Tribunal (chaired by Lord Justice Edis and including Mrs Justice Lieven and Mr Flint KC) held that the Security Service had failed to comply with the statutory safeguards required by the Regulation of Investigatory Powers Act 2000 and the Investigatory Powers Act 2016 concerning the acquisition and holding of personal data.

The Tribunal held:

  • There were “serious failing in compliance with the statutory obligations of MI5 from late 2014 onwards”. MI5 had failed to apply proper retention, review and deletion safeguards to authorised data held in one of its technology environments. The Security Service was under a duty to have notified the Investigatory Powers Commissioner from 2018, but did not do so until February 2019. The Security Service conceded that these failings constituted a breach of the Claimants’ rights under Article 8 of the ECHR.
  • The Home Secretary did not make adequate enquiries as to the longstanding compliance risks which had been reported on several occasions from December 2016. No explanation was sought or offered or reported to the Home Secretary as to the scale and seriousness of the risk to the handling requirements required by statute. The Secretary of State did not have grounds to be satisfied that effective safeguards applied to warrants and as such, breached the Tameside
  • MI5 had breached its duty of candour in failing to disclosure use made of BCD in the proceedings brought in 2015 by Privacy International in respect of handling arrangements for bulk personal data and bulk communication data (“the BPD/BCD claim”). The Tribunal will now consider whether the BPD/BCD claim should be reopened.

Jonathan Glasson KC and Sarah Hannett KC were instructed as Counsel to the Tribunal in the case.

Useful link(s)