But the sharing of intelligence with foreign governments is still a-okay. The European Court of Human Rights (ECHR) is the latest to deem the UK government's mass surveillance program unlawful. Judges ruled the "bulk interception regime" violated the right to privacy and freedom of expression. It said there was "insufficient oversight" over what communications UK agencies were collecting and also noted that there were "inadequate" safeguards for the protection of confidential journalistic sources. A previous judgement from a 2016 UK tribunal also found British intelligence agencies GCHQ, MI5 and MI6 broke privacy rules by amassing large amounts of UK citizens' data without proper oversight. The ECHR judges wrote: "In view of the potential chilling effect that any perceived interference with the confidentiality of journalists' communications and, in particular, their sources might have on the freedom of the press, the Court found that the bulk interception regime was also in violation of article 10." In the wake of Edward Snowden's revelations, three applications from Big Brother Watch, the Bureau of Investigative Journalism, Amnesty International and nine other human rights charities were joined together and lodged. They centred on complaints about powers given to security services under the Regulation of Investigatory Powers Act 2000 (RIPA) -- which was later replaced with the Investigatory Powers Act (IPA) in November 2016. That bill has yet to come into effect -- with the UK government currently redrafting it after it was deemed incompatible with EU law -- and was therefore not considered in the court's assessment. The ECHR, however, diverged from the applicants over the issue of sharing intel with foreign governments, ruling that it did not violate either the right to a private and family life, or to free speech. A government spokesperson told The Independent it "will give careful consideration to the Court's findings." In a statement, Big Brother Watch director Silkie Carlo called the decision a "landmark ruling", while warning of the dangers posed by the incoming IPA. " This judgment is a vital step towards protecting millions of law-abiding citizens from unjustified intrusion. However, since the new Investigatory Powers Act arguably poses an ever greater threat to civil liberties, our work is far from over." Amnesty International also (cautiously) welcomed the judgement, writing that it "does have some room for improvement, as it does not go far enough in condemning bulk surveillance. " It continued: "[the ruling] permits national governments a "wide margin of appreciation" in deciding whether to engage in bulk interception and greenlights vast intelligence sharing with the US National Security Agency (NSA)."
Privacy was violated at moment of collection, not when humans viewed data, ECHR rules. In a set of rulings today, the European Court of Human Rights found that the mass surveillance scheme used by the GCHQ—the United Kingdom's signals intelligence agency—violated the European Convention on Human Rights (ECHR), unlawfully intruding on the private and family life and freedom of expression of British and European citizens. And the case included consideration of intelligence collected by the US National Security Agency shared with GCHQ. The Court found that sharing intelligence information gathered from bulk surveillance—as GCHQ does with the NSA and other members of the " Five Eyes" intelligence and security alliance—does not violate the human rights charter. But the judges did warn that using such intelligence sharing to bypass restrictions on surveillance of a member state's own citizens would be a violation of the charter. In the ruling, the judges found that there was insufficient oversight through the UK's Investigatory Powers Tribunal (the UK equivalent of the US' Foreign Intelligence Surveillance Court) over the UK's bulk interception, filtering, and search of communications by the GCHQ. The judges also found that there were insufficient safeguards put in place to govern access to communications data. While the case has no direct impact on US intelligence gathering, the case could have a ripple effect because of the close connections between US and UK intelligence and law enforcement organizations. The suit was brought by Big Brother Watch, Amnesty International, the American Civil Liberties Union, and a number of other civil liberties organizations from Europe and North America, as well as the Bureau of Investigative Journalism and others. "The decision sends a clear message that similar surveillance programs, such as those conducted by the NSA, are also incompatible with human rights," claimed ACLU attorney Patrick Toomey. "Governments in Europe and the United States alike must take steps to rein in mass spying and adopt long-overdue reforms that truly safeguard our privacy." No damages were awarded, other than for the court costs of some of the applicants who brought the suit. And the court did not find that the surveillance itself was illegal. However, the ruling did find that individuals' privacy rights applied from the moment communications and data were captured by surveillance systems —not just when they were viewed or processed by human analysts. And the ruling also found that surveillance violated freedom of expression because of its potential chilling effects on journalists. The Court found that the way the UK government collected data from communications service providers was in violation of Article 8 of the ECHR (private and family life rights). It also found that both the method of bulk interception of communications and the process for obtaining communications metadata from service providers violated Article 10 (freedom of expression) because of "insufficient safeguards in respect of confidential journalistic material." And of particular concern to the court was the lack of any oversight into what Internet traffic was collected or what filters were used to determine which traffic was of interest. "While there is no evidence to suggest that the intelligence services are abusing their powers, the Court is not persuaded that the safeguards governing the selection of bearers for interception and the selection of intercepted material for examination are sufficiently robust to provide adequate guarantees against abuse," the Court's ruling stated. "Of greatest concern... is the absence of robust independent oversight of the selectors and search criteria used to filter intercepted communications." The parts of UK law that were found to be problematic by the Court are similar to aspects of the PATRIOT Act in the US that have enabled the most controversial parts of US mass surveillance. The Court rejected the UK government's claim that metadata collection was less intrusive than collecting contents of communications. " The Court recognizes how revealing metadata can be to people's lives," Toomey told Ars. "It can expose things the government wouldn't otherwise have access to." Mass surveillance in and of itself, however, was not found to be a violation of the charter. " In reaching this conclusion, the Court found that the operation of a bulk interception regime did not in and of itself violate the Convention," a spokesperson for the court said in a statement on the case, "but noted that such a regime had to respect criteria set down in its case-law." While the court's ruling applied to surveillance regimes set down by the UK's Regulation of Investigatory Powers Act of 2000—not the new Investigatory Powers Act passed in 2016, which has not yet come into full effect—some of the provisions ruled to be in violation of the charter remain in the new law. Other mass-surveillance cases, including one against the French government's Intelligence Act of July 24, 2015, are still pending. But the precedent set here will likely force other governments in Europe to re-examine their surveillance laws.