Tribunal finds ‘serious failings’ by UK security agency over privacy safeguards

An independent tribunal has criticised “serious failings” by MI5, the UK’s domestic security agency, to comply with privacy safeguards in relation to the possession and handling of vast amounts of individuals’ personal data.

The Investigatory Powers Tribunal, which probes complaints against the UK’s security services, on Monday ruled in favour of the charity Privacy International and Liberty, the human rights group, in the latest of a series of lawsuits brought by the two against MI5 over alleged mass surveillance.

The case centred on MI5’s compliance with critical legal safeguards for personal data under the Regulation of Investigatory Powers Act 2000 and the Investigatory Powers Act 2016.

Thanks to warrants granted by ministers and judicial commissioners, the UK’s main intelligence agencies — MI5, MI6 and GCHQ — have wide-ranging powers to intercept phone and online communications and carry out surveillance in the interests of national security.

But the law also sets out strict rules on how such data should be handled and stored.

The IPT ruled on Monday that, from late 2014 until 2019, MI5 held large amounts of data unlawfully because, contrary to law, at least one of the agency’s technology systems lacked proper retention, review and deletion safeguards.

“The holding and handling of data in those circumstances was unlawful on the basis that under the relevant provisions of RIPA and IPA satisfactory safeguards relating to RRD were not in place,” the tribunal said.

In its ruling, the three-judge body also found “serious failings in compliance with the statutory obligations of MI5 from late 2014 onwards”, adding that “those failings ought to have been addressed urgently by the management board [of MI5]”. 

The IPT also concluded that the Home Office had overlooked the agency’s failings, neglecting to make “adequate enquiries” or investigate longstanding compliance risks, despite red flags being reported several times since December 2016.

The judges said the Whitehall department “did not have grounds to be satisfied that effective safeguards applied to warrants where there had been no assessment or effective investigation into compliance with RRD”.

“We have made findings of serious failures by MI5 and the secretary of state,” the IPT said, adding that there had been a “widespread corporate failure”.

The tribunal said that although its findings would be sent in a report to Prime Minister Rishi Sunak, it did not think it appropriate to single out any individuals at MI5 or the Home Office for blame.

Megan Goulding, lawyer at Liberty, said: “This judgment confirms what we at Liberty and others have been saying for years — surveillance safeguards are not fit for purpose and fail to protect our fundamental privacy rights.”

Caroline Wilson Palow, legal director at Privacy International, said: “We’ve been here many times before. UK intelligence agencies seriously intrude on thousands or even millions of people’s privacy, we call them out, then the government promises better safeguards. Today’s ruling is especially troubling because it confirms that those safeguards can be illusory.”

The Home Office said: “MI5 consistently work to a high standard in challenging circumstances and treat the protection of personal information with the utmost seriousness. Substantial action has been taken over a number of years to address the concerns raised in this case.

“We accept the judgment delivered and will continue to drive forward work to ensure we and our partners remain fully compliant with the law.”