Judgment rules that secret intelligence sharing arrangements between Britain and the US did not comply with human rights laws

For more than 18 months the response from the security services to the disclosure by Edward Snowden of the mass harvesting of personal data of British citizens has been to say: “Trust us, nothing we are doing is unlawful.”

But for the first time in its 15-year history the investigatory powers tribunal (IPT) – the only British court that can hold GCHQ, MI5 and MI6 to account – has put a question mark against that assurance.

The 12-page tribunal judgment in the case brought by Liberty and Privacy International does not rule that the British GCHQ bulk interception programmes were unlawful. But it has ruled that the secret intelligence sharing arrangements between Britain and the US, known as Prism and Upstream, did not comply with human rights laws for seven years because the internal rules and safeguards supposed to guarantee our privacy have themselves been kept secret.

It was only public disclosure of those rules for the first time as part of the first of two IPT rulings in December that brought the intelligence-sharing regime into compliance with human rights law in general, and article 8 of the European convention on human rights on the right to privacy in particular.

The declaration by the tribunal judges is quite clear that until that public disclosure was made on 5 December, the Prism and Upstream programmes under which the private personal data of people living in the UK was obtained by the American authorities contravened human rights laws.

The judges go on to add, however, that the arrangements now comply with human rights laws.

It is not an academic point because what is involved, as Edward Snowden revealed, is the mass collection of data detailing the online lives of millions of British citizens held by internet giants such as Google, Facebook and Twitter.

The government insists that all that has been disclosed is “two paragraphs of additional detail” which were not previously in the public domain.

But the two paragraphs, while wrapped in the obscure and complex language of the Regulation of Investigatory Powers Act 2000 (Ripa), confirm that GCHQ and the security services hold some of the powers claimed by Edward Snowden.

For example they make clear the intelligence services in Britain have the power to ask foreign governments for bulk – “unanalysed” – intercepted content and communications data outside current international mutual legal assistance treaties.

They also make it clear that while it is preferable that the intelligence services do this with a warrant signed by a cabinet minister, they also have the power to act without a warrant. This could be in cases where, for example, it is not technically feasible to obtain the desired data under the terms of a British warrant – but warrantless action must be deemed “necessary and proportionate for the intelligence services”. Permission to act without a warrant must also be granted by a cabinet minister. The security services say they have never used this provision.

The two paragraphs go on to make clear that any bulk communications data obtained from US agencies by British intelligence services must be subject to the same internal rules and safeguards as any other material obtained under a ministerial warrant.

These are significant admissions made by the intelligence services which they were not prepared to confirm at the time of the Snowden revelations.

More legal cases are in the pipeline following the Snowden disclosures that cover the interception of legally privileged material and other issues. The Home Office suddenly published on Friday a consultation on the rules surrounding these issues and the ability to bypass the growing encryption being used by different internet companies. This IPT ruling is likely to be the first of a series enforcing a new transparency on the security services. It would not have happened without Snowden’s disclosures and the legal challenges that have come it their wake.