On October 27, 2014, the UK National Contact Point (“NCP”) for the Organization for Economic Cooperation and Development (“OECD”) Guidelines for Multinational Enterprises released an Initial Assessment Statement (“the Statement”) that dismissed Privacy International’s complaint against the six telecommunications companies and terminated the complaint process. In the Statement, the NCP found that Privacy International “presents a strong case that mass interception and surveillance of private communications through the collection and storage of data relating to an individual’s private life can infringe an individual’s human right to privacy.” Para. 47. Nonetheless, the complaint was dismissed on the ground that the single newspaper article on a UK security services document on which Privacy International relied was insufficient to “substantiate” “[t]he link the complainants make [between Tempora and] the specific companies.” Para. 45. Although the NCP did not refer to the article by name, the Suddeustche Zeitung article cited in (1) above was the basis for Privacy International’s claim that the six companies had provided the GCHQ with access to transatlantic fiber optic cables. Despite its finding about the evidentiary insufficiency of the article, the NCP “accept[ed] that the publication that made this report saw the document concerned and had reason to trust the source providing it who had provided other information generally acknowledged to be genuine.” Id.
Although the six companies had failed to “explicitly deny receiving the warrants in question” when they responded to the complaint, the NCP concluded that their silence did not warrant investigation of the complaint’s allegations. Here, the NCP reasoned that it was “legitimate” for the companies to be concerned that “commenting on whether and what warrants may have been received would place [them] in breach of duties placed on them by RIPA.” In addition, the NCP asserted that the OECD guidelines make “obeying domestic laws … the first obligation of enterprises and that the Guidelines ‘should not and are not intended to place an enterprise in situations where it faces conflicting requirements.’” Para. 46.
In dismissing the complaint, the NCP also insinuated that it should have been brought before the IPT, stating that Privacy International “has already brought a challenge … to the IPT which exists to investigate complaints about the alleged conduct including improper use of data/surveillance by UK Government entities within the scope of RIPA.” Para.59.
Although the Initial Assessment Statement was issued on July 11, 2014, publication was delayed because Privacy International requested a review on July 24, and the NCP did not decide to refuse the review request until October 6.