The IPT’s December 5, 2014 Judgment on Liberty et al’s challenge to Prism left open the question of whether before its publication of the Intelligence Services’ disclosures, the UK’s sharing of information from the NSA’s Prism and/or Upstream programs was compatible with Article 8 of the ECHR. In its February 6, 2015 Judgment, the IPT ruled against the Intelligence Services for the first time in its history, finding that before the disclosures, the sharing of information violated the notification component of the ECHR’s requirement that interferences with privacy be in “accordance with the law.”
Also left open by the December 5 Judgment was the question of whether if the Intelligence Services were to depart from previous practice and, in accord with Disclosure 1(b), obtain data from the NSA in the absence of a warrant, the protections of s.16 of RIPA would apply. After the Judgment, the Intelligence Services issued an additional disclosure, stating that if a warrantless request for data from Prism or Upstream were to be targeted at communications to, from, or about a specific individual(s), analogously to a RIPA s.8(1) warrant, the request for that person’s communications would need to be approved by the Secretary of State. The protections of s. 16 would only be needed if, by analogy to a s.8(4) of RIPA warrant, a request for communications from the NSA were not to be targeted at any particular individual. In the event that communications were obtained through an untargeted request, the Intelligence Services disclosed that, analogously to s.16(2) of RIPA, factors referable to a person known to be residing in the UK would not be used to select that person’s communications for examination. The prohibition could be lifted only if, by analogy to s.16(3) of RIPA, the Secretary of State were to certify that examining that particular person’s communications was necessary for national security, the detection or prevention of serious crime, or the economic wellbeing of the UK.
With Amnesty International’s agreement, Privacy International submitted that the additional disclosure ensured that the safeguard of s.16 of RIPA “is now in place” in the event of warrantless requests under 1(b), “but was not in place before December 2014.” Accepting the Claimants’ position, the IPT held that “’prior to the disclosure made and referred to in the Tribunal’s Judgment of 5 December 2014 and this judgment’ the Prism and/or Upstream arrangements contravened Articles 8 or 10 ECHR.” February 6 Judgment, para. 32.
The Claimants’ victory was limited, however, in that IPT held that the disclosures were sufficient to make the Prism and/or Upstream arrangements comply with the ECHR.