Privacy International and others v United Kingdom: Hacking Admissibility Decision and the Risk of ‘Deference Ping Pong’

By Daniella Lock (Doctoral Candidate and Teaching Fellow, UCL Faculty of Laws, University College London)

Last month, the European Court of Human Rights (ECtHR) handed down a decision that the application regarding the compatibility of the exercise of UK hacking powers made in Privacy International and others v United Kingdom was inadmissible. This was on the basis that the applicants had not exhausted domestic remedies. The Court reached this conclusion despite a case having been brought to the UK Investigatory Powers Tribunal (IPT), in Privacy International and Greennet v Secretary of State for Foreign and Commonwealth Affairs and ors, and a fifty-six page judgment being issued on the lawfulness of hacking (referred to ‘Computer Network Exploitation’ or CNE). This post sets out the reasoning of the Court and argues that while the decision itself is understandable, the reasoning underpinning it risks creating a process of ‘deference ping pong’. Deference ping pong – an ingenious phrase gratefully borrowed from Professor Colm O’Cinneide after a discussion on this issue – refers to a process by which the domestic courts and Strasbourg repeatedly defer to each other on key issues, usually with the consequence that substantive scrutiny of the state is ultimately avoided.


The case concerned UK hacking powers existing before 31 May 2018, before the Investigatory Powers Act 2016 came into force establishing a new legislative framework for hacking (and many other surveillance powers). The use of hacking powers by the UK Government first came to light as a result of the Snowden leaks in 2013 to 2014. However they were not officially acknowledged by the UK government until a year later, through the publication of the Draft Equipment Interference Code of Practice published in February 2015.

This acknowledgement came at a time in which the UK Government was in the process of officially acknowledging a number of other surveillance powers.  For example, engagement in the bulk acquisition of communications data by the security services was admitted in November 2015, when the then-Home Secretary, Theresa May, informed Parliament that communications data was being obtained in bulk from Communication Service Providers. The use of thematic warrants and BPDs were publicly avowed for the first time in March 2015 in a report by the Intelligence and Security Committee (the Parliamentary committee appointed to oversee the work of the UK’s security services). These powers have also been the subject of litigation in the UK.

The key contention of the applicants in Privacy International and others v United Kingdom is that the hacking powers in question are incompatible with articles 8 ECHR, as they permit the ‘interception or obtaining, processing, retention, examination, alteration or modification of private – and in certain cases extremely intimate or sensitive – information belonging or relating to very large numbers of people’ (see para 3 of their submissions) while underpinned by a ‘vague’ legal regime (para 17) which fails to meet the minimum safeguards for surveillance set out in Weber and Saravia v Germany (para 18).

The Court’s Decision

The ECtHR decided that the applicants’ case was inadmissible due to not having exhausted domestic remedies on two key grounds. The first is that the IPT in considering the applicants’ case had not determined whether the hacking in question in the case fell within the ECHR’s jurisdiction (paras 42 – 43). The question as to the jurisdiction of such interferences carried was raised as they were carried out under the authorisation of section 7 of the Intelligence Services Act 1994 (ISA) which refers to acts carried out outside of the British Islands.

The Court noted, in response to the applicants addressing the matter in IPT proceedings, that the Tribunal had stated it reserved ‘for future consideration if and when particular facts arise and the position of jurisdiction to challenge a s.7 warrant can be and has been fully argued’ as it had an ‘insufficient factual basis to reach any useful conclusion’ (para 55 of the IPT judgment). Moreover the applicants argued that ‘in their view the IPT was reluctant to rule on the question of jurisdiction without case-law guidance from Strasbourg and accordingly’ and reserved its position on that point ‘so that it could be first examined by this Court’ (para 39).

While the applicants had attempted to have the matter heard by the IPT, the Court maintained it could not ‘accept’ the applicants’ explanation that they did not pursue the argument about jurisdiction before the IPT in order that this Court would be able to decide the issue first’ (para 43). The Court justified this position on the basis that for the Court to accept this would take the ‘opposite approach to exhaustion’ set out in the ECHR (para 43).  

Another key factor cited by the Court was the fact that a judicial review with regards to an alternative hacking regime – that provided under section 5 ISA – was pending before the UK High Court, having been brought by first applicants Privacy International. The Court did note that at the time of their application, the applicants had no means of bringing a judicial review with regards to s7 ISA (only since the 2019 Supreme Court decision in R (on the application of Privacy International) v. Investigatory Powers Tribunal and others could judicial review be brought in relation to IPT rulings). However the ECtHR held it could not overlook the fact that developments in the judicial review regarding s5 ISA concern the original domestic case and one of the applicants as in the present application. The Court concluded such judicial review remained a ‘remedy to be exhausted by the applicants’ (para 46).


At first glance, this decision is fairly run of the mill. There is nothing hugely surprising about this decision by the Court given the recent availability of judicial review proceedings in the UK, and the fact that the applicants were already involved in bringing such proceedings regarding an adjacent hacking regime. Moreover, admissibility decisions are not usually ground breaking (though notably one of the most cited Strasbourg rulings in surveillance case law is that of Weber and Saravia v Germany which is an admissibility decision). However, on closer inspection, there is at least one issue of importance arising from the decision. 

Kicking the issue into the long grass?

At least insofar as standing goes, the Court has traditionally taken a fairly flexible approach to admissibility decisions with regards to surveillance. In the early 1978 case of Klass v Germany, the Court held that applicants could ‘claim to be a victim of a violation occasioned by the mere existence of secret measures or legislation permitting secret measures, without having to allege that such measures were in fact applied to him’ (para 35). However, the Court tightened its position in 2010in the case of Kennedy v UK. The current precedent is that in considering whether individuals may have their claim heard by the Court, they ‘must have regard to the availability of any remedies at the national level and the risk of secret surveillance measures being applied to him’ (Kennedy v UK, para 124). It is clear that the Court in Privacy International v United Kingdom was prepared to apply this precedent in a particularly rigid manner.

This rigid approach is reflected in the Court’s engagement with the issue regarding jurisdiction in Privacy International v United Kingdom. Recall that the applicants argued that ‘in their view the IPT was reluctant to rule on the question of jurisdiction without case-law guidance from Strasbourg’ and accordingly reserved its position on that point ‘so that it could be first examined by this Court’ (para 39). Indeed the IPT expressly states in its judgment that ‘ we reserve for future consideration, if and when particular facts arise and the position of jurisdiction to challenge a s.7 warrant can be and has been fully argued, whether an individual complainant may be able to mount a claim’ (para 53 of the IPT judgment).

The idea that IPT had avoided ruling on the issue of jurisdiction in order to receive guidance from the ECtHR suggests there is something counter-productive about the Court then sending the issue back to the UK courts. No doubt, now that the Court has sent the case back, the issue will now be considered in the UK. However this matter represents a waste of both the UK courts’ and the ECtHR’s judicial time, and serves to kick the issue of hacking into the long grass, due to the waiting times associated with bringing a case before the Court. Given the highly invasive potential of hacking powers, hopefully the Court will be revisiting this matter sooner rather than later.

The risk of deference ping pong

The Court taking this position also creates a risk of a form of deference ping pong ensuing between itself and the domestic courts with regards to novel Convention issues, whereby both defer to each other in a manner which enables the relevant state to evade substantive scrutiny. This risk is particularly prevalent with respect of jurisdictions without a long-standing independent regime of human rights law, such as the UK. For those states without an entrenched independent rights culture, domestic courts may well be cautious as to pronouncing on ECHR rights matters which raise new and complex issues. Indeed, the presiding precedent as to the approach of UK to ECHR rights in the UK is embodied by the ‘mirror principle’ established by Lord Bingham  in R v Special Adjudicator (para 20). The principle states that the ‘duty of national courts is to keep pace with the Strasbourg jurisprudence as it evolves over time: no more, but certainly no less’. This suggests the UK courts do not feel at ease articulating the requirements of the ECHR where there is no clear guidance from the Court and will defer on matters which are novel – indeed as the IPT did in Privacy International.

At the same time, the Court in Privacy International sent the novel issue of jurisdiction back to the UK courts while citing the subsidiary nature of its role in protecting ECHR rights.  The principle of subsidiarity precisely presupposes the willingness of domestic courts to take up the primary role in determining the requirements of the Convention on novel matters. However, as we have seen, there was not this willingness in the case of Privacy International and it is not likely to be present in lots of UK cases engaging with novel Convention matters. Thus it is clear that the Court’s emphasis of subsidiarity in this way carries with it a risk of creating a form of deference ping pong where no court feels entirely comfortable assessing the requirements of ECHR in a new environment.

Whether this scenario will play out again is not clear due to the lack of clarity in the Court’s reasoning. Importantly, it is not clear following the decision what the Court’s position would be where there is clear evidence that a domestic court has roundly avoided engaging with a particular issue. The Court gives the impression in Privacy International v United Kingdom, that it will be the applicants who bear the burden if this takes place. Indeed, in this manner the decision appears to follow a trend which has already been the subject of comment on this blog here and here, that the Court’s recent rulings on admissibility are at risk of representing a barrier to access to justice.

It is true that the Court is currently faced with significant political challenges, such as the UK Government having regularly expressed a desire to free itself from some if not all of the Conventions requirements. For example, this has recently culminated in its Overseas Operations Bill which would allow it to derogate from the ECHR during combat operations. It is likely that such challenges have created a situation where the use of admissibility decisions as a means of avoiding political controversy may be more attractive to Strasbourg judges. Indeed for any judges looking to avoid the thorny issues raised by an issue such as a hacking powers, Privacy International v UK may establish welcome precedent. However, if it is the applicant who bears the burden in the case that domestic courts expressly avoid engaging with a particular novel issue, this has the potential to create a significant gap in state accountability. Clarity on the Court’s position with regards to rulings by domestic courts in this respect would therefore be very welcome.

One thought on “Privacy International and others v United Kingdom: Hacking Admissibility Decision and the Risk of ‘Deference Ping Pong’

  1. Good post. It feels quite silly, I think, to approach the exhaustion of remedies question in a manner like Strasbourg did in this decision, in which it looks at whether the domestic court had, IN FACT, considered the ECHR angle, rather than whether it had a proper OPPORTUNITY to do so.

    If the domestic court could, in theory, assess the ECHR issue, but it did not, in fact, do so, why are claimants punished by being required to issue fresh proceedings?

    Surely, the court should be assessing this from the perspective of what the claimant did rather than what the court did. To do otherwise risks allowing domestic courts to erect additional, unnecessary hurdles by choosing not to deal with the issue on the facts when they could have.

    I think it makes sense, when looking at the domestic remedies question, for the court to look at three things – was it possible to raise the issue; was it, in fact, raised by the claimant; did the court actually consider it. The resulting matrix might look like this:

    Route A: POSSIBLE to raise + RAISED by claimant + court CONSIDERS = domestic remedies exhausted.

    Route B: POSSIBLE to raise + RAISED by claimant + court does NOT CONSIDER = domestic remedies exhausted.

    Route C: POSSIBLE to raise + claimants do NOT RAISE the claim = domestic remedies not exhausted.

    Route D: NOT POSSIBLE to raise = domestic remedies exhausted (separate issue would arise as to whether Cl would have standing before SB as a victim)

    To me, this makes sense – where the claimants fail to bring the case, and the domestic court cannot assess it, SB should insist that claimants go back and ask domestic courts to consider the issue. But where it is raised (and by raised I mean “raised in circumstances where the court ought to consider it”, because if there was, for example, a lack of standing or the claim was clearly vexatious, this would fall at the first hurdle: it would not be POSSIBLE to raise it) the courts should not just be able to choose not to consider the case, kicking the issue into the long grass for claimants.

    But Strasbourg instead adds to this; augmenting Route B with: “is it possible to raise the issue in further proceedings?” and this determines admissibility instead – if it is, in theory, possible to raise the issue again, the claimants have to do so in order to access Strasbourg. But that’s not in the claimants’ control – that’s something the courts control. If the court COULD have assessed it but chose not to, why make the claimants go further? They sought a remedy and did not get one.

    So what happened in the IPT here? It said it would consider the ECHR angle: (a) if and when particular facts arise; (b) and the position of jurisdiction to challenge a s.7 warrant can be and has been fully argued. This seems to suggest that it thought that neither applied in the case at hand. There seems to be a mix of justifications (the issue might not arise on the facts, so the court does not have jurisdiction to consider it at all, leading to Route D; and/or it was not properly raised by the claimant, leading to Route C). Depending on which one is considered most important, different conclusions might result (although Route D might lead to the SB court finding a lack of standing, as a separate issue from exhaustion) but on the facts I’m not even sure that the claimants neglected to fully argue the ECHR claim at the domestic level – the IPT accepts that the issue “was formulated as an agreed preliminary issue between the parties” at [53], and shows that the parties did put forward substantive submissions at [50]-[51]. So I am not even sure that the claimants did not raise the claim properly. This would move things into Route B…

    Regardless of the facts of this case, the idea of punishing claimants when domestic judges choose not to look at ECHR issues when they have the possibility to do so feels unjust more generally……

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s