Strasbourg Observers

Privacy International and others v United Kingdom: Hacking Admissibility Decision and the Risk of ‘Deference Ping Pong’

October 14, 2020

By Daniella Lock (Doctoral Candidate and Teaching Fellow, UCL Faculty of Laws, University College London)

Last month, the European Court of Human Rights (ECtHR) handed down a decision that the application regarding the compatibility of the exercise of UK hacking powers made in Privacy International and others v United Kingdom was inadmissible. This was on the basis that the applicants had not exhausted domestic remedies. The Court reached this conclusion despite a case having been brought to the UK Investigatory Powers Tribunal (IPT), in Privacy International and Greennet v Secretary of State for Foreign and Commonwealth Affairs and ors, and a fifty-six page judgment being issued on the lawfulness of hacking (referred to ‘Computer Network Exploitation’ or CNE). This post sets out the reasoning of the Court and argues that while the decision itself is understandable, the reasoning underpinning it risks creating a process of ‘deference ping pong’. Deference ping pong – an ingenious phrase gratefully borrowed from Professor Colm O’Cinneide after a discussion on this issue – refers to a process by which the domestic courts and Strasbourg repeatedly defer to each other on key issues, usually with the consequence that substantive scrutiny of the state is ultimately avoided.


The case concerned UK hacking powers existing before 31 May 2018, before the Investigatory Powers Act 2016 came into force establishing a new legislative framework for hacking (and many other surveillance powers). The use of hacking powers by the UK Government first came to light as a result of the Snowden leaks in 2013 to 2014. However they were not officially acknowledged by the UK government until a year later, through the publication of the Draft Equipment Interference Code of Practice published in February 2015.

This acknowledgement came at a time in which the UK Government was in the process of officially acknowledging a number of other surveillance powers.  For example, engagement in the bulk acquisition of communications data by the security services was admitted in November 2015, when the then-Home Secretary, Theresa May, informed Parliament that communications data was being obtained in bulk from Communication Service Providers. The use of thematic warrants and BPDs were publicly avowed for the first time in March 2015 in a report by the Intelligence and Security Committee (the Parliamentary committee appointed to oversee the work of the UK’s security services). These powers have also been the subject of litigation in the UK.

The key contention of the applicants in Privacy International and others v United Kingdom is that the hacking powers in question are incompatible with articles 8 ECHR, as they permit the ‘interception or obtaining, processing, retention, examination, alteration or modification of private – and in certain cases extremely intimate or sensitive – information belonging or relating to very large numbers of people’ (see para 3 of their submissions) while underpinned by a ‘vague’ legal regime (para 17) which fails to meet the minimum safeguards for surveillance set out in Weber and Saravia v Germany (para 18).

The Court’s Decision

The ECtHR decided that the applicants’ case was inadmissible due to not having exhausted domestic remedies on two key grounds. The first is that the IPT in considering the applicants’ case had not determined whether the hacking in question in the case fell within the ECHR’s jurisdiction (paras 42 – 43). The question as to the jurisdiction of such interferences carried was raised as they were carried out under the authorisation of section 7 of the Intelligence Services Act 1994 (ISA) which refers to acts carried out outside of the British Islands.

The Court noted, in response to the applicants addressing the matter in IPT proceedings, that the Tribunal had stated it reserved ‘for future consideration if and when particular facts arise and the position of jurisdiction to challenge a s.7 warrant can be and has been fully argued’ as it had an ‘insufficient factual basis to reach any useful conclusion’ (para 55 of the IPT judgment). Moreover the applicants argued that ‘in their view the IPT was reluctant to rule on the question of jurisdiction without case-law guidance from Strasbourg and accordingly’ and reserved its position on that point ‘so that it could be first examined by this Court’ (para 39).

While the applicants had attempted to have the matter heard by the IPT, the Court maintained it could not ‘accept’ the applicants’ explanation that they did not pursue the argument about jurisdiction before the IPT in order that this Court would be able to decide the issue first’ (para 43). The Court justified this position on the basis that for the Court to accept this would take the ‘opposite approach to exhaustion’ set out in the ECHR (para 43).  

Another key factor cited by the Court was the fact that a judicial review with regards to an alternative hacking regime – that provided under section 5 ISA – was pending before the UK High Court, having been brought by first applicants Privacy International. The Court did note that at the time of their application, the applicants had no means of bringing a judicial review with regards to s7 ISA (only since the 2019 Supreme Court decision in R (on the application of Privacy International) v. Investigatory Powers Tribunal and others could judicial review be brought in relation to IPT rulings). However the ECtHR held it could not overlook the fact that developments in the judicial review regarding s5 ISA concern the original domestic case and one of the applicants as in the present application. The Court concluded such judicial review remained a ‘remedy to be exhausted by the applicants’ (para 46).


At first glance, this decision is fairly run of the mill. There is nothing hugely surprising about this decision by the Court given the recent availability of judicial review proceedings in the UK, and the fact that the applicants were already involved in bringing such proceedings regarding an adjacent hacking regime. Moreover, admissibility decisions are not usually ground breaking (though notably one of the most cited Strasbourg rulings in surveillance case law is that of Weber and Saravia v Germany which is an admissibility decision). However, on closer inspection, there is at least one issue of importance arising from the decision. 

Kicking the issue into the long grass?

At least insofar as standing goes, the Court has traditionally taken a fairly flexible approach to admissibility decisions with regards to surveillance. In the early 1978 case of Klass v Germany, the Court held that applicants could ‘claim to be a victim of a violation occasioned by the mere existence of secret measures or legislation permitting secret measures, without having to allege that such measures were in fact applied to him’ (para 35). However, the Court tightened its position in 2010in the case of Kennedy v UK. The current precedent is that in considering whether individuals may have their claim heard by the Court, they ‘must have regard to the availability of any remedies at the national level and the risk of secret surveillance measures being applied to him’ (Kennedy v UK, para 124). It is clear that the Court in Privacy International v United Kingdom was prepared to apply this precedent in a particularly rigid manner.

This rigid approach is reflected in the Court’s engagement with the issue regarding jurisdiction in Privacy International v United Kingdom. Recall that the applicants argued that ‘in their view the IPT was reluctant to rule on the question of jurisdiction without case-law guidance from Strasbourg’ and accordingly reserved its position on that point ‘so that it could be first examined by this Court’ (para 39). Indeed the IPT expressly states in its judgment that ‘ we reserve for future consideration, if and when particular facts arise and the position of jurisdiction to challenge a s.7 warrant can be and has been fully argued, whether an individual complainant may be able to mount a claim’ (para 53 of the IPT judgment).

The idea that IPT had avoided ruling on the issue of jurisdiction in order to receive guidance from the ECtHR suggests there is something counter-productive about the Court then sending the issue back to the UK courts. No doubt, now that the Court has sent the case back, the issue will now be considered in the UK. However this matter represents a waste of both the UK courts’ and the ECtHR’s judicial time, and serves to kick the issue of hacking into the long grass, due to the waiting times associated with bringing a case before the Court. Given the highly invasive potential of hacking powers, hopefully the Court will be revisiting this matter sooner rather than later.

The risk of deference ping pong

The Court taking this position also creates a risk of a form of deference ping pong ensuing between itself and the domestic courts with regards to novel Convention issues, whereby both defer to each other in a manner which enables the relevant state to evade substantive scrutiny. This risk is particularly prevalent with respect of jurisdictions without a long-standing independent regime of human rights law, such as the UK. For those states without an entrenched independent rights culture, domestic courts may well be cautious as to pronouncing on ECHR rights matters which raise new and complex issues. Indeed, the presiding precedent as to the approach of UK to ECHR rights in the UK is embodied by the ‘mirror principle’ established by Lord Bingham  in R v Special Adjudicator (para 20). The principle states that the ‘duty of national courts is to keep pace with the Strasbourg jurisprudence as it evolves over time: no more, but certainly no less’. This suggests the UK courts do not feel at ease articulating the requirements of the ECHR where there is no clear guidance from the Court and will defer on matters which are novel – indeed as the IPT did in Privacy International.

At the same time, the Court in Privacy International sent the novel issue of jurisdiction back to the UK courts while citing the subsidiary nature of its role in protecting ECHR rights.  The principle of subsidiarity precisely presupposes the willingness of domestic courts to take up the primary role in determining the requirements of the Convention on novel matters. However, as we have seen, there was not this willingness in the case of Privacy International and it is not likely to be present in lots of UK cases engaging with novel Convention matters. Thus it is clear that the Court’s emphasis of subsidiarity in this way carries with it a risk of creating a form of deference ping pong where no court feels entirely comfortable assessing the requirements of ECHR in a new environment.

Whether this scenario will play out again is not clear due to the lack of clarity in the Court’s reasoning. Importantly, it is not clear following the decision what the Court’s position would be where there is clear evidence that a domestic court has roundly avoided engaging with a particular issue. The Court gives the impression in Privacy International v United Kingdom, that it will be the applicants who bear the burden if this takes place. Indeed, in this manner the decision appears to follow a trend which has already been the subject of comment on this blog here and here, that the Court’s recent rulings on admissibility are at risk of representing a barrier to access to justice.

It is true that the Court is currently faced with significant political challenges, such as the UK Government having regularly expressed a desire to free itself from some if not all of the Conventions requirements. For example, this has recently culminated in its Overseas Operations Bill which would allow it to derogate from the ECHR during combat operations. It is likely that such challenges have created a situation where the use of admissibility decisions as a means of avoiding political controversy may be more attractive to Strasbourg judges. Indeed for any judges looking to avoid the thorny issues raised by an issue such as a hacking powers, Privacy International v UK may establish welcome precedent. However, if it is the applicant who bears the burden in the case that domestic courts expressly avoid engaging with a particular novel issue, this has the potential to create a significant gap in state accountability. Clarity on the Court’s position with regards to rulings by domestic courts in this respect would therefore be very welcome.

Print Friendly, PDF & Email

Related posts

Leave a Reply

Your email address will not be published. Required fields are marked *