November 21, 2023
By Maria Tzanou
Do persons outside an ECHR Contracting State fall within the Convention’s territorial jurisdiction if their electronic communications were (or were at risk of being) intercepted, searched and examined by that State’s intelligence agencies operating within its borders for the purposes of a complaint under Article 8 ECHR?
The ECtHR’s Fourth Section judgment in Wieder and Guarnieri v. the UK, delivered on 12 September 2023, clarified this question, albeit in a laconic and largely undertheorised manner that missed out the opportunity to send a clear message about transborder surveillance.
Following the Investigatory Powers Tribunal (hereinafter the ‘IPT’) rulings in 2014 and 2015 on applications lodged by ten human rights organisations (hereinafter ‘the Liberty proceedings’) about the bulk interception of communications by the United Kingdom intelligence agencies pursuant to section 8(4) of the Regulation of Investigatory Powers Act 2000 (RIPA), Privacy International – one of the applicants in the Liberty proceedings, encouraged individuals to lodge complaints with the IPT using a standard application form available on Privacy International’s website.
The applicants in this case, Mr Joshua Wieder, a US national and IT professional who worked for commercial data centres and news organisations, and Mr Claudio Guarnieri, an Italian national and privacy and security researcher, used this form to submit complaints arguing that the UK government and the UK security services had breached their Articles 8 and 10 ECHR rights.
Neither of the applicants had been living in the UK at the time of the complaints (or in general); Mr Wieder was a US resident, while Mr Guarnieri was residing in Berlin, Germany.
The IPT handed down its judgment in May 2016. While noting that it had approached the question of locus standi and victim status on ‘a very open-minded basis’, it dismissed the claims of Mr Guarnieri and Mr Wieder by reference to the Human Rights Act 1998 (hereinafter ‘HRA’) on the ground that it had no jurisdiction to examine them. This was because pursuant to the IPT, a State’s competence under Article 1 ECHR was primarily territorial and the exceptions so far recognised by the Court concerned a) acts of diplomatic and consular agents present on foreign territory, b) the exercise of control and authority over an individual outside a Contracting State’s territory, and, c) the exercise of effective control of an area outside a Contracting State’s territory (see Al-Skeini and Others v. the UK). Therefore, in the IPT’s view, a Contracting State owed no obligation under Article 8 ECHR to persons who were situated outside its territory in respect of electronic communications between them which passed through that State. In fact, according to the IPT, a different finding regarding Article 8 ECHR would result in extending the bounds of the domestic courts’ jurisdiction under the Convention.
Following the IPT’s decision, Mr Wieder and Mr Guarnieri lodged a complaint before the Strasbourg Court, arguing that their Article 8 ECHR had been violated because, as a result of their work and contacts, their communications might have been intercepted, extracted, filtered, stored, analysed and disseminated by the UK intelligence agencies pursuant to the regime under section 8(4) of the RIPA.
The ECtHR noted from the outset that the principal issue in the annotated case did not concern the compliance of the UK’s bulk surveillance regime with the Convention as this matter had already been adjudicated in Big Brother Watch and Others (for a commentary see here). It should be recalled that, in Big Brother Watch and Others the ECtHR found that the UK had breached Article 8 ECHR because i) there was no independent authorisation of section 8(4) RIPA warrants, ii) the categories of selectors used to search intercepted communications did not have to be included in the application for a warrant, and, iii) selectors linked to an individual were not subject to prior internal authorisation.
Rather, the principal issue in the present case concerned the question of admissibility of the individual applications.
The UK disputed that the ECtHR had jurisdictional competence in this case for the purposes of Article 1 of the Convention. The Court commenced its analysis by reiterating that the exercise of jurisdiction is a necessary condition for a Contracting State to be able to be held responsible for acts or omissions imputable to it which give rise to an allegation of the infringement of rights and freedoms set forth in the Convention (H.F. and Others v. France and Catan and Others v. the Republic of Moldova and Russia). It observed that to date, it had not had the opportunity to consider the question of jurisdiction in the context of a complaint concerning an interference with an applicant’s electronic communications, although the matter was alluded to in previous judgments (Weber and Saravia v. Germany; Big Brother Watch and Others and Bosak and Others v. Croatia).
The applicants in the present case had not suggested that they were themselves at any relevant time in the UK or in an area over which the UK exercised effective control. Rather, they argued that the interception, extraction, filtering, storage, analysis and dissemination of their communications by the UK intelligence agencies pursuant to section 8(4) RIPA nevertheless fell within the UK’s territorial jurisdiction.
The ECtHR confirmed that this was the case, based on a rather technical reasoning. First, it recalled that in Big Brother Watch and Others it had identified four stages to the bulk interception process: i) the interception and initial retention of communications and related communications data; ii) the searching of the retained communications and related communications data through the application of specific selectors; iii) the examination of selected communications/related communications data by analysts; and, iv) the subsequent retention of data and use of the ‘final product’, including the sharing of data with third parties. According to the Court, the interception of communications and the subsequent searching, examination and use of those communications interfered both with the privacy of the sender and/or recipient, and with the privacy of the communications themselves. Under section 8(4) RIPA, the interference with the privacy of communications clearly took place where those communications were intercepted, searched, examined and used and, thus, the resulting injury to the privacy rights of the sender and/or recipient would also take place there.
Therefore, the Court concluded that the interference with the applicants’ rights under Article 8 ECHR took place within the UK and fell within the territorial jurisdiction of the latter, making it not necessary to consider whether any of the exceptions to the territoriality principle were applicable in this instance.
The Court finally examined ex officio the victim status of the applicants, confirming that for the purposes of the Article 8 ECHR the level of persuasion necessary to establish victim status cannot be unreasonably high. Thus, as section 8(4) RIPA entailed a bulk interception regime and communications might be intercepted, stored and searched even if neither the sender nor recipient were of interest to the intelligence agencies, the Court accepted that the applicants in this case could claim to be victims of the alleged violation (it should be noted that the IPT had already accepted their victim status).
Having declared their complaint admissible, the Court did not need to engage in a detailed discussion on the merits; it went on to rule that there had been a violation of the applicants’ Article 8 ECHR rights for the reasons identified in Big Brother Watch and Others (see above).
The Court’s judgment is welcome because it established, for the first time, the jurisdiction of a Contracting State under Article 1 ECHR in cases of alleged bulk interception of the communications of persons living outside the respondent State. Essentially, this means that the interception (or the risk of interception) of electronic communications by a Contracting State falls within this State’s territorial jurisdiction and the Convention rights are applicable even if the complainants reside outside this State’s territory. In fact, the Convention applies even when the complainant resides outside the ‘espace juridique’ of the Convention altogether; it should be recalled that the Court found that that the potential interception of the communications of Mr Wieder, a US national residing in the USA, fell within the territorial jurisdiction of the UK.
What is ever more remarkable, is that this assessment of the Court is not based on extraterritoriality grounds. Indeed, the Court did not need to engage with the potential extraterritorial application of the Convention; the UK was found to have proper territorial jurisdiction in cases that concern the risk of bulk interception of the electronic communications of persons residing outside its territory.
As such, the judgment has significant implications. It sends out a strong message on mass electronic surveillance and clarifies that the transboundary effects of this fall within the territorial jurisdiction of the respondent State and the Convention rights are applicable even for complainants living outside this State.
This is a particularly important finding for two reasons. First, the global nature and the infrastructure of the Internet mean that data are not territorially bound. Indeed, communications over the Internet take place through the adoption of standardised protocols. A single communication is divided into packets (units of data), which are transmitted – often via underwater fibre optic cables – separately across multiple networks. Packets may be routed via different countries resulting in increased data flows across borders. For example, a simple email sent between two persons (even if both are living in the same country) may be routed via another country or countries depending on the identified optimum path and the location of email servers.
Second, modern surveillance techniques, such as signals intelligence activities often have transborder effects as they can be conducted outside the territory of a state. It is therefore, significant, that the ECtHR has confirmed the normal application of human rights (and in particular of the right to privacy) in such cases, attesting that the state intercepting electronic communications is responsible to ‘secure to everyone within their jurisdiction the rights and freedoms’ of the ECHR (Article 1 ECHR) and that this includes persons living outside the territory of that state if their electronic communications are at risk of being intercepted. This clearly contrasts with the approach taken in other jurisdictions, such as the USA, where the US CLOUD Act requires a service provider to comply with the obligations to preserve or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession or control, ‘regardless of whether such communication, record, or other information is located within or outside of the United States.’ Indeed, in United States of America v. Agron Hasbajrami, the US Court of Appeals for the Second Circuit confirmed that ‘[t]he protections extended by the Fourth Amendment to foreign individuals abroad, if any, are minimal and plainly outweighed by the paramount national interest in preventing foreign attacks on our nation and its people.’
However, despite the clear significance of the message delivered by the ECtHR in Wieder and Guarnieri, the Court’s reasoning – or rather the lack of it – leaves a lot to be desired. First, the sheer length of the Court’s analysis on jurisdictional competence is extremely brief. This is completed in nine paragraphs overall, which appears underwhelming given the significant implications of its ruling.
Second and more importantly, the substance of the reasoning itself is limited. To contend the UK’s government argument that any interference with the applicants’ private lives occasioned by the interception, storage, searching and examination of their electronic communications ‘could not be separated from their person and would therefore have produced effects only where they themselves were located – that is, outside the territory of the United Kingdom’, the Court engaged in a confusing comparison of electronic communications with ‘possessions’. Having acknowledged that there are important differences between electronic communications (for the purposes of Article 8 ECHR) and possessions (for the purposes of Article 1 of Protocol No. 1), it held that an interference with an individual’s possessions occurs where the possession is interfered with, rather than where the owner is located (see Anheuser-Busch Inc. v. Portugal). Similarly, in the specific context of Article 8, according to the Court, ‘it could not seriously be suggested that the search of a person’s home within a Contracting State would fall outside that State’s territorial jurisdiction if the person was abroad when the search took place’. Therefore, ‘while some of the elements of a person’s private life (for example, physical integrity) may not readily be separated from his or her physical person, that is not necessarily the case for all such elements’ (see Von Hannover v. Germany and Arlewin v. Sweden).
This comparison between possessions and electronic communications led the Court to the – rather bizarre – conclusion that the interception of communications and the subsequent searching, examination and use of those interferes both with the privacy of the sender and/or recipient, and with the privacy of the communications themselves. This pronouncement allowed the Court to establish the UK’s territorial jurisdiction on the applicants’ rights at stake without the need to consider potential extraterritoriality exceptions.
Nevertheless, the dichotomy between ‘the privacy of the sender/ and or recipient’ and ‘the privacy of the communications themselves’ appears artificial and contrived; the privacy of the communications entails the privacy of the parties involved in these and it is difficult to see how the privacy of the ‘communications themselves’ is anything different especially since it seems to refer to the communications rather than the individuals involved.
In this regard, instead of a technical circumvention, the judgment would have been more robust if the Court had based its reasoning on a fundamental human rights approach. This is the path already followed by the German Federal Constitutional Court. In particular, the Bundesverfassungsgericht ruled in 2020 that Art. 1(3) of the Basic Law, which provides that German state authority is comprehensively bound by the fundamental rights of the Basic Law, aims to provide comprehensive fundamental rights protection and to place the individual at its centre, meaning that fundamental rights ought to provide protection whenever the German state acts and might thereby create a need for protection – irrespective of where and towards whom it does so. According to the Bundesverfassungsgericht, this means that the Basic Law affords protection against surveillance measures and the German state authority is bound by fundamental rights even in relation to actions taken vis-à-vis foreigners in other countries.
The Court’s ruling in Wieder and Guarnieri v. the UK is seminal, because it clarified for the first time that the Convention rights apply to individuals residing outside the territory of a Contracting State where their electronic communications are at risk of being intercepted, searched and examined by the latter’s intelligence agencies.
Regrettably, the Court’s reasoning is based on a mainly technical circumvention, which risks undermining the robustness of its ruling. This is all the more problematic given the decision’s significance and impact. The Court should have been more courageous in clearly asserting that the applicability of fundamental rights does not end at the national borders and state authorities cannot be exempt from having to adhere to fundamental rights when they engage in transborder surveillance.
Fundamental rights should not lag behind the realities of modern surveillance techniques and the international extension of state activities: States should be held accountable for such novel risks and bring them into the general framework of the rule of law.
Strasbourg Observers is an academic blog that discusses recent developments at the European Court of Human Rights. The editorial team of Strasbourg Observers is based at the Human Rights Centre of Ghent University and the Centre for Government and Law of Hasselt University.
Strasbourg Observers would not be possible without the valued work of countless guest bloggers. Visit the “Contact” page on our website to find out how to become one!
1 Trackback