Privacy and Freedom of Expression in the Context of the UK’s Eighth Periodic Review Before the UN Human Rights Committee

[Darryl Chan, LLM, is currently at an intergovernmental organisation for disarmament and has previously served as a research assistant to a member of the UN International Law Commission and at the Legal Division of the International Committee of the Red Cross.]

The author was present at the Committee’s 140th session in Geneva, including for the 8th periodic review of the UK.

Introduction

On 12 and 13 March 2024, the United Nations (UN) Human Rights Committee held its eighth periodic review of the United Kingdom of Great Britain and Northern Ireland (UK) on its compliance with the International Covenant on Civil and Political Rights (ICCPR). The rights to privacy and freedom of expression, as contained in Articles 17 and 19 of the ICCPR respectively, featured in the dialogue between the State party and the Committee. This was in light of recent legislation in the UK regarding bulk data collection, censorship, and the interception of online communications. There had also been recent developments in the UK on the use of facial recognition technology, intelligence sharing arrangements, and location tracking. The Committee was concerned that these changes in the legislative framework and practice affected the enjoyment of the rights to privacy and freedom of expression by persons under the jurisdiction of the UK. This article explores the issues of bulk data collection and censorship.

Bulk Data Collection

The Investigatory Powers (Amendment) Bill of 2023 amends the Investigatory Powers Act of 2016, which provides for bulk data collection in the form of bulk personal datasets. As defined in Article 199(1)(b) of the 2016 Act, bulk personal datasets are those which are of such a nature that “the majority of the individuals [whose personal information is retained] are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions”. The 2023 Bill reduces the threshold for access to datasets which carry a “low or no reasonable expectation of privacy” and sets out various factors for the determination of whether a “low or no reasonable expectation of privacy” attaches.

The UN Human Rights Committee asked the UK about the measures it was taking to ensure that the categorisation of bulk personal datasets would be based on concrete assessments of individuals’ reasonable expectations of privacy. In its response, the UK contended that its data collection regime contains strong safeguards to ensure that investigatory powers are used in a necessary and proportionate manner, including independent oversight, a right to redress, and a high threshold for the deployment of such powers. The safeguards they mentioned include a ‘double lock’ mechanism which requires warrants to be signed by both the executive and judicial branches. According to the UK, any data which is collected in bulk would be well-protected by safeguards on their access.

The UK explained the rationale for bulk data collection: bulk personal datasets are an essential tool for the disruption of threats such as terrorism and hostile actions by other States. For instance, bulk personal datasets allow intelligence agencies to spot individual behaviours which, when aggregated, could lead to the discovery of a threat. The UK asserted that the use of bulk personal datasets might be a less intrusive technique than the alternatives which could be used for these purposes.

On the UK’s claim, the Committee noted that the anticipated changes to bulk data collection could better serve investigatory aims but sought clarification on how the changes would better protect the right to privacy. In this regard, the UK described the 2023 Bill as an expansion of the oversight regime: it would require judicial authorisation, political oversight, and accountability for the use of investigatory powers.

In L.B. v Hungary, the Grand Chamber of the European Court of Human Rights held that “the protection of personal data is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the [European] Convention [on Human Rights].” Bulk data collection potentially represents a serious interference with the right to privacy because of the number of individuals affected. This being so, it is all the more critical to ensure that bulk data collection is only carried out for legitimate purposes where it is a necessary means to achieve such purposes and in a proportionate manner. The question of whether bulk data collection is necessary and proportionate to fight terrorism and threats emanating from hostile States might bear further consideration. Furthermore, the factors which are taken into consideration in the 2023 Bill for assessing a “low or no reasonable expectation of privacy” include “the extent to which the data has been made public by the individuals”. On this point, it is apposite to recall that in Satakunnan Markkinapörssi Oy and Satamedia Oy v Finland, the Strasbourg Court’s Grand Chamber held that “The fact that information is already in the public domain will not necessarily remove the protection of Article 8 of the Convention.” There therefore remains a requirement to balance the need to retain the information gathered in bulk datasets against the privacy of the individuals concerned. In the author’s view, it is important for legislation which enables the bulk collection of data to explicitly specify this countervailing consideration, which should not be left to be implied. 

In its concluding observations, the Committee expressed concern that the 2023 Bill “fails to provide strict safeguards and oversight” in accord with the right to privacy and that “the Bill’s regulation of bulk information has the potential to lead to overly broad collection of personal data.” It therefore urged the UK to “apply strict safeguards and oversight, including judicial review”.

Censorship

The UK’s Online Safety Act of 2023 in Articles 59(5)(c)(iii) and (iv) empowers the Secretary of State and any other Minister of the Crown to designate content as illegal. Service providers must, under Article 10(3) of the Online Safety Act, “swiftly take down such content.”

During the dialogue with the State party, the UN Human Rights Committee expressed concern that the Act undermines the right to freedom of expression by giving unchecked censorship powers to ministers. In its response, the UK asserted that the Online Safety Act defends privacy, the freedom of expression, and freedom of the press. It explained that services must consider and implement safeguards for freedom of expression when fulfilling their duties under the Act. Furthermore, the largest platforms with the most significant impact on public discourse would have duties to safeguard freedom of expression in order to mitigate against the over-removal of content. Duties would also be imposed on service providers against the arbitrary removal or restriction of legal content and arbitrary suspension or banning of users. Service providers would have to implement reporting mechanisms to allow users to challenge wrongful takedowns of content and the non-fulfilment by service providers of their duties under the Act.

Although it may concurrently protect and promote the right to freedom of expression, legislation allowing for censorship should always guard against unchecked ministerial powers. For instance, notwithstanding that duties of service providers against arbitrary removal or restriction may apply to legal content, the designation of content as legal or illegal should not remain the unrestrained imperative of the executive branch.

Indeed, the principle of legality requires that interferences with the right to freedom of expression be prescribed by law. As held by the Grand Chamber of the European Court of Human Rights in Perinçek v Switzerland, an interference can only be said to be prescribed by law if it is “formulated with sufficient precision to enable the person concerned to regulate his or her conduct,” notwithstanding that absolute certainty is not required. This finding of the Court is reminiscent of the principles set out by Fuller in his theory on the inner morality of law. In Karastelev and others v Russia, the Strasbourg Court held that an unfettered discretion to interfere with the right to freedom of expression does not satisfy the requirement of foreseeability. The Court stated: “For domestic law to meet those requirements it must afford a measure of legal protection against arbitrary interferences by public authorities with the rights safeguarded by the Convention. In matters affecting fundamental rights it would be contrary to the rule of law, one of the basic principles of a democratic society enshrined in the Convention, for a legal discretion granted to the executive to be expressed in terms of an unfettered power. Consequently, the law must indicate with sufficient clarity the scope of any such discretion conferred on the competent authorities and the manner of its exercise.” It is therefore important for there to be limitations on the exercise of discretion by the executive branch in its designation of content as illegal and subject to takedown. 

In its concluding observations, the Committee expressed concern that the Act gives “unchecked censorship powers to Ministers”, which may undermine the right to freedom of expression.

Conclusion

The full implementation of the ICCPR in the collection of information and the freedom to communicate information is complex to achieve especially in the context of the regulation of emerging technologies, but some clarificatory guidance can be found in the jurisprudence.

As the Committee stated in its General Comment No. 16, “interference authorized by States with the right to privacy can only take place on the basis of law, which itself must comply with the provisions, aims and objectives of the Covenant.” As referred to also by the Inter-American Court of Human Rights in Tristán Donoso v Panamá (para. 56), any interferences with the right to privacy should therefore be subject to the principle of necessity and to a balancing test which takes full account of the individual’s right to privacy. 

On the right to freedom of expression, the Committee was clear in its General Comment No. 34 that, flowing from the principle of legality, “A law may not confer unfettered discretion for the restriction of freedom of expression on those charged with its execution.” The nature of the discretion conferred upon the executive branch to censor information should therefore necessarily be subject to limitations and circumscribed by law.

These conclusions are in accord with the Committee’s concluding observations on the eighth periodic report of the UK, urging the State party to “ensure that proposals in the Investigatory Powers (Amendment) Bill apply strict safeguards and oversight, including judicial review, in compliance with international standards” and recommending that the State party “should adopt and effectively enforce measures to ensure that the Online Safety Act does not undermine the right to freedom of expression.” In the context of bulk data collection, which should only occur where absolutely necessary and should be confined to affect the least number of individuals possible, data collected could be anonymised for the purpose of analysis and only deanonymised where sufficiently justified, such as where irregularities indicative of a terrorist threat have been identified to a requisite degree of certainty. In the context of censorship, limitations on ministerial discretion should be specified in detail. These suggestions are congruent with the 2024 concluding observations of the Committee to the UK, the prior general comments of the Committee, and the case law of the regional human rights courts, which consistently raise concerns about the continued enjoyment of the rights to privacy and freedom of expression in the context of the developments in bulk information collection and censorship in the UK.