MI5 ungoverned spaces challenge

Court: Investigatory Powers Tribunal

Application No: IPT/15/110/CH

Status: Closed

This is a challenge against MI5 in relation to how they handle vast troves of personal data. Privacy International brought this case, together with Liberty, before the Investigatory Powers Tribunal, the judicial body that oversees the intelligence agencies, in January 2020.

In mid-2019, MI5 admitted that personal data was being held in “ungoverned spaces”. Much about these ‘ungoverned spaces’, and how they would effectively be “governed” in the future, remained unclear. At the time of filing, they were understood to be a ‘technical environment’ where personal data of unknown numbers of individuals was being ‘handled’. The use of ‘technical environment’ suggests something more than simply a compilation of a few datasets or databases.

The longstanding and serious failings of MI5 in relation to these ‘ungoverned spaces’ first emerged in Privacy International’s pre-existing case (Privacy International v Secretary of State for Foreign and Commonwealth Affairs and others), started in November 2015, which challenges the processing of bulk personal datasets (BPDs) and bulk communications data (BCD) by the UK Security and Intelligence Agencies. With this challenge we also seek to partially amend PI’s existing claim against MI5.

Then, in proceedings brought by Liberty against the bulk surveillance powers contained in the Investigatory Powers Act 2016 (IPA), MI5 admitted that personal data was being held in ‘ungoverned spaces’, demonstrating a known and continued failure to comply with both statutory and non-statutory safeguards in relation to the handling of bulk data since at least 2014. Importantly, documents disclosed in that litigation, and detailed in our Complaint, showed that the MI5 had sought and obtained bulk interception warrants on the basis of misleading statements made to the relevant authorities.

Privacy International and Liberty argue that MI5’s data handling arrangements result in the systematic violation of the rights to privacy and freedom of expression (as protected in Articles 8 and 10 of the European Convention of Human Rights) and under EU law. Furthermore, the claimants argue that the decisions to issue warrants requested by MI5, in circumstances where the necessary safeguards were lacking, are unlawful and void.

On 30 January 2023, the IPT found that MI5 unlawfully retained huge amounts of personal data between 2014 and 2019. During that period, and as a result of these breaches, warrants issued by subsequent Home Secretaries were unlawful. This amounted to a breach of our right to privacy; it also impacts the privacy of millions of people whose data is handled within these systems.

For a brief explanation of this case, see our article titled “MI5 data-management system akin to the ‘wild west"

*Image by Chris Yang on Unsplash