The Regulation of Investigatory Powers Act

To what extent do you believe that the Regulation of Investigatory Powers Act 2000 achieves a balance between upholding the right to privacy while also allowing the State to employ online surveillance techniques in the interests of national security? Increasing level of surveillance permeates almost all aspects of our lives, leading to consequential reduction of personal privacy. The Information Commissioner warned against the dangers of 'sleepwalking into a surveillance society'. 1 The Information Commissioner went further in 2006 by introducing a report 'A surveillance society'2 commissioned by his office.

In this report he acknowledges the benefits of surveillance in fighting terrorism and serious crime and improving entitlement and access to public and private services. However unseen or excess surveillance can encourage a climate of suspicion and undermine trust. 3 This essay will analyse the growth of data surveillance in the online world and see whether the Regulation of Investigatory Power 2000 achieves a balance to right of privacy and the States need to employ online surveillance to protect citizens from terrorist's threats. The main way in which privacy can be threatened is by placing the individual under surveillance.

This surveillance can take a variety of forms. In 1971 Alan Westin4 identified three forms of surveillance physical, psychological and data. Physical surveillance is an age old-established method of observing someone. As the name suggests it involves watching or listening to an individual with the aid of technology. 5 However this method is an expensive form of surveillance and can only be applied to a limited number of individuals. Psychological surveillance includes forms of interrogation, again costs of using this method gives it a limited usage in society. 6

Both the above surveillance techniques involve the watcher to play an active role. Data surveillance involves a more passive approach. Clarke describes dataveillance is the systematic use of personal data systems in the investigation or monitoring of actions of communication one or more person. 7 Computers were originally developed for their high speed capabilities. But the advancement of technology means that data can now be captured, stored and accessed more readily even when their users are dispersed. 8 The information revealed by an individual reveals something about that person.

This method involves the collection and retention of this information. With the growth of the internet and the ability to digitise any form of information the distinct boundaries between the types of surveillance are disappearing with technology linking the different methods of surveillance into 'a near seamless web of surveillance'. 9 Furthermore, the development in data processing means that systems of physical surveillance significantly by the involvement of the computer to digitise and process the information.

Significant difficulties have to be overcome when attempting to give privacy a concrete legal meaning. A number of definitions for privacy had been formulated over the years. The classic definition was given by a United State judge, Judge Cooley who stated that it consists of a 'right to left alone. '10 The essential component as stated by Lloyd is that an individual has the right to control the extent to which their personal information is dispersed to other people. 11 This notion of privacy has two main components.

The first is the right to live free from the attention of others in essence to avoid being watched. The second element is to control the use of information once gained. 12 Whilst surveillance is seen as a stealthy and unwelcome way of collecting personal data, this is not the case. Although members of the public may claim they value privacy, they do very little to protect themselves. Thousands of individuals have applied for supermarket 'loyalty cards'. 13 These cards provide a link between details of individual transaction and the stock management computer system.

Analysis of the information will reveal much about the individual's habits and lifestyle which may be used as a basis of direct marketing. Until 1985 the UK had no legislative framework available to deal with interception of communications. So for example phone tapping was only regulated by the police internal code of guidance, which was not made public. 14 This state of affairs was challenged in the ECHR case of Malone v United Kingdom15. Here the ECHR held the UK practice of interception was not under adequate legal regulation.

The UK citizens could not assess whether their telephone would be tapped, nor could they determine the basis in law for such surveillance. The UK's response was to pass the Interception of Communications Act16 which put interceptions by public bodies in a statute and provided some oversight of interception activities. However, the 1985 Act fell short of a concrete regulatory mechanism as did not apply to telecommunications systems outside the public network, such as internal systems, and there was no other UK legislation to regulate the interception of communications on such systems.

17 So employers engaging in the interception of both telephone calls and email within private networks appeared to be able to do so with relative ease without fear from prosecution under the law. This was illustrated in the case of Halford v United Kingdom. 18 In this case Ms Halfords telephone conversations were tapped by her employer to obtain information detrimental to her. The office was part of a private internal network, so fell outside the scope of the ICA 1985. As she could not challenge the alleged tap in court, she brought an action against the UK government alleging a breach of the ECHR Article 8.

The ECHR held that calls intercepted from her office telephone could fall within the scope of 'private life' in Article 8(1) ECHR, and that her employers had not informed her that her calls may be liable to interception. However Article 8(2) requires that the interference by a public authority must be 'in accordance with the law'. Since there was no UK law relating to regulation of interception of calls made on telecommunication systems outside the public network, the Court held that the interference could not be 'in accordance with the law'.

19 No statutory system of regulating the use of surveillance devices by the police was available until the enactment of the Regulation of Investigatory Powers Act 200020 (RIPA). RIPA is the government's response to the finding the ECHR in Halford case where the UK did not comply with Article 8. It was primarily designed to ensure compliance with the Convention to ensure that powers to intercept telecommunication and investigate surveillance of individuals are used in accordance to Article 8 of the European Convention. 21

With regards to internet surveillance RIPA sets out guidance to a partial defence of surveillance as including monitoring, observing or listening to persons, recording anything monitored and surveillance by or with the assistance of a surveillance device. 22 The Home Office argues that RIPA is capable of responding to current and future needs, but whether traditional definitions of surveillance remain appropriate for the modern world is a moot point. These concerns are based on technological advancement meaning individuals can now be monitored in ways not included within traditional understanding of surveillance.

The concept of web surveillance falls into this category as it was not directly considered when the regulatory regime was created. In the absence of strict electronic surveillance regulation, it is necessary to consider where web surveillance falls under in the existing regulatory framework. 23 It is clear that surveillance requires authorisation where it interferes with Article 8, so would a person using the web have legitimate expectation to privacy.

If they do then an Article 8(1) right is established and then accordingly a reason under Article 8(2) will be required for surveillance to be authorised. McArthur suggests that there can be no expectation of privacy on the internet. He believes that the internet is a public space and only situations where measures have been taken to conceal a person's identity or block tracking software should there be any suggestion of privacy. 24 Gillespie questions McArthur's view and states 'Does the mere fact that something occurs in public mean that there can be no expectation of privacy?

'25 The answer to this is 'no' and support for Gillespie's view can be seen through the decisions made by the European Court of Human Rights. In Von Hannover v Germany26 the Court upheld a complaint by Princess Caroline of Monaco who had been photographed by paparazzi whilst engaged in ordinary activities such as horse riding and eating in a restaurant. The Court stated that Article 8(1) ensures that persons are allowed to proceed with their ordinary life without outside interference and that Article 8(1) protects someone even in public places if there is a legitimate expectation of privacy.

27 The decision in Von Hannover only applies to a right to privacy in a public setting when an expectation of privacy arises. The fact a person is in a public place will not prevent a right under Article 8(1). Where someone merely acts in a public place the observance and recording of that act will not give rise to an expectation of privacy. This is illustrated in the case of Peck v United Kingdom28 where the applicant was recorded on CCTV after attempting to commit suicide. The footage was released to several media companies.

The ECHR upheld a breach of Article 8 but on the basis that the footage being released interfered with the applicant's private life rather than the original recording of the incident. In PG v United Kingdom 29the Court upheld a claim under Article 8(1) that the recording of two suspects voices whilst in custody amounts to a breach in respect to family life. The Court rejected the argument that a police cell was a public space and stated that an expectation of privacy could arise here.