MI5 breached surveillance laws for more than a decade

With the development of technology and the widespread digitisation of data, data breaches are becoming increasingly common, with half of businesses experiencing some form of cyber security breach or attack within the last 12 months. Governmental departments and public authorities are not immune to this threat.

Since at least 2016, MI5 have wilfully ignored large-scale data breaches and the law by failing to report to the Home Office or another oversight body. Despite the Home Office being alerted to potential data breaches, they failed to investigate MI5, and the Secretary of State continued to issue unlawful warrants. The data breach included private data of individuals gathered by secret surveillance, which, in turn, resulted in multiple violations of key legal safeguards.

Privacy is a fundamental right that everyone deserves. When data is collected for public protection, it should be stored securely to prevent breaches. Keep reading to learn about MI5’s data breaches, the law, and what steps you can take if you’ve been affected by a data breach.

The Tribunal

Six years after the suspected start of the data breaches, MI5 was brought to a tribunal. From the 25th to 29th of July 2022, the case was heard by the Investigatory Powers Tribunal and the human rights organisations Liberty and Privacy International. Liberty and Privacy International both told the tribunal that MI5 had continuously breached surveillance laws, resulting in the Home Secretary issuing unlawful surveillance warrants in bulk.

They also told the tribunal that MI5 had breached key legal safeguards by unlawfully storing and using people’s private and personal data gathered by secret intelligence. The safeguards MI5 broke include how long they had retained the data, who had access to the data, and how MI5 protected legal material such as correspondence between lawyers and clients.

Details of MI5 breaking the law stretch far beyond the six years they are suspected of. In 2019, MI5 was forced to admit that it had unlawfully retained and mishandled the public’s data over a 10-year period.

As part of that case, the Government disclosed several documents, including correspondence between MI5 and its watchdog, the Investigatory Powers Commissioner’s Office (IPCO). The documents included correspondence between MI5 and the Home Office, and reports of inspections carried out by the IPCO after learning of MI5’s failings.

The documents revealed to the court that MI5 considered its own data storage “ungoverned spaces,” with the Investigatory Powers Commissioner concluding that MI5 had handled data in an undoubtedly “unlawful manner.”

The revelation of more documents in 2022 only confirmed the true scale and severity of MI5’s lawlessness. While the information of who and what data was mishandled, it is likely to include those not suspected of any lawbreaking activity due to the broad surveillance powers given to MI5.

Liberty and Privacy International have said the failings of both MI5 and the Home Office violate the public’s right to privacy and free expression. As a result of the tribunal, Liberty and Privacy International have called for all unlawfully issued warrants to be quashed and all unlawfully retained data to be destroyed.

The Law

The unlawful actions of MI5 and the Home Office go hand in hand. The tribunal revealed that the fault lay in both MI5 for ignoring a prolonged issue with data breaches and in the Home Office for continuing to issue unlawful warrants.

MI5 has special powers higher than the police in collecting and retaining data on individuals for national security. What made MI5’s actions unlawful was collecting data from people they didn’t have the right to hold and collect because of the falsely obtained warrants. The subsequent data breach was also not reported according to the law, thus making MI5 guilty on two counts.

The Investigatory Powers Act, introduced in 2016 to supposedly govern surveillance powers, has been criticised for granting MI5 and other state bodies further “dangerous powers […] that continually violate our basic rights”.

The IPA should also work alongside the Data Protection Act 2018 which states that data must be handled securely. Considering ten years of recorded data mishandling and breaches, the IPA is redundant at best in governing behaviour.

The European Convention on Human Rights is another piece of legislation that protects individuals against unlawful data retention. Article 8 of this convention was actually summarised by Liberty and Privacy International, highlighting the state body’s violation of individuals’ right to privacy and freedom of expression.

The future of surveillance and data retention

The tribunal against MI5 demonstrates that current surveillance laws are not fit for purpose and require a complete overhaul, with amendments to legislation a necessity.

Caroline Wilson Palow, the legal director of Privacy International, is among the many voices expressing concern about the Investigatory Powers Act (Snoopers Charter). The Act, intended to govern certain bodies, is often ignored. Palow summarises the findings by saying, “Seven years later, even the rules that are enshrined in law are being ignored in practice. Those rules need a radical overhaul.”

Lawyer Megan Goulding from Liberty International concluded that “mass surveillance does not make us any safer. These powers breach our privacy and undermine core pillars of our democracy.”

HNK Solicitors can help with your unlawful retention of data claim

If you believe your data has been breached, HNK Solicitors can assist with your claim. As illustrated by this case, state bodies can also be guilty of unlawful data retention, and they must be held accountable. By seeking a solicitor, we can help you make a civil claim against the police force for unlawful retention of your data, and gather evidence to support your case.

We specialise in both data breach claims and civil actions against the police and operate on a no-win, no-fee basis, which means you don’t have to pay anything upfront until you receive your compensation. We provide a free consultation with no obligations, during which we can assess the viability of your claim.

To start your claim, you can get in touch with us via our online contact form, email us at enquiries@hnksolicitors.com, or call us on 0151 668 0809.