A court judgement last week by the Investigatory Powers Tribunal found that the government has been illegally collecting information about UK citizens over the last 17 years.
The ruling concerned information collected by the Government Communication Headquarters (GCHQ) in the BCD (Bulk Communications Data) collection and the BPD (Bulk Personal Datasets) programme.
The BCD contains information about when and where communication took place: what phone calls were made at what time, between which email addresses mail was exchanged, as well as Google Maps searches and web browser history. Using intercepted website cookies in combination with logged IP addresses, a person’s identity and communication habits can be charted.
The BPD gathers information such as medical records, electoral registers and tax records – then makes it possible for intelligence agencies to perform searches of these files.
The Investigatory Powers Tribunal is a court independent of any other governmental body. Its tasks include investigating the surveillance undertaken by MI5, MI6, and the GCHQ, and making sure that they abide by the European Convention of Human Rights.
The BCD and BPD were found to be in violation of Article 8 of the Convention, from their respective start dates up until 2015 when new legislation was implemented. The Tribunal found that there were insufficient safeguards against abuse of the collected information. On several occasions members of staff accessed information in the databases for personal use. Another issue was that GCHQ has not been informing Parliament, nor the general public, of what types of information they were capable of collecting, nor for how long they were intending to store it.
It is still unclear what will happen to the databases of the BCD and BPD now that their collection has been deemed illegal. The organisation Privacy International argues that even with the new 2015 legislation, the oversight of the activities of the GCHQ leaves much to be desired. No authorisation by a third party is needed for the collection of data, nor are any procedures in place for informing victims of their data having been misused. No matter what the GCHQ or other agencies do with our data, we simply would not know.
So why are we, the general public, not more upset about information being collected about us in this way? Part of the explanation may lie in the extent of the surveillance having been kept secret. We simply are not aware of how much information is being collected about us, nor how many people have access to it. Furthermore, we might think that we can hide in private browsing windows – when in fact the use of this common web reader function is being logged as well – or find safety in numbers, when the sheer volume of data collected means the odds of someone paying particular attention to ours are minuscule.
And after all, if we are doing nothing wrong, we have nothing to hide, right?
Image: Hannah Wei