Venice Commission - Report on a rule of law and human rights compliant regulation of spyware

Disclaimer: this information was gathered by the Secretariat of the Venice Commission on the basis of contributions by the members of the Venice Commission, and complemented with information available from various open sources (academic articles, legal blogs, official information web-sites etc.).

Every effort was made to provide accurate and up-to-date information. For further details please visit our site : https://www.venice.coe.int/

United Kingdom

1. Does your legal framework allow for the use of spyware as a tool of targeted surveillance either in criminal or intelligence investigations or is there an explicit prohibition on the use of spyware? If so, how does your domestic legal framework define spyware?

In the United Kingdom the use of spyware is regulated by the Investigatory Powers Act 2016 (IPA) (see in particular Section 5 on Equipment interference) and the Regulation of Investigatory Powers Act (“RIPA”) 2000 - and so has full parliamentary authority and is accessible and provided by law. Other relevant legislation includes the Human Rights Act 1998 (giving force to the ECHR in the domestic legal system) and the Intelligence Service Act.

2. Are there specific rules (covering notably the scope ratione materiae, temporis and personae) in place or do the general rules on targeted surveillance (interception of communications) apply (could you please provide us with such specific or general rules)?

According to Section 102(5), a targeted thematic equipment interference warrant can only be issued: (i) in the interests of national security, (ii) for the purpose of preventing or detecting serious crimes or (iii) in the interests of the economic well-being of the UK, so far as those interests are also relevant to the interests of national security.
As specified in Section 101 of the IPA, third parties who are sufficiently linked to the main target can also be the object of spyware surveillance.
Section 116 provides that warrants are valid for six months. Targeted surveillance can be carried in the absence of a prior authorisation, provided that such authorisation is granted by the relevant authorising body within three days (Section 109 § 3).

3. What kind of data, if any, could be collected with spyware?

In the United Kingdom Section 99 § 2 of the IPA 2016 provides that communications, equipment data or any other information can be obtained through a targeted equipment interference warrant.

4. Has there been any official evaluation of the need for, or added value of, spyware?

5.Who authorises/approves measures of targeted surveillance in criminal and intelligence investigations (judiciary, executive, expert bodies, security services)?

Authorizations involve the judiciary and the executive. Indeed, Section 108 of the IPA specifies that both in the context of criminal and intelligence investigation, the Investigatory Powers Commissioner (IPC) approves the warrants for equipment interference at the request of public authorities, such as the Secretary of State, intelligence agencies, police and local authorities. The IPC is supported by a team of Judicial Commissioners. They are appointed by the Prime Minister but must hold or have held high judicial office.

6. What are the national oversight mechanisms in place in your country for the activities of the security services (are they judicial, parliamentary, executive, or expert)? Do these bodies have (binding) remedial powers?

There is a detailed oversight regime including an IPC, Judicial Commissioners and an Investigatory Powers Tribunal (IPT). The IPC carries out detailed auditing and reporting of the use of such powers, the Judicial Commissioners are responsible for the authorisation of warrants and notices as well as having their own investigative powers and the IPT is an entirely independent Tribunal established to hear complaints about the misuse of investigatory powers. It is comprised of individuals who have held high judicial office (and the President must be such a person) and senior lawyers. The Tribunal also has power to award compensation and may make orders for the destruction of information and records of information and for the cancellation of warrants.

7. Does a post-surveillance notification mechanism exist? Are there any other remedies available for individual targeted by measures of targeted surveillance?

Unlawful interception of communications which occur intentionally or recklessly are rendered criminal offences.
The IPT has power to award compensation and may make orders for the destruction of information and records of information and for the cancellation of warrants. Rights of appeal to the Court of Appeal are also provided for. The IPT is a judicial body entirely independent of Parliament and Government. Judicial independence is itself enshrined in the Constitutional Reform Act 2005 and no organisation can intervene in any IPT investigation or influence its decisions.