MI5’s retention of innocent people’s data ‘undoubtedly unlawful’

The accusations have emerged from internal documents released in the High Court as part of a case brought by the civil rights group Liberty against the Home Office over what it claims is unlawful surveillance by the security services and misuse of the Investigatory Powers Act (IPA).

The Act provides the security services with powers, under warrants issued by judicial commissioners, to ‘hack’ computers and phones and intercept communications. These powers allow the Government to carry out ‘bulk surveillance’ on people who are of no intelligence interest. That information is then stored by the security services for potential investigations in the future.

The Act includes safeguards about how this information is stored and handled. It is against the law to keep data when it is no longer needed, or to store it in an unsafe way.

The Investigatory Powers Commissioner’s Office (IPCO) is responsible for ensuring that privacy protections contained in the IPA are upheld, including that safeguards around storage and timely deletion of data are met.

Following the initial revelations last month that MI5 had breached IPA privacy safeguards, further documents and letters from MI5 and have since revealed more detail of those breaches, including that MI5 has failed to meet its legal duties for as long as the IPA has been law.

The failures have led the Investigatory Powers Commissioner, Lord Justice Fulford, to conclude that MI5’s method of holding and handling people’s data was “undoubtedly unlawful”, saying: “Without seeking to be emotive, I consider that MI5’s use of warranted data… is currently, in effect, in ‘special measures’ and the historical lack of compliance… is of such gravity that IPCO will need to be satisfied to a greater degree than usual that it is ‘fit for purpose’.”

The Government has applied for further details on MI5’s breaches to be provided to the court through secret evidence and private hearings.

Megan Goulding, Liberty lawyer, said: “These shocking revelations expose how MI5 has been illegally mishandling our data for years, storing it when they have no legal basis to do so. This could include our most deeply sensitive information – our calls and messages, our location data, our web browsing history. It is unacceptable that the public is only learning now about these serious breaches after the Government has been forced into revealing them in the course of Liberty’s legal challenge.”

The court heard that senior officials at MI5 were aware three years ago that there were serious issues with the management of data. MI5 informed the Home Office and Number 10 of the concerns in April this year, but the commissioner said they should have revealed them earlier.

Discussions between lawyers and clients were among the information wrongly held by the security service. Liberty said such material should be protected by legal privilege, but instead it was being seen by people at MI5.

Lawyers for MI5 said they could not explain the exact nature of the breaches in open court, not because they were “embarrassing” but because there were “serious national security concerns”.

Home Secretary Sajid Javid said MI5 has now taken “immediate and substantial steps” to comply with the law.

Julian Milford, representing Mr Javid and Foreign Secretary Jeremy Hunt, acknowledged in court “the existence of serious compliance risks”.

But he added that these specific issues were a “complete irrelevance” to Liberty’s court case, which was challenging the legality of the whole system of information gathering created by the IPA.