Security News > 2022 > April > UK spy agencies sharing bulk personal data with foreign allies was legal, says court

A privacy rights org this week lost an appeal [PDF] in a case about the sharing of Bulk Personal Datasets by MI5, MI6, and GCHQ with foreign intelligence agencies.

The decision means a contested part of a 2018 ruling by the IPT will stand: that safeguards and rules around data collection between 2015 to 2017 by the state agencies meant that sharing that data was legal - "Compatible with article 8 of the European Convention of Human Rights."

The British agencies have also never stated, in public, whether any of them have shared BPDs with foreign intelligence agencies - they have a so-called "Neither confirm nor deny" policy - but the judgment noted it "Proceeds on the assumption that sharing has taken place."

The IPT ruled in 2016 that bulk collection of personal data by GCHQ and MI5 between 1998 and 2015 was illegal, with the post-2015 cases considering the transfer of data to other bodies.

Last year The Register exclusively revealed that, according to a Home Office report, MI5's storage of personal data on espionage subjects was still facing "Legal compliance risk" issues despite years of warnings from regulator IPCO. Answering the question of whether MI5's data holdings are "Now legally compliant," a Home Office report published on June 7 last year said MI5's "Implementation of mitigations" for "Identified risks" was still under way.

Separately, the UK government last week settled two human rights claims brought under Articles 8 and 10 of the European Convention on Human Rights, handing £1,000 apiece in costs to Bureau of Investigative Journalism global editor James Ball and NGO Human Rights Watch.

News URL

https://go.theregister.com/feed/www.theregister.com/2022/04/06/privacy_international_vs_ipt/