Data breaches by UK Secret Service MI5
Privacy and data protection
The UK Investigatory Powers Act gives the government the power to gather information about what people say and do online, even when they are not suspected of a crime. In 2019, it was revealed during a case taken by Liberty that the UK Security Service, MI5, for years may have been unlawfully copying and sharing innocent people’s data and storing it insecurely and for longer than allowed. Some members of MI5 had known about the risk of legal breach for years but kept it hidden.
Liberty and Privacy International brought a joint case to the UK Investigatory Powers Tribunal arguing that MI5 used and retained surveillance data illegally, violating safeguards meant to limit how agencies handle this data. This case is an important piece of litigation for Liberty’s overall strategy of stopping mass surveillance, as it demonstrates that the legal safeguards that do exist in legislation around mass surveillance are illusory in practice.
"MI5 used and retained surveillance data illegally, violating safeguards meant to limit how agencies handle this data"
The Tribunal rules that MI5’s actions were unlawful and that the Investigatory Powers Act is unlawful for not providing effective safeguards in practice. The Investigatory Powers Act is changed so that only those suspected of wrongdoing can have their data collected and stored, and that this data is stored securely.