Data breaches by UK Secret Service MI5

The UK Investigatory Powers Act gives the government the power to gather information about what people say and do online, even when they are not suspected of a crime. In 2019, it was revealed during a case taken by Liberty that the UK Security Service, MI5, for years may have been unlawfully copying and sharing innocent people’s data and storing it insecurely and for longer than allowed. Some members of MI5 had known about the risk of legal breach for years but kept it hidden.

Liberty and Privacy International brought a joint case to the UK Investigatory Powers Tribunal arguing that MI5 used and retained surveillance data illegally, violating safeguards meant to limit how agencies handle this data. The hearing at the tribunal took place from 25-29 July 2022.

This case is an important piece of litigation for Liberty’s overall strategy of stopping mass surveillance, as it demonstrates that the legal safeguards that exist in legislation around mass surveillance are illusory in practice.

On 30 January 2023, the tribunal made their decision, agreeing with Liberty and Privacy International’s arguments that MI5, in breach of key legal safeguards, unlawfully handled individuals’ private data that was gathered by secret surveillance. Additionally, they found that successive Home Secretaries did not enquire into or resolve this long-standing rule-breaking despite obvious red flags.