A selection of key paragraphs can be found below the judgment.
II. THE BULK INTERCEPTION OF COMMUNICATIONS
B. The alleged violation of Article 8 of the Convention
425. Nonetheless, the Court recalls that there is considerable potential for bulk interception to be abused in a manner adversely affecting the rights of individuals to respect for private life (see paragraph 347 above). Therefore, in a State governed by the rule of law, which is expressly mentioned in the Preamble to the Convention and is inherent in the object and purpose of Article 8 (see Roman Zakharov, cited above, § 228), the Court considers that, when viewed as a whole, the section 8(4) regime, despite its safeguards, including some robust ones as highlighted above (see, for example, paragraphs 412 and 415 above), did not contain sufficient “end–to–end” safeguards to provide adequate and effective guarantees against arbitrariness and the risk of abuse. In particular, it has identified the following fundamental deficiencies in the regime: the absence of independent authorisation, the failure to include the categories of selectors in the application for a warrant, and the failure to subject selectors linked to an individual to prior internal authorisation (see paragraphs 377–382 above). These weaknesses concerned not only the interception of the contents of communications but also the interception of related communications data (see paragraph 416 above). While the IC Commissioner provided independent and effective oversight of the regime, and the IPT offered a robust judicial remedy to anyone who suspected that his or her communications had been intercepted by the intelligence services, these important safeguards were not sufficient to counterbalance the shortcomings highlighted at paragraphs 377–382 above.
426. In view of the aforementioned shortcomings, the Court finds that section 8(4) did not meet the “quality of law” requirement and was therefore incapable of keeping the “interference” to what was “necessary in a democratic society”.
427. There has accordingly been a violation of Article 8 of the Convention.
C. The alleged violation of Article 10 of the Convention
456. In light of the above, the Court would accept that the safeguards in the IC Code concerning the storage, onward transmission and destruction of confidential journalistic material were adequate. However, the additional safeguards in the IC Code did not address the weaknesses identified by the Court in its analysis of the regime under Article 8 of the Convention, nor did they satisfy the requirements identified by the Court at paragraphs 448‑450 above. In particular, there was no requirement that the use of selectors or search terms known to be connected to a journalist be authorised by a judge or other independent and impartial decision-making body invested with the power to determine whether it was “justified by an overriding requirement in the public interest” and whether a less intrusive measure might have sufficed to serve the overriding public interest. On the contrary, where the intention was to access confidential journalistic material, or that was highly probable in view of the use of selectors connected to a journalist, all that was required was that the reasons for doing so, and the necessity and proportionality of doing so, be documented clearly.
457. Moreover, there were insufficient safeguards in place to ensure that once it became apparent that a communication which had not been selected for examination through the deliberate use of a selector or search term known to be connected to a journalist nevertheless contained confidential journalistic material, it could only continue to be stored and examined by an analyst if authorised by a judge or other independent and impartial decision‑making body invested with the power to determine whether its continued storage and examination was “justified by an overriding requirement in the public interest”. Instead, all that was required by paragraph 4.2 of the IC Code was that “particular consideration” be given to any interception which might have involved the interception of confidential journalistic material, including consideration of any possible mitigation steps (see paragraph 96 above).
458. In view both of these weakness, and those identified by the Court in its consideration of the complaint under Article 8 of the Convention, it finds that there has also been a breach of Article 10 of the Convention by virtue of the operation of the section 8(4) regime.