The 122-page report recently published (on November 3, 2026) by the international organization Privacy International, titled “Artificial Intelligence Agencies: The use and regulation of AI in UK Intelligence Agencies” highlights the extensive surveillance capabilities being acquired by British intelligence agencies, as well as the shortcomings of the existing legislative framework.
In this context, the case law of the European Court of Human Rights (ECHR) takes on critical importance, as it defines the boundaries within which the invocation of national security may justify intrusions into private life.
According to the report, the British intelligence agencies MI5 (internal security and counterintelligence), MI6 (foreign espionage) and GCHQ (electronic communications and cyber security) are increasingly using artificial intelligence technologies to collect, manage and analyze an incalculable amount of data.
Applications include processing telecommunications information, recognizing behavioral patterns, mapping social relationships, creating individual profiles and predicting potential threats.
The essential change brought about by artificial intelligence lies not only in the acceleration of information processing, but in the qualitative expansion of the possibility of state intervention.
Artificial intelligence allows combining data from different sources and drawing new conclusions, which do not arise from the independent examination of the original information.
Even seemingly innocent, innocuous or publicly available data can be used to form critical conclusions about a person’s personality, political beliefs or social contacts.
The report also includes journalistic revelations about the use of artificial intelligence by the Israeli military intelligence services during the war in Gaza. Specific reference is made to the Lavender and Gospel systems, which, according to sources cited by Privacy International, were used to analyze surveillance and targeting data (pp. 24-25).
Another striking example can be found in China, where artificial intelligence is utilized for mass surveillance and population control.
There, state authorities monitor the Uyghur Muslim minority, with citizens being sent to “re-education” camps based on opaque algorithmic assessments (p. 23).
One of the key findings by Privacy International is that the British legislative framework remains largely fragmented and inadequately adapted to modern technological capabilities.
The Investigatory Powers Act, which governs the surveillance powers of intelligence agencies, includes procedural safeguards for data collection; however, it fails to specifically and comprehensively address the subsequent processing of such data through artificial intelligence.
Consequently, an intelligence-gathering activity may be based on lawful authorization, even though the potential application of algorithmic models, the merging of databases, or the creation of predictive profiles has not been sufficiently evaluated.
The ECHR and Case Law
Furthermore, Privacy International points out that broad national security exemptions within personal data protection legislation can significantly limit the effectiveness of existing safeguards.
This problem is compounded by the institutionalized secrecy surrounding intelligence services, which hinders both independent oversight and the ability of affected individuals to effectively pursue legal remedies.
The report draws extensively on the case law of the European Court of Human Rights (ECHR) to demonstrate that, while the protection of national security is in principle a legitimate objective for restricting the right to privacy, it does not exempt states from the requirements of Article 8 of the European Convention on Human Rights (ECHR).
In the case of Klass and Others v. Germany (6 September 1978), the ECHR acknowledged that, under certain conditions, secret surveillance may be necessary for the protection of national security.
However, the Court emphasized that a system of secret surveillance could potentially undermine—or even destroy—democratic processes under the guise of protecting them. For this reason, adequate and effective safeguards against abuse are required. Similarly, the judgments in Roman Zakharov v. Russia (4 December 2015) and Szabó and Vissy v. Hungary (12 January 2016) highlight the stringent requirements stemming from Article 8 of the ECHR regarding the legality, necessity, and oversight of covert surveillance measures.
The report cites these cases to underscore that the collection of sensitive information and communications constitutes an interference with private life, which requires an adequate legal basis and effective safeguards.
In the judgment Big Brother Watch and Others v. the United Kingdom (25 May 2021), the Grand Chamber of the ECtHR examined the compatibility of bulk communications interception systems (under the Regulation of Investigatory Powers Act 2000) with the ECHR, and established oversight requirements for successive stages of the surveillance process.
It emphasized the criteria used to select information for examination (“selectors”), requiring additional safeguards when these are linked to identifiable individuals.
Adjustment of Safeguards
Privacy International argues that the use of artificial intelligence makes the adaptation of these safeguards even more imperative.
Modern systems can analyze data on a massive scale without being limited to specific phone numbers or other traditional identifiers; instead, they utilize general descriptions of behavior or potential threats. Consequently, existing oversight criteria may no longer correspond to the actual extent of the intrusion.
In the case of Peck v. the United Kingdom (28/1/2003), the ECHR acknowledged that activities taking place in a public space can fall within the scope of the right to privacy, particularly when they are subject to systematic recording.
In the cases of Rotaru v. Romania (4/5/2000) and Amann v. Switzerland (16/2/2000), the Court examined the collection and retention of personal information by state authorities, recognizing its significance in the context of Article 8 of the ECHR.
Finally, the report cites the case of S. and Marper v. the United Kingdom (4/12/2008) concerning the retention of biometric data (fingerprints, cellular samples, etc.). Drawing on the principles established in the ruling, it argues that certain forms of mass collection and algorithmic processing of sensitive biometric information may be disproportionate, even when accompanied by procedural safeguards.
In the final pages of the report, Privacy International recommends the establishment of specific rules for every stage of the use of artificial intelligence by intelligence agencies—from data collection to the generation of algorithmic inferences and decision-making.
Proposals include the mandatory disclosure of the use of artificial intelligence in surveillance authorization requests, the independent assessment of the necessity and proportionality of algorithmic processing, and the strengthening of the powers of independent oversight authorities.
Great importance is placed on the technical feasibility of auditing these systems, their training data, and their outputs.
The organization also advocates for a total ban on certain applications, including fully automated decisions with significant impacts on individuals, real-time biometric identification, predictive risk assessment based solely on individual characteristics, and the targeting of individuals for exercising their fundamental rights.
The Dynamic Nature of Legality
The report by Privacy International highlights a fundamental challenge for the modern rule of law: the legality of the initial collection of information does not necessarily imply the legality of any subsequent algorithmic processing of that data.
The critical conclusion is that artificial intelligence cannot be treated merely as a technical tool for intelligence services; rather, it acts as a factor that fundamentally alters the intensity and scope of state surveillance power.
In this sense, the effective protection of fundamental rights requires not only the oversight of information collection but also substantive legal and technical supervision of the subsequent algorithmic processes.
