HMRC has been ordered to reconsider a request to disclose whether a surveillance technology firm is under investigation.
Campaign group Privacy International (PI) alleges that British company Gamma International has supplied equipment to “repressive” regimes with records of human rights abuse to spy on political activists and had submitted a dossier of evidence to HMRC , which is responsible for enforcing UK export controls.
The allegations relate to Gamma's FinFisher products, designed to covertly install malware on a user's computer or mobile phone without their knowledge by tricking them into downloading fake updates.
Once the software is installed the victim’s devices can be taken over, the cameras and microphones remotely switched on, emails, instant messengers and voice calls monitored, and locations tracked.
Following a request for information on the status of any investigation HMRC told PI that it had no power or duty to provide information or progress reports about any investigations it was conducting, but today a High Court judge ruled that the 2013 decision was taken unlawfully and must be reconsidered.
The campaign group had applied for judicial review on its own behalf and two political activists who say they are victims of criminal surveillance by the security forces of Bahrain and Ethiopia and entitled to know about any investigations, or if none are taking place.
Lawyers for the group submitted that the equipment used by the security agents was supplied by Gamma in breach of export regulations, though the allegations have been denied and Gamma has repeatedly stated that it only supplies products and services to legitimate government organisations.
PI had told HMRC: "At the most serious end of the spectrum, we believe that Gamma's technologies are being used to gather information on individuals who are then arrested, tortured and, in some cases, executed."
Mr Justice Green, sitting in London, stressed that he had not heard any evidence from Gamma and said his judgment dealt only with the powers and duties of HMRC and he was not ruling on the merits of the complaints lodged.
He ruled the decision not to disclose information must be retaken for several reasons, including misdirections and errors of law by HMRC decision makers and their "irrational" failure to obtain advice or guidance from the unit responsible for assessing PI's complaint.
The judge also said "new reasons" had been given for the decision which were inconsistent with those in decision letters.
Giving guidance for a re-hearing, the judge said NGOs like PI "can act as guardians of the public conscience".
He said: "As with the press their very existence and the pressure they bring to bear on particular issues, and upon those who are responsible for governance of those issues, is one of the significant checks and balances in a democratic society. They have, therefore, a significant role to play."
However the nature and extent of information which could be provided to them "may depend on the circumstances of a given case".
The judge said the HMRC had treated as "a sufficient generic reason" to withhold information from PI that it could impact upon the reputations of individuals or companies.
He ruled: "To adopt this stance was unlawful. Even if there is some reputational harm, that still has to be balanced against other interests, including the public interest in transparency and disclosure."