Committee (5th Day) (Continued)
210ZA: Clause 151, page 118, line 8, leave out subsection (5)
My Lords, my noble friend and I decided that I would be the one to confess how difficult I find it to understand Clause 151(5), so this is a probing amendment. I managed to make some progress in following the trail between different clauses and subsections this morning, but it involved something like copying and pasting chunks of wording in my head. I would therefore be grateful if the Minister could explain straightforwardly what follows from modifying a bulk acquisition warrant so that it no longer authorises or requires telecoms operators to do what is listed in Clause 146(5)(a). We are told to disregard Clause 151(2)(a), but the same criteria are then brought in by reference to Clause 146(1)(a) and Clause 146(2). I am sorry to be dim, but we decided that this probably justified seeking a short explanation.
I have complimented the draftsmen of the Bill—and I do not resile from that—as it is very helpful to have references to where definitions are to be found and so on, but given the complexity of the subject matter, this is a plea for the Bill to say, for example, “If a warrant is modified so that there is no requirement on a telecoms operator, then, in the case of renewal, the following”. That would have caused slightly less of a scrambled brain. I beg to move.
My Lords, as the noble Baroness has explained, Amendment 210ZA relates to the modification of a bulk acquisition warrant for the purpose of allowing examination of material after acquisition has ceased. Here, we come back to the issue that we debated earlier in relation to Amendments 201ZC and 217C, which covered bulk interception and bulk equipment interference warrants. The amendment would remove important technical provisions from the Bill—a point that I made in that earlier debate.
The Bill enables a bulk acquisition warrant to be modified such that it no longer authorises the acquisition of any material but continues to authorise the selection of material for examination. The circumstances catered for here are limited to a situation where it may no longer be necessary or possible to continue the collection of data, such as where a communications service provider goes out of business, but the data collected up to that point under a warrant remain pertinent. In circumstances such as those, it may continue to be necessary and proportionate to examine data that have already been collected under that warrant.
Clause 151(5), which the amendment would remove, simply clarifies that a warrant that has been modified in that way remains a valid bulk warrant if the Secretary of State considers that examination of the acquired data remains necessary and it is approved by a judicial commissioner. That is necessary because Clause 146(5) states that one of the conditions of the warrant is that its main purpose is to acquire data. But, of course, a warrant that has been modified in the manner I have described will no longer meet that condition because it will no longer authorise the collection of data.
I hope that that explanation clarifies any uncertainty in the noble Baroness’s mind and that she will agree that these provisions are necessary.
Amendment 210ZA withdrawn.
Clause 151, as amended, agreed.
Clause 152: Modification of warrants
Amendments 210ZB and 210ZC not moved.
Clause 152 agreed.
Clause 153: Approval of major modifications made in urgent cases
Amendment 210ZD not moved.
Clause 153 agreed.
Clauses 154 to 156 agreed.
Clause 157: Duty of operators to assist with implementation
Amendment 210ZE not moved.
Clause 157 agreed.
Clause 158: Safeguards relating to the retention and disclosure of data
Amendment 210ZF not moved.
Amendment 210ZG had been withdrawn from the Marshalled List.
Clause 158 agreed.
Clause 159 agreed.
Amendment 210A not moved.
Clauses 160 to 163 agreed.
Clause 164: Power to issue bulk equipment interference warrants
Amendments 210B and 210C not moved.
Clause 164 agreed.
Clause 165: Approval of warrants by Judicial Commissioners
Amendments 211 and 212
211: Clause 165, page 128, line 23, after “must” insert “—
212: Clause 165, page 128, line 24, at end insert “, and
( ) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).”
Amendments 211 and 212 agreed.
Clause 165, as amended, agreed.
Clause 166 agreed.
Clause 167: Failure to approve warrant issued in urgent case
212A: Clause 167, page 129, line 10, at end insert “and is reported to the Judicial Commissioner”
My Lords, I rise to move Amendment 212A standing in my name and that of my noble friend Lady Hamwee. Clause 167 deals with the situation in which a judicial commissioner fails to approve a decision to issue a bulk interference warrant in urgent cases. When this happens, under Clause 167(2) the person to whom the warrant is addressed,
“must, so far as is reasonably practicable, secure that anything in the process of being done under the warrant stops as soon as possible”.
Our Amendment 212A adds a requirement that the actions taken to stop activity under the warrant are reported back to the judicial commissioner to confirm that his decision has been complied with. I beg to move.
My Lords, as the noble Lord, Lord Paddick, has indicated, Amendment 212A seeks to mandate that in the event that a bulk equipment interference warrant is issued in an urgent case and the judicial commissioner later refuses to approve the decision to issue the warrant, the relevant security and intelligence agency must report any activity carried out under that warrant and any steps being taken to stop the activity to the judicial commissioner.
This amendment is not necessary. Clause 167(4) grants the judicial commissioner the power to require representations where they have refused to approve the decision to issue a bulk equipment interference warrant which was issued urgently. Under this provision, security and intelligence agencies may be required to set out what material has been acquired under the warrant as well as other details of the interference, and it will be for the judicial commissioner to determine exactly what information they require to make their decisions on a case-by-case basis. This provision as drafted ensures that the commissioners will have all the necessary information to determine how material should be handled and if any further interference is required to stop the activity. Therefore there is a reporting function in order that the judicial commissioner can make the appropriate directions under Clause 167(3).
In these circumstances, I invite the noble Lord to withdraw the amendment.
Amendment 212A withdrawn.
Clause 167 agreed.
Clause 168 agreed.
Clause 169: Requirements that must be met by warrants
213: Clause 169, page 130, line 22, leave out subsection (5) and insert—
“(5) The operational purposes specified in the warrant must be ones specified, in a list maintained by the heads of the intelligence services (“the list of operational purposes”), as purposes which they consider are operational purposes for which material obtained under bulk equipment interference warrants may be selected for examination.”
Amendment 213 agreed.
Amendment 213A had been withdrawn from the Marshalled List.
214: Clause 169, page 130, line 26, leave out from “issued,” to end of line 28 and insert “are specified in the list of operational purposes.
(6A) An operational purpose may be specified in the list of operational purposes only with the approval of the Secretary of State.(6B) The Secretary of State may give such approval only if satisfied that the operational purpose is specified in a greater level of detail than the descriptions contained in section 164(1)(b) or (2).(6C) At the end of each relevant three-month period, the Secretary of State must give a copy of the list of operational purposes to the Intelligence and Security Committee of Parliament.(6D) In subsection (6C), “relevant three-month period” means—(a) the period of three months beginning with the day on which this section comes into force, and(b) each successive period of three months.(6E) The Prime Minister must review the list of operational purposes at least once a year.”
Amendment 214 agreed.
Clause 169, as amended, agreed.
Clause 170 agreed.
Clause 171: Renewal of warrants
Amendments 215 to 217
215: Clause 171, page 131, line 13, leave out “before the end of the relevant” and insert “during the renewal”
216: Clause 171, page 131, line 34, at end insert—
“( ) “The renewal period” means—(a) in the case of an urgent warrant which has not been renewed, the relevant period;(b) in any other case, the period of 30 days ending with the day at the end of which the warrant would otherwise cease to have effect.”
217: Clause 171, page 132, line 8, at end insert—
“( ) In this section—“the relevant period” has the same meaning as in section 170;“urgent warrant” is to be read in accordance with subsection (3) of that section.”
Amendments 215 to 217 agreed.
Clause 171, as amended, agreed.
Clause 172: Modification of warrants
Amendments 217A to 217C not moved.
Clause 172 agreed.
Clause 173: Approval of major modifications made in urgent cases
Amendment 217D not moved.
Clause 173 agreed.
Clauses 174 to 181 agreed.
Clause 182: Bulk personal datasets: interpretation
218: Clause 182, page 140, line 36, leave out “section” and insert “Part”
My Lords, this is the first group of amendments specific to Part 7, which relates to bulk personal datasets. In moving Amendment 218 I shall speak also to Amendments 219, 226 and 232.
The Government agreed in the other place that we should provide further restrictions on the use of class BPD warrants, and the new clause provided by Amendment 219 and the consequential changes made by Amendments 218 and 232 honour that commitment.
This builds on Clause 187, “Additional safeguards for health records”, previously introduced in the other place. That clause states that a dataset that includes health records can be retained under a specific BPD warrant only if there are exceptional and compelling circumstances to do so.
The proposed new clause introduced here makes clear that a class BPD warrant cannot be used if the dataset consists of health records or if a substantial proportion of the dataset consists of sensitive personal data. Nor can a class BPD warrant be used if a dataset raises novel or contentious issues that ought to be considered by the Secretary of State and a judicial commissioner. It is right that the Bill offers the strongest protections to the most sensitive datasets that the agencies hold; this new clause and consequential amendments in this grouping, and indeed the subsequent grouping, reflect that.
This proposed new clause responds to the constructive engagement we have had with the Intelligence and Security Committee and in the other place. I therefore commend these amendments to the Committee.
Amendment 226 is separate to these amendments. It is a minor technical amendment to bring the drafting of Clause 189 into line with wording in other equivalent provisions in the Bill. I commend that amendment to the Committee. I beg to move.
My Lords, I will speak to our Amendments 218A, 218B, 219A, 223A and 223D, and question whether Clauses 185 and 186 should stand part of the Bill. The purpose of Amendments 218A and 218B, and of the question whether Clauses 185 and 186 should stand part of the Bill, is to ensure that each bulk personal dataset is separately authorised by the Secretary of State and a judicial commissioner, and to exclude class bulk personal dataset warrants. It is our intention not to disallow specific bulk dataset warrants, but to remove class bulk personal dataset warrants from the Bill.
Both the Joint Committee on the Bill and the Intelligence and Security Committee recommended that class bulk personal datasets should be removed from the Bill, yet they remain part of it. The Intelligence and Security Committee reported that the acquisition, retention and examination of any bulk personal dataset is sufficiently intrusive that it should require a specific warrant. I accept what the noble Earl said on working with the ISC to try to meet it half way by adding these additional safeguards, but we maintain that it still does not go far enough, because bulk personal datasets containing private information on a large number of people are of no relevant or legitimate interest to the agencies.
I appreciate that the amendments we have proposed do not make every amendment necessary to completely remove the provision of class bulk personal datasets from the Bill, but at this stage we believe it is sufficient to raise the point of principle. I ask the Minister to justify going against the recommendations of the Joint Committee and the ISC.
Amendment 219A is an amendment to government Amendment 219. It would require the head of the intelligence service to consult the judicial commissioner when deciding whether the nature of a bulk personal dataset acquired through a class bulk personal dataset warrant requires a separate warrant. It would require consultation with the judicial commissioner where there is a sense from the head of the security services that a particular bulk personal dataset requires separate authorisation.
Amendment 223A relates to Clause 186(6), which states that a separate warrant is not required to retain and examine a bulk personal dataset that may reasonably be regarded as a replacement for a bulk personal dataset for which a warrant already exists—for example, the latest edition of the electoral roll. The amendment would exempt from this automatic authority for a replacement dataset—
It may be for the convenience of the Committee to appreciate, as I understand it, that the noble Lord would like to put this group with the group that I think was originally separated out; that is, the group beginning with government Amendment 221. Is it his wish that we should deal with everything comprehensively in one go or shall we split the groups as originally proposed?
I do apologise; perhaps I have an out of date list. It would be helpful if we could deal with all these matters together if that is possible. The noble Earl indicates that it is and I am grateful.
Amendment 223A refers to Clause 186(6), which states that a separate warrant is not required to retain and examine a bulk personal dataset that may reasonably be regarded as a replacement for an updated bulk personal dataset for which a warrant already exists. The amendment seeks to exempt from this automatic authority a replacement dataset which contains new and additional information that was not included in the original bulk dataset. For example, if a new electoral roll was to contain the email addresses of voters as a new category of information, a new warrant would be required even though it might be considered a replacement for a bulk personal dataset that was already in existence.
Amendment 223C refers to Clause 187 and the definition of “health record” under subsection (6)(c). It states that a,
“‘health record’ means a record, or a copy of a record, which … was obtained by the intelligence service from a health professional”.
Should this not be “would be obtained” to cover the situation where the authority to obtain the record was not given? Whether something is a health record or not should not depend on whether it has or has not been obtained by the intelligence service.
Amendment 223D requires that the judicial commissioner who approves bulk personal dataset warrants, in addition to those matters contained in Clause 188(1)(a), should also consider in the case of health records the additional safeguards set out in Clause 187(3); that is, that there are “exceptional and compelling circumstances”. Following on from our previous amendment, we would say exceptional and compelling,
“circumstances ‘relating to national security’”.
My Lords, given that we are grouping everything together in the way we have agreed, perhaps it would be appropriate if I complete my remarks on the government amendments before addressing the noble Lord’s amendments. The amendments that I have not yet spoken to are government Amendments 221 and 222. These are related to and consequential on the government amendments introducing restrictions on the use of class warrants that I have already spoken to. They are part of a set of amendments that honour the Government’s commitments in the other place that we should provide further restrictions on the use of class BPD warrants. Amendments 221 and 222 amend Clause 186, which makes provision for specific BPD warrants. In particular, Amendment 221 adds to the circumstances in which an agency may apply for a specific BPD warrant the situation in which it is prevented from relying on a class BPD warrant by the new clause placing restrictions on the use of those warrants that we debated earlier. Amendment 222 builds on this by placing an obligation on the agency in such circumstances to include an explanation of why it cannot rely on a class BPD warrant in its application for a specific BPD warrant. These amendments thus ensure that the provisions in the Bill setting out the circumstances in which class and specific BPD warrants should be used will operate coherently together. These amendments thus also respond to the constructive engagements we have had with the ISC and the other place.
Turning to the amendments of the noble Lord, Lord Paddick, I understand that the intention behind Amendments 219A and 218B and the stand part debate is to remove the provisions allowing for class BPD warrants. Perhaps it is worth reminding ourselves that class BPD warrants provide an appropriate means of authorising the retention and use of datasets that are similar both in nature and in the level of intrusion that their retention and use would result in. This would, for example, allow the Secretary of State to authorise a class of dataset relating to travel covering datasets that are similar in nature but refer to different travel routes, or perhaps where they were provided by different sources. The decision to issue a warrant for a particular class of data would be subject to approval by a judicial commissioner before being issued.
Removing class warrants would increase bureaucracy without increasing safeguards. It is also unnecessary because such warrants are subject to the “double lock” authorisation process by a Secretary of State and judicial commissioner. If they considered that a class bulk personal dataset warrant was too broad, they would not issue it.
It is quite true that the ISC and the Joint Committee which scrutinised the draft Bill did not endorse class BPD warrants in their original reports on the draft Bill, but the ISC’s view on this has changed. As the chair of the ISC said at Third Reading of the Bill in the other place,
“we then had further evidence—as has happened in the dialogue with the Government and the agencies—in particular from the Secret Intelligence Service, about the rationale for retaining class warrants in the Bill. In particular, the evidence highlighted the fact that many of these datasets covered the same information or type of information. In those circumstances, we considered that a class warrant would be appropriate, as the privacy considerations were identical”.—[Official Report, Commons, 7/6/16; col. 1063.]
He then made additional comments on restrictions on their use. The Government accepted in principle the ISC’s arguments for restrictions on the use of class BPD warrants, and we have already discussed amendments brought forward by the Government to reflect this. So I hope that, on reflection, the noble Lord will want to think further about those amendments that seek to excise class BPD warrants.
Amendment 219A adds to Amendment 219—the government new clause on restricting use of class bulk personal dataset warrants—that the judicial commissioner must be consulted before a decision is taken. This is an unnecessary amendment. The Secretary of State and judicial commissioner double lock will apply not only to new class and specific BPD warrants, but also to renewals of both types of warrants. This gives them effective oversight of the datasets that appear under each type of warrant. These decisions will also be subject to retrospective oversight by the Investigatory Powers Commissioner. To add another pre-consultation is not necessary or efficient. Moreover, the draft code of practice includes detailed guidance on when a specific BPD warrant should be sought. It also makes it clear, for example, that if required in an individual case, the security and intelligence agency can seek guidance from the Secretary of State or a judicial commissioner on whether it would be appropriate for a specific BPD warrant to be sought. So again, I hope that the noble Lord will want to reflect further on that amendment.
Amendment 223A would restrict the extent to which a specific BPD warrant could extend to replacement datasets. In effect, it would mean that only absolutely identical datasets could be covered by these provisions. The provision for a replacement dataset would be relevant only where a specific BPD warrant has been authorised and is already in place. The provision is a pragmatic and sensible approach to situations where a dataset is regularly or continually updated; for example, a particular dataset may be updated weekly or monthly. These updates would, by definition, include additional information, but in these cases the necessity and proportionality case and operational purposes would not alter. To require repeated new warrants in this scenario would not be proportionate; the notion of a replacement dataset allows the agencies to use these amended and updated data in line with the existing authorisation. Again, I hope the noble Lord will find that acceptable.
Amendment 223C would amend the definition of health records in the context of the bulk personal dataset provisions so that, instead of it covering a health record that “was obtained” by an intelligence service, it becomes a health record that “would be” obtained by the SIA. The requirement for a warrant in Part 7 of the Bill is engaged only after a bulk personal dataset is physically acquired, and the tense in the definition reflects this. Part 7 of the Bill does not provide any powers to the security and intelligence agencies to acquire bulk personal datasets. The agencies acquire such datasets through the exercise of various existing statutory powers, notably the “information gateway provisions” in the Security Service Act 1989 and the Intelligence Services Act 1994.
The only purpose of Part 7 is to ensure that, where the agencies retain, or retain and examine, bulk personal datasets, those datasets are subject to robust privacy safeguards. These safeguards are comparable to those provided for in relation to other powers under the Bill. They include introducing a double-lock so that warrants for the retention and examination of bulk personal datasets by the agencies will in future be subject to approval by both a Secretary of State and a judicial commissioner, and oversight by the Investigatory Powers Commissioner. In addition, the Bill makes it clear that an intelligence service must state on a specific BPD warrant application if a purpose of the warrant is to authorise the retention and examination of health records, and that the Secretary of State can issue such a warrant only if there are exceptional and compelling circumstances that make this necessary. All these safeguards remain applicable. The tense used in the definition is not indicative of when or how the dataset was obtained, which is not part of the Bill. Rather, the purpose of this definition is to explain what a health record is for the purposes of this clause. I hope that that explanation is helpful.
Turning to Amendment 223D, Clause 188 outlines what factors the judicial commissioner must review when deciding whether to approve a decision to issue a class or specific BPD warrant. Clause 188(1)(a) states that it must be necessary on grounds falling within the relevant clauses on specific and class BPD warrants. The amendment seeks to add a specific reference to Clause 187(3), which refers to additional safeguards for health records. Any such dataset could be held only under a specific BPD warrant; it is not a separate type of warrant in itself. These safeguards are therefore already covered by the references in place, which apply to all warrants relating to bulk personal datasets. I hope the noble Lord will feel comfortable in not moving the amendment.
Amendment 218 agreed.
Clause 182, as amended, agreed.
Clause 183: Requirement for authorisation by warrant: general
Amendments 218A and 218B not moved.
Clause 183 agreed.
Clause 184 agreed.
219: After Clause 184, insert the following new Clause—
“Restriction on use of class BPD warrants
(1) An intelligence service may not retain, or retain and examine, a bulk personal dataset in reliance on a class BPD warrant if the head of the intelligence service considers—(a) that the bulk personal dataset consists of, or includes, health records, or(b) that a substantial proportion of the bulk personal dataset consists of sensitive personal data.(2) An intelligence service may not retain, or retain and examine, a bulk personal dataset in reliance on a class BPD warrant if the head of the intelligence service considers that the nature of the bulk personal dataset, or the circumstances in which it was created, is or are such that its retention, or retention and examination, by the intelligence service raises novel or contentious issues which ought to be considered by the Secretary of State and a Judicial Commissioner on an application by the head of the intelligence service for a specific BPD warrant.(3) In subsection (1)—“health records” has the same meaning as in section 187;“sensitive personal data” means personal data consisting of information about an individual (whether living or deceased) which is of a kind mentioned in section 2(a) to (f) of the Data Protection Act 1998.”
Amendment 219A (to Amendment 219) not moved.
Amendment 219 agreed.
Clause 185: Class BPD warrants
220: Clause 185, page 142, line 23, at end insert—
“( ) The fact that a class BPD warrant would authorise the retention, or the retention and examination, of bulk personal datasets relating to activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary on grounds falling within subsection (3)(a).”
Amendment 220 agreed.
Clause 185, as amended, agreed.
Clause 186: Specific BPD warrants
Amendments 221 to 223
221: Clause 186, page 142, line 38, after “but” insert “either—
(i) the intelligence service is prevented by section (Restriction on use of class BPD warrants)(1) or (2) from retaining, or retaining and examining, the bulk personal dataset in reliance on the class BPD warrant, or(ii) ”
222: Clause 186, page 142, line 45, at end insert—
“( ) Where subsection (3)(b)(i) applies, the application must include an explanation of why the intelligence service is prevented by section (Restriction on use of class BPD warrants)(1) or (2) from retaining, or retaining and examining, the bulk personal dataset in reliance on a class BPD warrant.”
223: Clause 186, page 143, line 22, at end insert—
“( ) The fact that a specific BPD warrant would authorise the retention, or the retention and examination, of bulk personal datasets relating to activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary on grounds falling within subsection (5)(a).”
Amendments 221 to 223 agreed.
Amendment 223A not moved.
Clause 186, as amended, agreed.
Clause 187: Additional safeguards for health records
Amendments 223B and 223C not moved.
Clause 187 agreed.
Clause 188: Approval of warrants by Judicial Commissioners
Amendment 223D not moved.
Amendments 224 and 225
224: Clause 188, page 144, line 39, after “must” insert “—
225: Clause 188, page 144, line 40, at end insert “, and
( ) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).”
Amendments 224 and 225 agreed.
Clause 188, as amended, agreed.
Clause 189: Approval of specific BPD warrants issued in urgent cases
226: Clause 189, page 145, line 5, leave out “believed” and insert “considered”
Amendment 226 agreed.
Clause 189, as amended, agreed.
Clauses 190 and 191 agreed.
Clause 192: Requirements that must be met by warrants
227: Clause 192, page 147, line 8, leave out subsection (5) and insert—
“(5) The operational purposes specified in a class BPD warrant or a specific BPD warrant must be ones specified, in a list maintained by the heads of the intelligence services (“the list of operational purposes”), as purposes which they consider are operational purposes for which data contained in bulk personal datasets retained in reliance on class BPD warrants or specific BPD warrants may be selected for examination.”
Amendment 227 agreed.
Amendment 227A had been withdrawn from the Marshalled List.
228: Clause 192, page 147, line 12, leave out from “issued,” to end of line 17 and insert “are specified in the list of operational purposes.
(6A) An operational purpose may be specified in the list of operational purposes only with the approval of the Secretary of State.(6B) The Secretary of State may give such approval only if satisfied that the operational purpose is specified in a greater level of detail than the descriptions contained in section 185(3)(a) or (as the case may be) section 186(5)(a).(6C) At the end of each relevant three-month period, the Secretary of State must give a copy of the list of operational purposes to the Intelligence and Security Committee of Parliament.(6D) In subsection (6C), “relevant three-month period” means—(a) the period of three months beginning with the day on which this section comes into force, and(b) each successive period of three months.(6E) The Prime Minister must review the list of operational purposes at least once a year.(6F) In this Part, “the specified operational purposes”, in relation to a class BPD warrant or a specific BPD warrant, means the operational purposes specified in the warrant in accordance with this section.”
Amendment 228 agreed.
Clause 192, as amended, agreed.
Clause 193 agreed.
Clause 194: Renewal of warrants
Amendments 229 to 231
229: Clause 194, page 147, line 43, leave out “before the end of the relevant” and insert “during the renewal”
230: Clause 194, page 148, line 21, at end insert—
“( ) “The renewal period” means—(a) in the case of an urgent specific BPD warrant which has not been renewed, the relevant period;(b) in any other case, the period of 30 days ending with the day at the end of which the warrant would otherwise cease to have effect.”
231: Clause 194, page 148, line 27, at end insert—
“( ) In this section—“the relevant period” has the same meaning as in section 193;“urgent specific BPD warrant” is to be read in accordance with subsection (3) of that section.”
Amendments 229 to 231 agreed.
Clause 194, as amended, agreed.
Clause 195: Modification of warrants
Amendments 231ZA and 231ZB not moved.
Clause 195 agreed.
Clause 196: Approval of major modifications made in urgent cases
Amendment 231ZC not moved.
Clause 196 agreed.
Clauses 197 and 198 agreed.
Clause 199: Initial examinations: time limits
231ZD: Clause 199, page 152, line 41, leave out subsection (3)
My Lords, I shall speak also to Amendment 231ZE. These amendments are tabled in my name and that of my noble friend Lord Paddick. They are both probing amendments.
Clause 199 provides for time limits on certain examinations. I accept that the first of our amendments is technically not a good one—but it is a probing amendment. It would take out the subsection that states that the “permitted period”—I do not think I need for this purpose to spell out what it is—
“begins when the head of the intelligence service first forms”,
certain beliefs. My noble friend and I were intrigued as to how it could be established and recorded that someone had formed a belief—and, indeed, had first formed a belief. I am not sure about “first formed”, because once a belief is formed, it is established, so it is not going to be formed a second time. But that is not the question, really. We felt that there was a danger that acknowledging the formation of the belief, which triggers the start of the period, could be delayed so that the period itself did not begin to run. So it is a question of safeguarding.
Amendment 231ZE would reduce the time before the permitted period comes to an end. It would make it one month rather than three months. The permitted period is the period in which the head of the intelligence service has to take certain steps—having, in effect, discovered that information which has been obtained includes data relating to individuals who are not, in fact, of interest to the service. So, overall, a good safeguarding clause would properly ensure that information which is not needed is dealt with in an appropriate way. Our concerns are that, having got as far as acknowledging the need for all of this, there are a couple of points at which the arrangements might not be applied as rigorously as one would expect. I beg to move.
My Lords, Clause 199 explains the process of, and sets the time limits for, the initial examination of a dataset. The noble Baroness, Lady Hamwee, has explained the purpose of Amendments 231ZD and 231ZC, and I am obliged to her for indicating that these are probing amendments. I make no point about the technicalities of the proposed amendment, and understand the underlying rationale for making these probing amendments.
Although there may be occasions when a security and intelligence agency knows exactly what it has received, that is clearly not always the case. To give a simple example, an agency may receive a USB stick that it believes contains files relating to an organisation engaged in terrorist activity. This might, or might not, be a bulk personal dataset, and needs to be subject to an initial examination to determine whether it is a bulk personal dataset. To be absolutely clear, this initial examination process can only establish what the data are: in particular, whether this is a bulk personal dataset or not, and whether there is a case for retaining it. They cannot be searched or selected for examination without a warrant, so delaying applying for a warrant is not a way for the intelligence agency to work round the system provided for in the Bill.
It is not in anyone’s interest to delay the process. The agency cannot start using the data until a warrant is issued, and the agencies will therefore want to get warrants in place as quickly as possible, particularly as there may be concerns about whether threats and opportunities will be missed by reason of any delay. More generally, the Bill places an obligation on the agency to apply for a warrant,
“as soon as reasonably practicable”,
meaning that if it is possible to apply for a warrant sooner than the deadline set out in Clause 199 the agency would do so. The time limit here is just what I would term the “hard stop” provision within the clause. Amendment 231ZD is therefore unnecessary and indeed, in a sense, unhelpful.
From the point where the intelligence agency believes a dataset created in the United Kingdom includes personal data, as the noble Baroness, Lady Hamwee, noted, it has three months to complete the initial examination and apply for a warrant to retain and, if necessary, select data for examination from the dataset. Amendment 231ZE seeks to reduce this period from three months to one month.
The Government do not think this is appropriate. The structure and format of some bulk personal datasets can be highly complex, even if created in the United Kingdom. In some cases, it can take considerable time to be confident that the structure is sufficiently understood. Only then can the intelligence agency accurately describe the information contained in the dataset and know whether it is necessary and proportionate for it to be retained. There may be other factors that require time to resolve, including, for example, technical difficulties such as formatting, compression and encryption. Indeed, there may be language issues: the dataset, even if created in the United Kingdom, may be in a foreign language. In addition to that, the size of the dataset can be a factor. Three months is therefore considered the appropriate time limit for this initial examination. However, I underline the point that this is an outer limit—this is the hard limit for that.
Again, I emphasise to the noble Baroness that this three-month time limit does not provide a way for the agencies somehow to circumvent the safeguards within the Bill. The dataset in question cannot be used for intelligence purposes until a specific BPD warrant is in place or until the provisions set out in chapter 6 of the draft code of practice, which relate to authorising retention and use of a dataset fitting within a class warrant, are met. In these circumstances, I invite the noble Baroness to withdraw the amendment.
I am grateful for that explanation. It has helped me to understand the process but it has also made me wonder whether in Clause 199(3) the term “belief” is the correct one. The way that the Minister has described it, it is more of a suspicion—I do not mean that in any negative way—or a concern. A “belief” suggests that there has been a thought process arriving at a conclusion. I do not expect him to respond to that now unless he wants to but I am left wondering, and he might want to look at this again, whether this wording quite describes the completely cogent explanation about the clause that we have just heard. For the moment, though, I beg leave to withdraw the amendment.
Amendment 231ZD withdrawn.
Amendment 231ZE not moved.
Clause 199 agreed.
Clause 200 agreed.
Amendment 231A not moved.
Clause 201 agreed.
Clause 202: Part 7: interpretation
Amendments 232 and 233
232: Clause 202, page 155, line 3, at end insert—
““personal data” has the meaning given by section 182(2);”
233: Clause 202, page 155, line 7, at end insert—
““the specified operational purposes” has the meaning given by section 192(6F);”
Amendments 232 and 233 agreed.
Amendment 234 had been withdrawn from the Marshalled List.
Clause 202, as amended, agreed.
House adjourned at 9.36 pm.