Skip to main content

Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2022

Volume 826: debated on Tuesday 20 December 2022

Motion to Approve

Moved by

That the draft Regulations laid before the House on 17 November be approved.

Relevant documents: 19th Report from the Secondary Legislation Scrutiny Committee

My Lords, keeping the public safe and protecting our national security is a key priority for this Government. It is vital that our intelligence agencies, law enforcement bodies and public authorities are able to exercise the important powers contained in the Investigatory Powers Act 2016, which I will refer to as the IPA. We rightly have in place world-leading standards on transparency, privacy, redress and oversight to accompany the exercise of these powers.

The regulations to be debated today will make two necessary amendments to Schedule 4 to the IPA. The first will implement changes to the communications data authorisation process for the UK intelligence community in order to implement the findings of a High Court judgment. This judgment was handed down in June this year in the case of Liberty v Secretary of State for the Home Department and Secretary of State for Foreign and Commonwealth Affairs. I will refer to communications data as CD and the UK intelligence community as UKIC.

This amendment will remove the power for UKIC to internally authorise the acquisition of CD for purposes which relate solely to serious crime, other than in urgent circumstances. In line with the court’s judgment, from 1 January 2023, it will be necessary for UKIC to seek authorisation for acquisitions of this type through the Office for Communications Data Authorisations, which I will refer to as the OCDA. The OCDA is part of the Investigatory Powers Commissioner’s Office, and its involvement in the authorisation process will ensure that an independent body has considered all non-urgent applications for CD.

For urgent applications, UKIC needs the ability to continue to self-authorise the acquisition of CD in such circumstances, because the OCDA is open only during normal office hours and our intelligence services need to be able to acquire CD at any time of day or night in urgent situations. This statutory instrument makes the necessary change to Schedule 4 to permit such urgent acquisition. Law enforcement bodies such as police forces are able to self-authorise urgent CD requests in the same way.

If this power is not in place, there is a risk of causing delays to UKIC’s operations, potentially putting the public at increased risk of serious crime. Additionally, these regulations will amend the Schedule 4 entry for the UK National Authority for Counter-Eavesdropping, which I will refer to as UK NACE. UK NACE was added to Schedule 4 in 2020, and these regulations do not change the powers afforded to it but make its designation more consistent with the approach taken for other similar bodies which form part of relevant public authorities for the purposes of Schedule 4 to the IPA.

It is opportune to make this small change alongside the other amendments to Schedule 4 to implement the High Court judgment. Per the obligations set out in Section 72 of the IPA, appropriate consultation has taken place with UK NACE, the Foreign, Commonwealth and Development Office and the Investigatory Powers Commissioner’s Office in advance of making this change. UK NACE plays a critical role in protecting our national security from state threats and other malign actors, and it is vital that it is equipped with the appropriate powers to carry out this activity effectively.

In summary, these regulations will enable UKIC and UK NACE to continue carrying out their statutory duties effectively, while ensuring that there is appropriate oversight in place to protect privacy. I hope noble Lords will support these measures and their objectives. I commend the draft regulations to the House and beg to move.

My Lords, we support these regulations, but I have a number of questions to ask the Minister and would like the whole House to reflect on the way regulations of this sort are dealt with by the House.

Early in January, there will be a debate on two reports from this House on the way in which secondary legislation is dealt with by Parliament, particularly the House of Lords. This particular set of regulations—what I am about to say has no effect on them—come under the enhanced affirmative procedure, which provides for regulations being placed in a draft form so that Parliament can assess them and then request the Government to make changes in summary. They would then bring forward amendments to it. In this set of regulations such a requirement was not in place, because the committee that looked at them, of which I am a member, did not make any recommendations about changes that might be required.

However, there are two points in respect of the way that Parliament deals with these matters. The first is that when the enhanced affirmative procedure is required, there is no specification as to which committee of this House will look at them. I will raise that matter in January, but we perhaps need to consider it. At the moment, the Secondary Legislation Scrutiny Committee looks at them, but not necessarily so: it is simply because there was nobody else. In the other place, it is “other committees” that look at this procedure, which is quite strange.

There is no question that, because there is no recommendation from the Secondary Legislation Scrutiny Committee, this procedure would have to form the amendment. It is very important that we have that opportunity to make changes to the secondary legislation; it is otherwise a take-it-or-leave-it procedure. A detailed discussion has been going on in this House about this, as we find it very strange for a Parliament to give such power to the Executive without having the opportunity to properly scrutinise and make appropriate changes.

I would like to ask the Minister some questions. First, which bit of the EU law, which resulted in the High Court’s decision, was problematic? This was a compendium case taken to the High Court, in which the Government defended themselves. This was one of several elements, and the Government were defeated on this element on the basis that they were breaching that EU law. Is the Minister satisfied that the EU law itself is appropriate and will therefore not necessarily need to be changed? It provides some fundamental rights, particularly against what people call the snoopers’ charter.

My second question concerns the operation of the OCDA. It is rather strange that the Minister and his counterpart in the other place talked about the OCDA being able to deal with these matters only during opening hours. It strikes me as being rather like a pub: you have opening hours, you have to place your order, and you cannot put anything in if the doors are closed. The question therefore arises: if you are applying to the OCDA during opening hours, how long would it take to give an answer? Clearly, the issue of understanding and defining what is urgent is very important. Having a definition that says that it is urgent only if it is closing time or they are gone would not be wholly appropriate. I understand the urgent nature of the legislation, but perhaps the Minister could describe how long the OCDA would take to provide an answer in ordinary circumstances where there is not such urgency. With those two questions, I am pleased to support these regulations. I hope that we can delve more into the process in January.

My Lords, perhaps I might ask the Minister a couple of questions arising out of this. First, am I right in thinking that, to satisfy the court judgment, we must pass these regulations before the beginning of January? Perhaps he could clarify that. Secondly, looking in more detail at the position of the Security Service in particular in dealing with organised crime, I think I am right to say that the only change made by these regulations to satisfy the court judgment is that the urgency procedure would be able to address serious crime communications bids only if there is a matter of urgency, otherwise they would need to go through the normal process.

What slightly puzzles me about that is that I would expect the Security Service, which makes an enormous contribution in dealing with serious crime, to work in close conjunction with the police and, presumably, the National Crime Agency. Would it not be the police leading many such investigations? Would they not themselves be in a position to make the urgent request for communications data? I ask that simply for clarification, not out of any criticism of the fact that the Government have implemented the court’s decision.

Clearly, this restriction will not apply to other areas in which the intelligence agencies work. They will be able to make their own applications on their own initiative, even if it is not an urgent case, because it is within their core areas of activity. But when it comes to serious crime their responsibilities are shared with other bodies, which might be expected to take a lead on the requirement to use communications data.

My Lords, I thank the Minister for his opening comments. He has outlined what the statutory instrument does. These changes come as a result of the High Court ruling in June this year in the case of Liberty v the Secretary of State for the Home Department and the Secretary of State for the FCDO.

This SI will allow for the internal authorisation of the acquisition of communications data solely for serious crime purposes in urgent situations, as prescribed by Section 61A of the Investigatory Powers Act 2016. I understand that parts of the wider case were dismissed. However, the High Court ruled in favour of Liberty on one key point—namely, deeming it to be unlawful for the security services to obtain individuals’ communications data from telecom providers without having prior independent authorisation in certain circumstances.

In preparing for this debate, I read the blog of Neil Brown, who says he is an internet, telecoms and tech lawyer. He commented:

“I suspect, absent an appeal, there will be a tweak to the Investigatory Powers Act 2016, to provide for independent authorisation of requests by security or intelligence agencies before obtaining communications data, retained under Part 4 Investigatory Powers Act 2016, for the applicable crime purpose.”

This SI is indeed the tweak he refers to. He goes on:

“While important, this decision is unlikely to have a material impact on telecommunications operators, whether it applies to all communications data or only communications data retained by a telecommunications operator under Part 4. This is because it relates to what happens ‘behind the scenes’ before a Part 3 authorisation or notice is served on a telecommunications operator. The impact of a Part 3 authorisation or notice has not changed, nor has the obligation to provide data in response to a notice. I suppose that it might have an impact in the short term on the volume of requests, if OCDA”—

the Office for Communications Data Authorisations—

“is to have an increased workload—presumably, if that is the case, there would be a plan to increase OCDA’s staffing.”

My questions for the Minister arising from those comments are, first, does he believe that Neil Brown is accurate in his assessment that there is likely to be a lack of impact on the telecommunication operators through this SI? Secondly, is there a plan to increase the OCDA’s staffing if necessary?

We welcome the Government’s corrective action through this SI. We recognise that there needs to be an appropriate balance between our civil liberties and the fast-changing threats posed by serious and organised crime.

My Lords, I thank noble Lords who participated in this short debate for their considered views on the regulations. To go back to where I started, it is vital that the public have confidence in the discharge of the important powers contained in the investigatory powers regime and that these organisations can carry out their statutory duties to keep us all safe.

The noble Lord, Lord German, asked me about the relevant pieces of retained EU legislation or case law that pertain to the High Court decision. These particular pieces of law are: the Parliament and Council directives—I shall not go into the numbers as there are a lot of them—as implemented in the UK by Parliament in the Privacy and Electronic Communications (EC Directive) Regulations 2003; Privacy International v the Secretary of State for the Foreign and Commonwealth Office and the Secretary of State for the Home Department —again, a load of numbers which I will not bother repeating; and a third one which is in French, and I am afraid my pronunciation powers prevent me having a go.

The High Court decided in the Liberty case in June 2022 that under the e-privacy directive, when interpreted by the subsequent judgments from the Court of Justice of the European Union, all non-urgent access to communications data by the UK intelligence community —UKIC—solely for the applicable crime purpose must be subject to prior approval by the Investigatory Powers Commissioner’s Office. On implementation of these regulations, UKIC will apply for all non-urgent, serious crime only CD authorisations via the Office for Communications Data Authorisations, as I explained. This statutory instrument changes the position in UK law, as set out in the Investigatory Powers Act 2016, to bring it into line with the relevant obligations retained under EU law. No further action or changes to retained EU law are required to bring the IPA into line with the judgment issued by the Supreme Court.

The noble Lords, Lord Ponsonby and Lord German, asked about the number of these applications. In 2021, more than 240,000 communications data applications were considered by the Office for Communications Data Authorisations, which was an increase of over 8% compared with 2020. We expect the volume of authorisations to increase further following the removal of UKIC’s ability to self-authorise communications data acquisition for serious crime purposes, except in urgent circumstances.

To ensure that the judgment is implemented effectively, we have been working closely with the OCDA and UKIC to ensure that the appropriate systems and processes are in place ahead of 1 January to manage the increase in authorisations as a result of these regulations coming into force.

I am afraid I cannot speculate on what impact it will have on the telecommunications industry. I have not read the Neil Brown report referred to by the noble Lord, Lord Ponsonby, but I will see whether there is any information available on that, and if there is I will happily write to the noble Lord to explain. I am not sure whether any of that information is available.

The noble Lord, Lord German, also invited me to compare the OCDA to a pub, which I am happy to do. There is a very specific prioritisation system within the OCDA, and it is bespoke to the issue raised by UKIC, so the most urgent cases will be delivered in minutes and the less urgent ones in hours, which is clearly not acceptable when being served in a pub.

The noble Lord, Lord Beith, asked why these regulations have taken some time to implement and whether they need to be authorised from 1 January. The answer is yes. They were laid as soon as possible following the High Court judgment in June. There is a statutory requirement to consult the relevant parties and the Investigatory Powers Commissioner’s Office for at least 12 weeks before laying regulations, with which we have complied.

I am not really able to speculate on the split between UKIC and police powers, as invited to by the noble Lord, Lord German. But I imagine that, by its very nature, this is communications data that tends to come from much more specialist sources in the main.

I think I have answered the questions that were asked. I hope all noble Lords can agree that the implementation of these regulations will play a vital role in ensuring the ongoing effective operation of the investigatory powers regime.

Motion agreed.