Joint Committee On Human Rights Sixteenth Report

2 Human rights concerns in relation to the Draft Code

7. When we first examined the Draft Code, it seemed to us to give rise to four matters of concern on human rights grounds.

a)  The nature of the communications data affected by the Draft Code is sufficiently personal and sensitive to give rise to obligations on the part of the state under Article 8 of the European Convention on Human Rights (ECHR) in relation to the retention and storage of personal data as well as its processing and disclosure.[6] The communications providers which retain the communications data are nearly always likely to be private businesses rather than public officials. If they are not "public authorities" for the purposes of the Human Rights Act 1998, they are not directly subject to the legal obligation imposed by section 6 of that Act to act compatibly with Convention rights. It is therefore unclear how the Draft Code would ensure that the state can discharge its obligations under ECHR Article 8 in relation to the retention and storage of the data.

b)  It is not clear how the Draft Code's standard periods of retention would meet the requirement of proportionality which forms part of the test of necessity in a democratic society when justifying an interference with rights under ECHR Article 8.

c)  The availability of the communications data to agencies for purposes other than the protection of national security would call in question the legitimacy of the aim for which the data are to be retained, the necessity for that retention and its proportionality, all of which are elements of the justification for retention of personal data under ECHR Article 8.

d)  It is not clear how thoroughly the consultation exercise required by section 103 of the Anti-terrorism, Crime and Security Act 2001 was carried out and how far the fruits of it have been taken into account in the Draft Code.

8. Our Chair wrote to the Home Secretary on 30 October 2003 asking a number of questions about these matters. The Home Secretary replied in a letter of 7 November 2003. We are grateful to the Home Secretary and his staff for replying so promptly. Both letters are appended to this Report. We have considered the Home Secretary's response, and now report our considered views in the light of it.

Applicability of the Human Rights Act 1998 to service providers holding communications data

9. Paragraph 5 of the Draft Code says that it has been drawn up in accordance with various pieces of legislation, including the Human Rights Act 1998. The 1998 Act makes the Convention rights, including the particularly relevant right under ECHR Article 8, part of the law in the United Kingdom. The Draft Code offers no guidance to service providers as to their responsibilities under the Act.

10. Generally, the obligations under the Human Rights Act 1998 are imposed only on "public authorities". These are of two relevant kinds: "all-purpose" public authorities which exercise state authority, such as government departments and the police; and "functional" or "limited purpose" public authorities, which are public authorities to the extent that they exercise public functions but are otherwise private bodies. Communications providers are not likely to be all-purpose public authorities. If they were under a legal obligation to comply with Article 8, it would normally be because they are functional public authorities under section 6(3)(b) of the Human Rights Act 1998 ("any person certain of whose functions are functions of a public nature") when holding data for an extended period for non-business purposes in order to comply with a requirement made under Part 11 of the Anti-terrorism, Crime and Security Act 2001.

11. We considered it to be important to clarify the obligations of communications providers in relation to ECHR Article 8 in order to ensure that the obligation of the state to secure the rights under the Convention to everyone within its jurisdiction, under ECHR Article 1, can be fulfilled. We therefore asked the Government whether it considered that service providers holding information for the purposes of the Anti-terrorism, Crime and Security Act 2001 were to be regarded as functional public authorities for the purposes of the Human Rights Act 1998. The Home Secretary told us that the Government takes the view that the retention of communications data by communications providers is "a private function that arises out of the commercial service that the communication services providers provide". This has the disadvantage that the communications providers are not public authorities for that purpose and are not bound by the obligation to act compatibly with Convention rights under section 6 of the Human Rights Act 1998.

12. The right to respect for private life under ECHR Article 8 is of fundamental importance. Any invasion of the right must be strongly justified. Safeguards are essential. Making those who retain communications data subject to the Human Rights Act might be one such safeguard. Unless the primary legislation is amended to provide expressly that the providers are, or are not, public authorities for that purpose, only the courts can answer the question authoritatively. We note, however, that if the Government's view is correct it increases the importance of ensuring that the provisions of the Code, under which the communications providers will work, are fully compatible with Convention rights, particularly ECHR Article 8. Indeed, this is recognized by the Government. The Government draws a distinction between "retention" of data (which in Part 11 of the Anti-terrorism, Crime and Security Act 2001 means the standard retention of all communications data relating to any person) and "data preservation", by which the Home Secretary means retention of specified data relating to particular cases on a case by case basis at the express request of an agency. The Home Secretary says in his letter, in answer to question 2,

… we fully accept that the approach to retention of communications data taken in the Code of Practice needs to comply with Article 8 of the European Convention on Human Rights. It must be necessary and proportionate for the Government to ask that the different types of data are retained for the periods set out in the Code. As a starting point the Government needs to demonstrate why there needs to be blanket data retention at all, rather than data preservation.

In the second paragraph of his letter, the Home Secretary states that, in the Government's view, retention of communications data is both necessary and proportionate in the light of advice received from the security and intelligence services and from the police.

Across-the-board standard retention periods for communications data in various categories: necessity and proportionality

13. Paragraphs 7 and 8 of the Draft Code state that the Secretary of State considers it to be necessary for the purpose of national security for service providers to retain communications data for the periods set out in Appendix A to the Draft Code. Paragraph 8 explains that the Secretary of State would, if necessary, issue a certificate under section 28(2) of the Data Protection Act 1998 to exempt such data from the fifth data protection principle (data not to be kept for longer than necessary for the purposes of processing).

14. This would not deal with the position under ECHR Article 8 and the Human Rights Act 1998. If a service provider is a functional public authority when retaining data for national security purposes, it would have to show both that the retention is necessary (in the sense of being a response to a pressing social need) and proportionate (interfering no more than is essential in the circumstances of the case with the right to respect for private life and correspondence). A retention which fails to meet those criteria will not be justifiable under ECHR Article 8.2.

15. We therefore asked the Government why it considers that it would be proportionate to retain communications data by reference to across-the-board standard periods of time, without reference to the identity of the user of the service or the circumstances in which the communications took place.

16. Whether or not the service provider is a functional public authority, the state seems to us to have an obligation under ECHR Article 1 and Article 8 to take positive steps to safeguard the service user's right to respect for private life and correspondence. These include, as the Government accepts, ensuring that the blanket retention of communications data is necessary for a legitimate purpose, and that it is proportionate to the aim which it seeks to achieve. In the context of communications data, appropriate safeguards might also include legislation imposing on the service providers an obligation to ensure that an assessment of proportionality is made in relation to different pieces of data. However, neither the Regulation of Investigatory Powers Act 2000, the Anti-terrorism, Crime and Security Act 2001 nor the Draft Code indicates that there is a requirement of proportionality, let alone offers advice on how it should be applied.

17. We therefore asked the Government whether, and if so why, it considers that a Code which does not mention the requirement of proportionality would discharge the United Kingdom's obligations under ECHR Article 8.

18. The Home Secretary replied that it is not correct to assume that the communications providers will be making an assessment of proportionality on a case-by-case basis, so guidance as to how that should be done is unnecessary. Furthermore, the Government does not consider data preservation on a case-by-case basis to be an adequate tool for fighting terrorism and safeguarding national security, because "data preservation will never aid investigation of a person who is not currently suspected of involvement with, say, a terrorist organization". It is said to be necessary to keep all communications data because of the need to be able to check the communications record of a person who comes newly under suspicion after the communications in question have been made, in order to find out whether he or she has been in communication with other people who are known to represent a threat to national security or a threat of terrorism. In this way a "pattern of association" can be identified. The Home Secretary also says that Parliament recognized the need for data retention when it passed Part 11 of the Anti-terrorism, Crime and Security Act 2001.

19. We agree that Parliament accepted that there may be a need for data retention for those purposes, although we note that the relevant provisions were not debated by the Commons either at Committee or Report stage due to the effects of the programme order applied to the Bill. However, we have not been able to establish how pressing the need is, or how often the police and security and intelligence services find it necessary to make use of such data or are significantly hampered by its absence. Those matters seem to us to be relevant to the assessment, to be made by each House, of the necessity for the retention which would be sought by the Draft Code, and of the proportionality of the periods set for retention of each kind of communications data. We draw these matters to the attention of each House.

Use of retained data for purposes unrelated to national security

20. Although the Draft Code sets extended periods of retention for communications on the ground of national security, it says nothing about the use which could be made of data retained under it which could not otherwise have been lawfully retained for that period. Indeed, paragraph 25 of the Draft Code expressly disclaims any intention to do so. As the Draft Code stands, it appears that communications data retained for an extended period under the Anti-terrorism, Crime and Security Act 2001 could be obtained by or disclosed to public authorities for a variety of other purposes, including but not limited to the investigation of crimes unrelated to national security under the Regulation of Investigatory Powers Act 2000. As noted above, a Draft Order in Council, the Draft Regulation of Investigatory Powers (Communications Data) Order 2003, has been laid before each House. This Draft Order would greatly extend the range of bodies by whom communications data can be obtained and to whom they can be disclosed lawfully under the 2000 Act.

21. When we initially examined the Draft Code we were concerned that this might give rise to an unacceptable way by which a very wide range of investigators (including, if the Draft Order is approved, ambulance services) could avoid the restrictions placed by Parliament on the obtaining or disclosure of such data in cases unrelated to national security when the Regulation of Investigatory Powers Act 2000 was passed. If arrangements permit communications data retained under the Anti-terrorism, Crime and Security Act 2001 to be obtained, disclosed or processed for the purposes of other legislation, when the data could not lawfully have been retained under that legislation, there must be doubt about the legitimacy of the aim for which they are being obtained, disclosed or processed, and the necessity for and proportionality of the obtaining, disclosure or processing of the data.[7]

22. We therefore asked the Government what legal or technological measures are being taken or are planned to ensure that the communications data retained for the purposes of Part 11 of the Anti-terrorism, Crime and Security Act 2001 will not be available for purposes other than the protection of national security, in order to ensure the proportionality and so the compatibility of the retention with rights under ECHR Article 8.

23. The Home Secretary replied that the Government does not intend to take any legal or technological measures to restrict the use of retained data to national security purposes. The Government's view is that, if data are available, they should as a matter of policy be accessible at the request of other public authorities for other purposes. The Government gives the example of a murder investigation as a purpose for which data should be accessible. Furthermore, the Government does not accept that the Anti-terrorism, Crime and Security Act 2001, the Human Rights Act 1998 or the ECHR imposes any restriction on the use of retained data for purposes other than protecting national security. The Home Secretary points out that the Government's view was made clear during debate on the Anti-terrorism, Crime and Security Bill in the House of Lords, and that an amendment which would have limited accessibility of the data under the Regulation of Investigatory Powers Act 2000 was withdrawn. In the light of that, he suggests, it is "very clear that when the 2001 Act was passed Parliament did not intend access to be restricted in that way." A similar view was expressed by the Parliamentary Under-Secretary of State for the Home Department (Caroline Flint MP) during debate on the Draft Regulation of Investigatory Powers (Communications Data) Order in the House of Commons Third Standing Committee on Delegated Legislation.[8]

24. We recognize that there may be cases not involving national security in which it is both necessary and proportionate to have access to retained communications data if they are available and relevant. The investigation of a murder might be such a case. On the other hand, we do not consider that the relationship between the powers under the two Acts is as straightforward as the Government suggests. The 2000 Act authorised designated persons to issue authorisations permitting, or notices requiring, communications data to be obtained by investigators for purposes listed in section 22(2) if the designated person decided in each case, on a case-by-case basis, that he or she 'believes it is necessary' for one of the listed purposes and also 'believes that obtaining the data in question by the conduct authorised or required by the authorisation or notice is proportionate to what is sought to be achieved by so obtaining the data': section 22(1) and (5). The interests of national security are among the purposes for which an authorisation or notice may be given, but there are many others. The 2001 Act requires the Secretary of State to issue a Code of Practice, and allows him to enter into agreements, containing—

… any such provision as appears to the Secretary of State to be necessary—

(a) for the purpose of safeguarding national security; or

(b) for the purposes of prevention or detection of crime or the prosecution of offenders which may relate directly or indirectly to national security.[9]

It is not clear to us that Parliament, in enacting Chapter 11 of the 2001 Act, intended to affect the balance between rights, safeguards and the public interest in relation to access to communications data in cases which are unrelated to national security.

25. It seems to us that the main safeguard against abuse of the power to access for non-national-security purposes communications data retained under the 2001 is the fact that any access will have to be authorised or required by a designated person in a public authority empowered to access such data by the 2000 Act. The designated person will be a public authority, bound by the Human Rights Act 1998 and the Convention rights, and also bound to refuse a notice or authorisation unless he or she believes that the requirements of necessity and proportionality are met on the facts of each particular case, under section 22(1) and (5) of the 2000 Act. On balance, we are prepared to accept the Government's view that, as a matter of policy, it should be possible to have access to any communications data which are available and are relevant to a case if those conditions are satisfied on the facts of the particular case. We have come to the conclusion that the safeguards already mentioned, coupled with the availability of judicial review of a notice or authorisation under the 2000 Act and the need to comply with the Data Protection Principles under the Data Protection Act 1998 so far as they apply to such data, are capable in principle of providing appropriate protection for the right to respect for private life and correspondence under ECHR Article 8. We draw this matter to the attention of each House.

The consultation process

26. Before publishing a Draft Code, section 103(2) of the Anti-terrorism, Crime and Security Act requires the Secretary of State to consult with (a) the Information Commissioner and (b) the communications providers to whom the code will apply. The process of consultation could have begun as early as December 2001 or January 2002, but it was not clear to us how thorough the consultation has been, when it was commenced, or how long was allowed for it. We note that the consultation process is an essential part of the scheme of Part 11 of the Anti-terrorism, Crime and Security Act to ensure that the Code of Practice made under section 102 puts in place a properly limited scheme for retention of communications data which respects the requirements of the Human Rights Act 1998 and the ECHR as well as the Data Protection Act 1998 and related legislation. We are mindful of the fact that the Court of Appeal (Civil Division) has recently reaffirmed the importance of proper compliance with legal consultation requirements in the process of policy-making.[10]

27. We therefore asked the Government what views the Information Commissioner expressed when consulted on the Draft Code, what steps were taken to consult with the communications service providers, when and over what period these consultations took place, and what views the communications service providers expressed. In his reply, the Home Secretary referred to various fora in which representatives of the industry had an opportunity to express views about proposals for the Draft Code. There was a Technical Working Group, meeting monthly for several months until March 2003 to discuss technical matters relating to the Draft Code. A six-monthly Government Industry Forum gave an opportunity for the industry to speak to Government, as did an Operators Group and meetings with the Internet Service Providers Association. The Government also visited smaller providers to explain its objectives and to assess the impact of the proposals on them. Industry was then encouraged to participate in the public consultation which took place in the three months from 11 March 2003. During these processes, the Government sought to allay concerns of the providers about the legality of the proposals in the light of the ECHR.

28. We are satisfied that these steps were sufficient to comply with the Secretary of State's duty under section 103(2) of the 2001 Act to consult the communications providers to whom the Draft Code will apply.

The timetable for parliamentary scrutiny

29. We asked the Home Secretary whether it was necessary to press ahead with the Draft Order and Draft Code of Practice now, and, if they could not be deferred for further consideration in Parliament, what the reasons for the urgency are, bearing in mind that the Government has laid a Draft Retention of Communications Data (Extension of Initial Period) Order 2003 which, if approved, would extend for two years from 13 December 2003 the power of the Secretary of State to give directions for the retention of communications data under section 104 of the 2001 Act. The Home Secretary responded that the draft Orders and Draft Code are high priorities in view of the terrorist threat, which makes it "critically important to put these measures in place as soon as possible, in order to provide investigators with the necessary tools to fight terrorism and safeguard national security". The Home Secretary said that technical changes in the industry mean that providers need to keep communications data for less and less time for business purposes, so there is a danger that important data will cease to be available if the Draft Code is not quickly put in place. The Home Secretary also noted that the extension of powers under section 104 of the 2001 Act must be approved by both Houses before 13 December, and that the Draft Code and its associated Draft Order were laid before Parliament on 11 September 2003, in his view giving plenty of time for consideration by Parliament.

30. We note that the two Houses were sitting on 11 September, but rose for the conference recess on 19 September, to reassemble on 14 October. The total sitting period allowed for consideration of these proposals thus amounts to about five weeks. In our view, this is not sufficient in view of the importance of the measures, their potential to affect human rights, and the long period of gestation of the proposals since December 2001. We draw this matter to the attention of each House.

6   Article 8 provides: "1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interest of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others." Back

7   See Appendix 3 Back

8   HC Deb, Third Standing Committee on Delegated Legislation, 4 Nov. 2003, cc 26-27 Back

9   Section 102(2), italics added Back

10   R. (on the application of Butler) v. Bath and North East Somerset District Council, The Times, 4 Nov. 2003, CA, on reg. 15 of the Town and Country Planning (Development Plan) (England) Regulations 1999 (SI 1999 No. 3280), concerning a policy on identifying suitable locations for Gypsy and traveller sites. Back

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2003
Prepared 14 November 2003