Draft Communications Data Bill - Draft Communications Data Bill Joint Committee Contents

2  What RIPA does, and how the system currently functions

21.  Chapter II of Part I of RIPA essentially deals with four matters:

  • what categories of communications data should be available;
  • who can access it;
  • for what purposes; and

subject to what safeguards.

22.  As we have said, the annual report of the IoCC for 2011 states that in that year 494,078 requests were made for access to communications data. The great majority were made under RIPA, though there are a number of other statutory information-gathering powers which can be used by public authorities to acquire communications data. Clause 24 of and Schedule 2 to the draft Bill will amend certain powers in other legislation so that they may not be used in the future to oblige CSPs to disclose communications data. This is intended to consolidate the powers under which communications data can be disclosed.

BOX 4: Requests, crimes and individuals

There is a difference between the numbers of requests, the numbers of people being investigated, and the numbers of crimes being investigated. Many requests may be made in relation to the same person because that person may use a large number of devices (criminals habitually change 'phones on a regular basis to try to evade detection); conversely one request can reveal data on many people. Nor does the number of requests equate to the number of crimes investigated. Many requests can be made during an investigation into a single crime; a significant murder, organised crime or counter-terrorism investigation can involve hundreds of communications data requests.

Data that can be accessed

23.  Data can of course only be accessed if it is available. CSPs are commercial organisations; they generate data only if it is useful and they keep it only for as long as it is necessary, but storage is expensive, and once they no longer have a business purpose for data, they will delete it unless they are required to retain it under the Regulations implementing the Data Retention Directive. Otherwise they are currently under no duty to preserve data, nor will they do so. One of the main drivers of the legislation is to give the Government the power to require CSPs to generate and retain data for which they have no business purpose.

24.  When RIPA was enacted communications were still mainly by post or by phone, though emails were gaining in popularity, and the distinction between communications data and content was relatively straightforward. In the case of post, communications data was what was written on the outside of the item, and the rest was content. Phone calls were calls between landlines, between mobile phones, or between landlines and mobile phones. Communications data is therefore defined in RIPA as three elements:

  • traffic data (essentially, data identifying the location of the device to or from which the communication is sent, the equipment through which it is transmitted and the signals actuating equipment);
  • use data (data, other than content, about the use made of a service); and

subscriber data (data held by the service provider about the persons to whom it provides the service, other than traffic data or use data).

Accessed by whom?

25.  Section 25(1) of RIPA as originally enacted listed six public authorities permitted to access communications data. These included, in addition to police forces and the intelligence and security services, the National Criminal Intelligence Service and the National Crime Squad, which are now superseded by SOCA,[18] and the Commissioners of Customs and Excise and Commissioners of Inland Revenue, now superseded by HMRC.[19]

26.  In addition, the Secretary of State has power by order to add any public authority. Over the years a large number of authorities have been added in this way.[20] For some, like the Financial Services Authority (FSA), a good case can be made. The inclusion of all local authorities is more controversial; the inclusion of some others seems hard to justify, even though they can access communications data only for limited purposes. In Chapter 4 we give our views on which authorities should appear on the face of the draft Bill, and the procedure which should be followed for any amendments to this list.

Permitted purposes

27.  RIPA, as originally enacted, provided that communications data could be obtained only if to do so was "necessary" on one of the following grounds:[21]

"  (a) in the interests of national security;

(b) for the purpose of preventing or detecting crime or of preventing disorder;

(c) in the interests of the economic well-being of the United Kingdom;

(d) in the interests of public safety;

(e) for the purpose of protecting public health;

(f) for the purpose of assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department;

(g) for the purpose, in an emergency, of preventing death or injury or any damage to a person's physical or mental health, or of mitigating any injury or damage to a person's physical or mental health."

28.  There was also a power for the Secretary of State to add, by order subject to affirmative resolution, "any purpose (not falling within paragraphs (a) to (g)) which is specified for the purposes of this subsection by an order made by the Secretary of State". Two additions have been made under this power:[22]

"  (a) to assist investigations into alleged miscarriages of justice; and

(b) where a person ("P") has died or is unable to identify themselves because of a physical or mental condition—

(i)  to assist in identifying P, or

(ii)  to obtain information about P's next of kin or other persons connected with P or about the reason for P's death or condition."

These are currently the nine permitted purposes. If communications data is not "necessary" for one of these very broad purposes, it cannot be accessed under RIPA.

The safeguards under RIPA

29.  Any of many thousands of police officers may think that communications data is necessary to help them with a criminal investigation. Authorisation therefore has to be given by Designated Senior Officers independent of the inquiry. Designated Senior Officers are trained in considering the impact of necessity, proportionality and collateral intrusion on an individual's privacy. Before an application reaches the Designated Senior Officer, it is channelled through a Single Point of Contact (SPoC). The SPoC is an officer who has undergone formal training, is independent from the investigation, will advise the applicant, and will submit applications for authorisation if, and only if, they meet all the formal requirements, including those of necessity and proportionality. Authorisation is then given by the Designated Senior Officer, also independent from the investigation. If the application is authorised, it is returned to the SPoC officer who will obtain the communications data from the CSP and pass it to the applicant.

30.  The seniority of the officer granting the authorisation is prescribed by an order made by the Secretary of State.[23] In the police forces no officer under the rank of Superintendent can authorise an application for all classes of communications data, though Inspectors can authorise applications for subscriber data. The purposes for which authorisations can be granted are also limited; the police can grant authorisations for all purposes except tax assessment and collection, and the investigation of possible miscarriages of justice, while only HMRC can grant authorisations for tax purposes, and authorisations for investigations into miscarriages of justice can be given only to the Criminal Cases Review Commission and its Scottish equivalent. Fire Control Officers and Control Supervisors in Ambulance Control Rooms can access all communications data, but for the single purpose of dealing with death or injury in an emergency. If they wish to access communications data for preventing or detecting crime, authorisation is needed at a more senior level, and will not extend to traffic data.

31.  Some witnesses suggested to us that the authorisation system was simply a means of rubber-stamping applications.[24] We are satisfied that this is not the case and we explain why in Chapter 5.

32.  An additional safeguard was the creation by section 57 of RIPA of the office of IoCC, one of whose duties is "to keep under review … the exercise and performance, by the persons on whom they are conferred or imposed, of the powers and duties conferred or imposed by or under Chapter II of Part I [of RIPA]". In other words, he inspects the working of the system for access to communications data to make sure that it is done entirely in accordance with the statute, and makes recommendations for improvement when errors occur. The purpose is to reassure the public that intrusion is kept to a minimum and their privacy is respected as far as is consistent with the aims of the legislation. Whether this reassurance is achieved is again something we consider in Chapter 5.

Communications data held overseas

33.  RIPA is drafted so as to attempt to give United Kingdom public authorities a legal basis for requesting communications data from CSPs based overseas if they operate a service in the United Kingdom. However, many overseas CSPs refuse to acknowledge the extra-territorial application of RIPA. The procedure can of course be used to request access to data, and many CSPs will comply but emphasise that they are doing so on a voluntary basis; others will refuse to respond to RIPA requests at all. At that stage the only way in which United Kingdom law enforcement authorities can access the data is through the arrangements for international mutual legal assistance which allow the judicial and prosecuting authorities of one state to seek from the authorities of another state help in the prevention, detection and prosecution of crime. We consider these arrangements in Chapter 6.

18   Paragraph 135 of Schedule 4 to the Serious Organised Crime and Police Act 2005 makes amendments to section 25 of RIPA consequential to this change. The Scottish equivalent, the Scottish Crime and Drug Enforcement Agency (SCDEA), was added by paragraph 4(5) of the Schedule to the Police, Public Order and Criminal Justice (Scotland) Act 2006 (Consequential Provisions and Modifications) Order 2007, SI 2007/1098. Back

19   Paragraph 8 of Schedule 12 to the Serious Crime Act 2007 makes the consequential amendment to section 25 of RIPA. Back

20   The Regulation of Investigatory Powers (Communications Data) Order 2010, SI 2010/480, lists all the relevant public authorities, and gives the ranks of the persons designated to grant access to communications data and the purposes for which they may grant authorisations. Back

21   Section 22(2) Back

22   by the Regulation of Investigatory Powers (Communications Data) (Additional Functions and Amendment) Order 2006, SI 2006/1878, which is now consolidated by the Regulation of Investigatory Powers (Communications Data) Order 2010, SI 2010/480. Back

23   RIPA, section 25(2)-(5) Back

24   E.g. David Davis MP and Dr Gus Hosein, Q 118 Back

previous page contents next page

© Parliamentary copyright 2012
Prepared 11 December 2012