Conclusions and recommendations
Introduction
1.The Committee was hugely appreciative of our witnesses’ willingness to submit evidence to a challenging deadline. The quality and range of our written evidence has allowed us to make a serious attempt at scrutinising the draft Bill with the necessary degree of rigour. (Paragraph 6)
2.The Committee is grateful to all those who appeared in person before it, often at necessarily short notice. (Paragraph 7)
Targeted Interception
3.We agree that the targeted interception power should be part of the Bill, subject to appropriate warrant authorisation arrangements. (Paragraph 42)
Communications Data
4.We agree that the power to obtain communications data is an important tool for law enforcement and other public bodies. It should be included in the Bill. (Paragraph 58)
5.We acknowledge the difficulty of providing definitions broad enough to capture the variety of ways in which communications are conducted, and may be conducted in the future, while still providing sufficient clarity and precision. (Paragraph 68)
6.We are grateful that the Government has provided further information on the interpretation of communications data and content. We have not had an opportunity to seek views as to whether the definitions are now sufficiently clear. Parliament will need to look again at this issue when the Bill is introduced. We urge the Government to undertake further consultation with communications service providers, oversight bodies and others to ascertain whether the definitions are sufficiently clear to those who will have to use them. (Recommendation 1) (Paragraph 69)
7.We are concerned about the potential detail that entity data might encompass in relation to telecommunications providers, such as Facebook and Google, who build detailed automated profiles of their users. The Government should say whether it wishes to acquire such data in principle and, if not, how it will ensure that the entity data it requests and receives is not of that level of detail. (Paragraph 73)
8.The definition of data in Clause 195 is unclear, unhelpful and recursive. The Government must provide a meaningful and comprehensible definition of data when the Bill is introduced. (Recommendation 2) (Paragraph 76)
9.We agree that local authorities and trading standards should continue to have access to communications data to support their law enforcement roles, but this intrusive power should not be used for minor infringements. (Paragraph 82)
10.We recommend that Parliament should give further consideration to defining the purposes for which local authorities may be allowed to apply for communications data when the Bill is introduced. (Recommendation 3) (Paragraph 83)
11.We believe that law enforcement should be able to apply for all types of communications data for the purposes of ‘saving life’. We recommend that the Home Office should undertake further consultation with law enforcement to determine whether it is necessary to amend Clause 46 (7)(g) to make this explicit on the face of the Bill. (Recommendation 4) (Paragraph 87)
Internet Connection Records
12.We consider that, on balance, there is a case for Internet Connection Records as an important tool for law enforcement. We have concerns about the definitions and feasibility of the existing proposal, which the Home Office must address. These are set out in the following sections. It is also important for ICRs to be properly authorised and overseen, and these issues will be considered in subsequent chapters. (Paragraph 106)
13.We recommend that the Government should publish in a Code of Practice alongside the Bill advice on how data controllers should seek to minimise the privacy risks of subject access requests for ICRs under the Data Protection Act 1998. (Recommendation 5) (Paragraph 107)
14.While we recognise that ICRs could prove a desirable tool for law enforcement agencies, the Government must address the significant concerns outlined by our witnesses if their inclusion within the Bill is to command the necessary support. (Recommendation 6) (Paragraph 108)
15.We acknowledge that, as with communications data, it is difficult to provide definitions of ICRs broad enough to capture the variety of ways in which communications are conducted on the internet, and may be conducted in the future, while still providing sufficient clarity, technical detail and precision. (Paragraph 120)
16.We welcome the additional information the Home Office has provided on ICRs, though we are not in a position to assess the extent to which it meets the concerns of witnesses as to a lack of clarity. (Paragraph 121)
17.We recommend that the definition of Internet Connection Records should be made consistent throughout the Bill and that the Government should give consideration to defining terms such as ‘internet service’ and ‘internet communications service’. We recommend that more effort should be made to reflect not only the policy aims but also the practical realities of how the internet works on a technical level. (Recommendation 7) (Paragraph 122)
18.We do not believe that ICRs are the equivalent of an itemised telephone bill. However well-intentioned, this comparison is not a helpful one. (Paragraph 126)
19.The Committee acknowledges that there are important differences between the ICR proposal in the draft Bill and the system which was used in Denmark. We believe that the Home Office has learned lessons from the Danish model that will increase the chances of ICRs being effective. (Paragraph 146)
20.We recommend that the Government should publish a full assessment of the differences between the ICR proposal and the Danish system alongside the Bill. (Recommendation 8) (Paragraph 147)
21.The Committee is grateful to the many witnesses who submitted detailed consideration of Internet Connection Records. We urge the Government to explain in its response to this report how the issues which have been raised about the technical feasibility of ICRs will be addressed in practice. (Paragraph 150)
22.We agree that all of the proposed purposes for which access to ICRs could be sought are appropriate. Furthermore, we recommend that the purposes for which law enforcement may seek to access ICRs should be expanded to include information about websites that have been accessed that are not related to communications services nor contain illegal material, provided that this is necessary and proportionate for a specific investigation. (Paragraph 155)
23.We recommend that the purposes for which law enforcement may seek to access ICRs should be expanded to include information about websites that have been accessed that are not related to communications services nor contain illegal material, provided that this is necessary and proportionate for a specific investigation. (Recommendation 9) (Paragraph 155)
Data Retention
24.While judgements from the European Court of Justice are outstanding, legislation in this area will remain subject to potential change. Whether ICRs are included or not, we believe that, in light of the ongoing need for communications data and the imminent expiry of DRIPA, a continued policy of some form of data retention is appropriate and that these provisions should accordingly form part of the Bill. (Paragraph 162)
25.The security of retained data, especially such potentially intrusive data, is of great importance. We have received assurances from the Home Office that it is possible to hold such data securely if high standards are set, observed, and regularly scrutinised but data theft remains an ongoing challenge. (Paragraph 174)
26.We urge the Government to consider the suggestion to work with the Information Commissioner’s Office, the National Technical Assistance Centre and the Communications-Electronics Security Group at GHCQ, which has recognised expertise in this area, to draw up a set of standards for CSPs. (Recommendation 10) (Paragraph 175)
27.We are not convinced that targeted retention orders are a viable alternative to a data retention provision, as they do not provide retrospective information and would be of limited value in instances where criminal action had ceased. (Paragraph 183)
28.Any fixed retention period will always risk being arbitrary. We believe on balance that law enforcement have made the case for a 12 month retention period and support its inclusion in the Bill. (Paragraph 186)
29.We are not able to make an assessment of the accuracy of the data retention costs provided by the Government. We urge the Government to continue working with CSPs to improve the detail of the cost estimates for data retention to show how it will be deliverable in practice and deliver value for money. (Paragraph 195)
30.As the communications data will be held for purposes that are not related to the CSP’s own business purposes, we agree that the Government should provide CSPs with whatever technical and financial support is necessary to safeguard the security of the retained data. While we do not agree that 100% cost recovery should be on the face of the Bill, we do recommend that CSPs should be able to appeal to the Technical Advisory Board on the issue of reasonable costs. (Recommendation 11) (Paragraph 196)
31.Our view is that the Government should provide statutory guidance on the cost recovery models, and that particular consideration should be given to how the Government will support smaller providers served with data retention notices. (Recommendation 12) (Paragraph 197)
32.We agree with the Government’s intention not to require CSPs to retain third party data. The Bill should be amended to make that clear, either by defining or removing the term “relevant communications data”. (Recommendation 13) (Paragraph 205)
33.We recommend that the Government should clarify the types of data it expects CSPs to generate and in what quantities so that this information can be considered when the Bill is introduced. (Recommendation 14) (Paragraph 209)
34.We believe that the definition of telecommunications service providers cannot explicitly rule out smaller providers without significantly compromising the data retention proposals as a whole. We acknowledge that the potential burden of data retention notices, particularly for smaller providers, could be acute. This makes the clarification of cost models, as we have recommended above, essential. (Paragraph 220)
35.We are reassured that a route of appeal for data retention notices exists in Clause 73. (Paragraph 221)
36.We understand the Government’s position for not allowing the fact that a data retention notice has been served to be referred to in public. We suggest that some forum or mechanism, perhaps through the Technical Advisory Board, is made available so that CSPs subject to such notices can share views on how best to comply with them. (Recommendation 15) (Paragraph 228)
37.We believe that the Intelligence and Security Committee and the Investigatory Powers Commissioner should have access to a list of CSPs served with data retention notices and that their scrutiny will be a valuable check on the appropriate use of this power. We also acknowledge that the Information Commissioner’s Office will scrutinise the information security arrangements of CSPs subject to data retention notices and will therefore need to be informed of the existence and content of relevant notices. (Paragraph 229)
Request Filter
38.We welcome the amendments that have been made to the Request Filter proposal. They constitute an improvement on that which was included in the Draft Communications Data Bill. (Paragraph 238)
39.We welcome the Government’s proposal to build and operate a Request Filter to reduce the amount of potentially intrusive data that is made available to applicants. We believe that the technical and security challenges involved in implementing the Request Filter can be met and would urge the Investigatory Powers Commissioner to examine and report on it to ensure that it is secure. (Paragraph 246)
40.We acknowledge the privacy risks inherent in any system which facilitates access to large amounts of data in this manner. We believe that the requirement upon law enforcement to state the operational purpose for accessing data through the filter will provide an important safeguard that can be assessed by the Investigatory Powers Commissioner and that the oversight of the Commissioner will be sufficient to prevent the Request Filter being used for “fishing expeditions” and ensure that it is used proportionately. (Paragraph 247)
Encryption
41.We agree with the intention of the Government’s policy to seek access to protected communications and data when required by a warrant, while not requiring encryption keys to be compromised or backdoors installed on to systems. The drafting of the Bill should be amended to make this clear. (Recommendation 16) (Paragraph 263)
42.The Government still needs to make explicit on the face of the Bill that CSPs offering end-to-end encrypted communication or other un-decryptable communication services will not be expected to provide decrypted copies of those communications if it is not practicable for them to do so. We recommend that a draft Code of Practice should be published alongside the Bill for Parliament to consider. (Recommendation 17) (Paragraph 264)
Targeted Equipment Interference
43.The Committee welcomes the fact that the EI techniques and powers are now properly addressed in legislation. (Paragraph 268)
44.We are grateful for the information provided about EI on visits to the Metropolitan Police and to GCHQ, which has assisted our ability to scrutinise this power. (Paragraph 272)
45.We agree that targeted equipment interference has the potential to be very intrusive. (Paragraph 286)
46.There is nevertheless a substantive case for the targeted equipment interference power. We believe that, subject to the appropriate authorisation process involving a Judicial Commissioner, such activities should be conducted when necessary and proportionate. (Paragraph 287)
47.We recommend that the Government should produce a Code of Practice on Equipment Interference to cover the activities both of the security and intelligence agencies and of law enforcement. (Recommendation 18) (Paragraph 288)
48.We note that, if our recommendation for post-legislative review five years after the Bill’s enactment is implemented, a tighter definition can be introduced without running the risk of law enforcement and the agencies being left behind by technological advancement. (Paragraph 292)
49.We acknowledge both the concerns of witnesses about the breadth of the definitions and the desire of Government not to inadvertently rule out access to new types of equipment or system in the future. (Paragraph 293)
50.We believe that the involvement of Judicial Commissioners in the authorisation process may ensure that the equipment and systems targeted by EI activities will be proportionate and considered foreseeable. (Paragraph 294)
51.We recommend that the Government should produce more specific definitions of key terms in relation to EI to ensure greater confidence in the proportionality of such activities and that a revised Code of Practice is made available alongside the Bill. (Recommendation 19) (Paragraph 295)
52.We acknowledge the importance of data protection in relation to EI activities. We recommend that the assessments undertaken by Judicial Commissioners when authorising warrants should give consideration to data protection issues. (Recommendation 20) (Paragraph 298)
53.We further recommend that the Home Office should make clear in the explanatory notes to the Bill or in a Code of Practice how EI activities can be conducted within the constraints of data protection legislation. (Recommendation 21) (Paragraph 299)
54.We agree that material acquired through targeted equipment interference warrants should be admissible in court, though we share the concerns of witnesses about the risks involved. We believe that law enforcement and the security and intelligence agencies will need detailed codes of practice and appropriate procedures to ensure that evidence is not inadvertently compromised. We urge the Government to consider how it will reconcile the understandable desire of law enforcement and the security and intelligence agencies to keep their techniques secret with the need for evidential use and disclosure regimes in legal proceedings. (Recommendation 22) (Paragraph 305)
Bulk Capabilities
55.We commend the Home Office for making explicit provision for these bulk powers and for giving the Parliament an opportunity to debate and decide upon them. (Paragraph 309)
56.We recommend that the Government should publish a fuller justification for each of the bulk powers alongside the Bill. We further recommend that the examples of the value of the bulk powers provided should be assessed by an independent body, such as the Intelligence and Security Committee or the Interception of Communications Commissioner. (Recommendation 23) (Paragraph 319)
57.We recognise that, given the global nature of the internet, the limitation of the bulk powers to “overseas-related” communications may make little difference in practice to the data that could be gathered under these powers. We recommend that the Government should explain the value of including this language in the Bill. (Recommendation 24) (Paragraph 323)
58.It is possible that the bulk interception and equipment interference powers contained in the draft Bill could be exercised in a way that does not comply with the requirements of Article 8 as defined by the Strasbourg court. It will be incumbent upon the Secretary of State and judicial commissioners authorising warrants, and the Investigatory Powers Commissioner’s oversight of such warrants, to ensure that their usage is compliant with Article 8. (Paragraph 331)
59.We are aware that the bulk powers are not a substitute for targeted intelligence, but believe that they are an additional resource. Furthermore, we believe that the security and intelligence agencies would not seek these powers if they did not believe they would be effective and that the fact that they have been operating for some time would give them the confidence to assess their merits. (Paragraph 340)
60.National security considerations mean that we are not well-placed to make a thorough assessment of the value of the bulk powers. The scrutiny and conclusions of the Intelligence and Security Committee on the Bill will be of significant assistance for Parliamentarians considering these powers. (Paragraph 341)
61.We are grateful to the Home Secretary for the additional information she provided on safeguards for bulk powers, but note that her letter arrived too late for other witnesses to give the Committee their views upon it. (Paragraph 347)
62.In general, we are content that the safeguards proposed by the Home Office, buttressed by authorisation by Judicial Commissioners and oversight from the Investigatory Powers Commissioner will be sufficient to ensure that the bulk powers are used proportionately. (Paragraph 348)
63.We acknowledge, though, the call for greater safeguards for the bulk powers. We believe that it is difficult to make a thorough assessment of the effectiveness of further safeguards without a greater understanding of the way in which bulk powers are operated in practice. (Paragraph 349)
64.We recommend that the Investigatory Powers Commissioner, within two years of appointment, should produce a report to Parliament considering the safeguards that exist and making recommendations for improvements if required. (Recommendation 25) (Paragraph 349)
65.We agree that bulk communications data has the potential to be very intrusive. As with the other bulk powers, we believe that the fuller justification which we have recommended the Government produces and the conclusions of the Intelligence and Security Committee on the Bill will assist Parliament’s consideration of the necessity and appropriateness of bulk acquisition. (Paragraph 362)
66.We recommend that applications for targeted and bulk EI warrants should include a detailed risk analysis of the possibilities of system damage and collateral intrusion and how such risks will be minimised. We also recommend that such warrants should detail how any damaged equipment will be returned to its previous state at the point that the authorisation or operational need ceases. (Recommendation 26) (Paragraph 372)
67.We acknowledge the concerns of CSPs and other companies who may be required to be complicit in EI activities. We believe that, on balance, it is necessary, subject to a warrant that has been authorised as necessary and proportionate by the Secretary of State and a Judicial Commissioner. (Paragraph 373)
68.We recommend that the Code of Practice on equipment interference should set out how individuals and companies should be engaged with when conducting authorised EI activities to make the process more transparent and foreseeable. (Recommendation 27) (Paragraph 374)
Bulk Personal Datasets
69.We are grateful to the Home Secretary for the additional information she provided to the Committee on bulk personal datasets (BPDs). We believe that that the lack of a formal case for BPDs remains a shortcoming when considering the appropriateness of this power. (Paragraph 389)
70.We recommend that the Home Office should produce its case for bulk personal datasets (BPDs) when the Bill is published. (Recommendation 28) (Paragraph 390)
71.We recommend that the Intelligence and Security Committee, in their analysis of BPDs, should assess the extent to which the concerns expressed by witnesses are justified. (Recommendation 29) (Paragraph 391)
72.While the Committee acknowledges the case made by the Home Office for not providing detailed information as to the contents of bulk personal datasets (BPDs), the lack of that detail makes it hard for Parliament to give the power sufficient scrutiny. (Paragraph 403)
73.The safeguards for BPDs are not sufficiently explained in the Bill. We have not seen a draft Code of Practice on BPDs, and we therefore do not know whether BPDs will, in practice, be treated differently from the communications datasets that are referred to in parts 4 and 6 of the Bill (and which also appear to fall under the definition of a BPD). (Paragraph 406)
74.We believe that a draft Code of Practice on BPDs should be published when the Bill is introduced to provide greater clarity on the handling of BPDs, not least in relation to the provisions of the Data Protection Act 1998. To the greatest extent possible, the safeguards that appear in the Data Protection Act 1988 should also apply to personal data held by the security and intelligence agencies. (Recommendation 30) (Paragraph 407)
75.We also agree that existing powers for acquiring BPDs should be consolidated in this Bill and that any other powers for the security and intelligence agencies to acquire BPDs should be repealed. (Recommendation 31) (Paragraph 408)
Authorisation of Warrants
76.The Committee is satisfied that a case has been made for having a ‘double-lock’ authorisation for targeted interception, targeted equipment interference, and bulk warrants. (Paragraph 421)
77.The Committee is satisfied with the wording in the Bill and believes that the judicial review principles will afford the Judicial Commissioners a degree of flexibility, as outlined by the Home Secretary. (Paragraph 433)
Authorisation of Targeted Interception
78.The Committee believes that a modification, as currently worded in the draft Bill, might include adding a whole new set of people or premises to an existing warrant. The warrant could therefore be changed in a substantial way without any judicial oversight. (Paragraph 438)
79.The Committee recommends that major modifications for targeted interception warrants, as defined in the draft Bill, should also be authorised by a Judicial Commissioner. (Recommendation 32) (Paragraph 439)
80.The omission of a reference to the Mental Health (Care and Treatment) (Scotland) Act appears to us to be an oversight, which we agree could lead to the creation of conflicting authorisation regimes for the use of interception in psychiatric hospitals in Scotland. (Paragraph 443)
81.The Committee recommends that this apparent oversight be addressed in the revised Bill. (Recommendation 33) (Paragraph 443)
82.We recommend that the Home Office should further review its list of investigatory powers in other legislation to ensure that nothing else has been overlooked. (Recommendation 34) (Paragraph 444)
Authorisation of Targeted Equipment Interference
83.The Committee believes that the differential approach to authorisations and modifications for targeted equipment interference warrants applied to the security and intelligence agencies and law enforcement agencies is confusing and unjustified. (Paragraph 450)
84.We therefore recommend that the approach to targeted equipment interference warrants should be standardised and that all modifications should be subject to judicial authorisation. (Recommendation 35) (Paragraph 450)
85.The Committee is satisfied that the safeguards for equipment interference are adequately set out in the Code of Practice and do not need to also be reflected on the face of the Bill. (Paragraph 452)
Authorisation of Urgent Warrants
86.While the Committee accepts that there will be some exceptionally urgent circumstances in which a warrant will need to be authorised immediately, it is not clear why the period for the Judicial Commissioner to review and authorise the warrant should be as long as five working days. (Paragraph 456)
87.The Committee therefore recommends that the period in which urgent warrants must be reviewed by a Judicial Commissioner should be shortened significantly. We suggest that they must be reviewed within 24 hours of their signature by the Secretary of State (Recommendation 36) (Paragraph 457)
88.We agree that greater clarity on the term “urgent” is required. (Paragraph 458)
89.The Committee recommends the inclusion of a definition of the word “urgent” for the purposes of authorising urgent warrants. (Recommendation 37) (Paragraph 460)
Authorisation of Thematic Warrants
90.The Committee agrees that the current wording of the provisions for targeted interception and targeted equipment interference warrants is too broad. (Paragraph 467)
91.The Committee recommends that the language of the Bill be amended so that targeted interception and targeted equipment interference warrants cannot be used as a way to issue thematic warrants concerning a very large number of people. (Recommendation 38) (Paragraph 468)
Authorisation of Communications Data
92.The Committee is satisfied that the proposed authorisation process for communications data is appropriate but recommends that extra protections for privileged and confidential communications should be applied in the same way as is proposed for journalists in Clause 61. (Recommendation 39) (Paragraph 474)
93.The Committee understands the value of local authorities being able to access communications data in limited circumstances and is content with the proposed authorisation process. (Paragraph 478)
94.The Committee recommends the removal of emergency procedures for communications data so that the Single Point of Contact process can never be bypassed. (Recommendation 40) (Paragraph 482)
95.The Committee agrees with the conclusions of the Delegated Powers and Regulatory Reform Committee (DPRRC) on the enhanced affirmative procedure for amendments to Clause 54 and Schedule 4. We join them in welcoming the strengthening of scrutiny procedures in this area of the draft Bill. (Paragraph 485)
96.The Committee agrees with the recommendation of the DPRRC on modifications to the list of ranks and offices which must be held by a designated senior officer. We recommend that Clause 56(1) and Clause 57(4) should be amended accordingly. (Recommendation 41) (Paragraph 489)
Authorisation of Bulk Powers
97.Subject to the views of the Intelligence and Security Committee regarding bulk powers, we are confident that the Judicial Commissioners would be able to assess the necessity and proportionality criteria in relation to bulk warrants. (Paragraph 493)
Authorisation of Bulk Personal Datasets
98.The Committee recommends that authorisations for bulk personal datasets should be required to be specific and provisions for class authorisations should be removed from the Bill. The provision relating to replacement datasets (Clause 154(6)) should also be removed. (Recommendation 42) (Paragraph 497)
National Security and Technical Capability Notices
99.The Committee accepts that National Security and Technical Capability notices are different in scope and intrusion to the types of warrants that will need to be authorised by a Judicial Commissioner. We are therefore content that these notices should be issued by the Secretary of State without reference to a Judicial Commissioner. (Paragraph 502)
Intelligence Sharing
100.The Committee believes that leaving the decision regarding the propriety of sharing intercept material with an overseas authority to the appropriate issuing authority is not a strong enough safeguard (Paragraph 510)
101.The Committee would like to see more safeguards for the sharing of intelligence with overseas agencies on the face of the Bill. These should address concerns about potential human rights violations in other countries that information can be shared with. (Recommendation 43) (Paragraph 511)
102.The Committee also recommends that the Bill should make it illegal for UK bodies to ask overseas agencies to undertake intrusion which they have not been authorised to undertake themselves. (Recommendation 44) (Paragraph 512)
Extraterritoriality
103.We recommend that the Government should give more careful consideration to the consequences of enforcing extraterritoriality. The Government should re-double its efforts to implement Sir Nigel Sheinwald’s recommendations. (Recommendation 45) (Paragraph 518)
Privileged Communications
104.The Committee is concerned that the Bill as drafted only provides (through a proposed code of practice relating to Part 3 of the Bill) for the application of LPP in the case of communications data (despite the information provided by the Home Office which suggests provisions of the code will relate to acquisition of other material). (Paragraph 534)
105.The Committee is further concerned that there are no substantive provisions addressing LPP even in the case of communications data on the face of the Bill and considers that this may call into question the application of LPP when the Bill’s powers are exercised, particularly given the judgment in McE and the inclusion of specific provisions in other legislation conferring investigatory powers. Additionally, the lack of a draft code prevents the Committee scrutinising provisions on an important matter. (Paragraph 535)
106.The Committee notes the Home Office’s concerns about potential abuse of privileges by either lawyers or their clients. (Paragraph 536)
107.The Committee recommends that provision for the protection of Legal Professional Privilege (LPP) in relation to all categories of acquisition and interference addressed in the Bill should be included on the face of the Bill and not solely in a code of practice. The Government should consult with the Law Societies and others as regards how best this can be achieved. (Recommendation 46) (Paragraph 537)
108.The Home Office should review its proposals in relation to LPP to ensure that they meet the requirements of Article 8 and relevant case law. (Recommendation 47) (Paragraph 538)
109.The Committee considers that protection for journalistic privilege should be fully addressed by way of substantive provisions on the face of the Bill. (Paragraph 553)
110.The Committee recommends that the Home Office should reconsider the level of protection which the Bill affords to journalistic material and sources. This should be at least equivalent to the protection presently applicable under PACE and the Terrorism Act 2000. (Recommendation 48) (Paragraph 554)
111.The Committee recommends that if Clause 61 remains in its present form the Bill should make it clear that RIPA and Clause 61 do not act so as to enable the investigatory authorities to avoid the application of PACE or the Terrorism Act and the ability they afford to media to know about an application for communications data and make representations as to the proposed acquisition. (Recommendation 49) (Paragraph 555)
112.The Home Office should review Clause 61 to ensure that it meets the requirements of Article 10 ECHR. (Recommendation 50) (Paragraph 556)
113.The Committee considers that the approach taken in the Bill to surveillance of Parliamentarians strikes an effective balance between the need for Parliamentarians to be able to communicate fully and frankly with their constituents and other relevant third parties and the needs of the security and intelligence agencies and law enforcement agencies. (Paragraph 564)
Judicial Commissioners
114.It is unclear to us why the Home Office chose to create a group of Judicial Commissioners rather than creating an Independent Intelligence and Surveillance Commission as recommended by David Anderson QC, a recommendation endorsed by the knowledgeable and experienced Interception of Communications Commissioner’s Office. The benefits of having a senior independent judicial figure in the Investigatory Powers Commissioner would not be lost by putting the IPC at the head of a Commission. The evidence we have heard is that the work of the oversight body will be significantly enhanced by the creation of a Commission with a clear legal mandate. (Paragraph 574)
115.We recommend that such a Commission should become the oversight body in the Bill. (Recommendation 51) (Paragraph 574)
116.The Judicial Commissioners or Commission should have the power to instigate investigations on their or its own initiative. This is vital in order to ensure effective and independent oversight. The current provisions in the draft Bill on the powers of the Judicial Commissioners do not make it clear that they have this power. We recommend that a power to initiate investigations should appear on the face of the Bill. (Recommendation 52) (Paragraph 575)
117.We welcome the creation of the Judicial Commissioners as a single oversight body which will improve transparency, public confidence and effective oversight of the use of the powers contained in the Bill. (Paragraph 579)
118.We do not think that appointment by the Prime Minister would in reality have any impact on the independence of the Investigatory Powers Commissioner and Judicial Commissioners. In modern times, our senior judges have had an unimpeachable record of independence from the executive and we believe any senior judge appointed to these roles would make his or her decisions unaffected by the manner of appointment. (Paragraph 587)
119.We recommend that the Lord Chief Justice should have the power to appoint Judicial Commissioners following consultation with his judicial counterparts in Scotland and Northern Ireland and with the Prime Minister, Scottish Ministers, and the First Minister and deputy First Minister in Northern Ireland. This will ensure public confidence in the independence and impartiality of the Judicial Commissioners. It will also enhance political confidence in them. The Lord Chief Justice will also be able to assess the impact of appointments on the work of the High Court and the Court of Appeal, which must not be impaired by the creation of the Judicial Commissioners. The Judicial Appointments Commission must also be consulted to ensure that the appointments procedure is fair and transparent. (Recommendation 53) (Paragraph 588)
120.We accept concerns that having renewable terms of appointment could have negative implications for public confidence in the independence of Judicial Commissioners. We conclude that these concerns strengthen the argument for the power of appointment being held by the Lord Chief Justice, rather than the Prime Minister. (Paragraph 592)
121.The Government should reconsider both the length of terms of appointment and whether they should be renewable. Terms need to be long enough for Judicial Commissioners to build expertise but should not be so long that they have a negative impact on a serving judge’s career. It may be that three-year terms with an option for renewal is the most workable solution but we recommend that there should be careful reconsideration of these provisions in consultation with the Lord Chief Justice, Judicial Appointments Commission, the current surveillance Commissioners and other interested parties to ensure the benefits and disadvantages of the different approaches have been thoroughly examined. (Recommendation 54) (Paragraph 593)
122.Maintaining public confidence in the Judicial Commissioners may occasionally require that a Commissioner is removed from the role because he or she has behaved in a manner incompatible with what is, in effect, high judicial office. Public confidence also requires that the power to remove from office does not damage the public perception of the Judicial Commissioners’ independence from the executive or the freedom of the Judicial Commissioners to make decisions that may be unpopular with the Government. We believe that the broad powers of dismissal contained in the draft Bill significantly impair the independence of the Judicial Commissioners. We therefore recommend that the Judicial Commissioners be subject to the same dismissal and suspension procedures as those applicable to serving senior judges: removal from office following a resolution of both Houses of Parliament and suspension and other disciplinary measures exercised by the Lord Chief Justice and Lord Chancellor. (Recommendation 55) (Paragraph 597)
123.We believe it is inappropriate for the Home Secretary alone to determine the budget of the public body which is monitoring her exercise of surveillance powers. The Government may want to consider a role for Parliament in determining the budget. (Recommendation 56) (Paragraph 604)
124.Clause 177 contains a power for the Home Secretary to modify the functions of the Judicial Commissioners. While we recognise the concerns of some of our witnesses, we believe such a power is appropriate as we have every confidence such a power would only be exercised responsibly by the Secretary of State. (Paragraph 608)
125.While we accept that the Judicial Commissioners must not be perceived as overseeing their own work, we do not think this is an insurmountable problem. We agree with the Home Secretary that the senior judges who will act as Judicial Commissioners will be well aware of the need to separate the authorisation and oversight functions with which they are entrusted. We emphasise that there needs to be a clear delineation of functions within the Judicial Commissioners in order to ensure public confidence in the independence and impartiality in the exercise of the Commissioners’ oversight functions. (Paragraph 612)
126.Clause 171 changes the existing powers of the relevant commissioners to report errors in the use of surveillance powers to the individuals affected by raising the applicable test and requiring the involvement of the Investigatory Powers Tribunal in making the decision. This approach is cumbersome and unnecessary given there are no concerns over the way the current oversight bodies have used their powers of error-reporting. We recommend that the Investigatory Powers Commissioner exercise the error-reporting power alone, without reference to the Investigatory Powers Tribunal. (Recommendation 57) (Paragraph 621)
127.We recommend that the Government should review the error-reporting threshold in light of the points made by witnesses. (Recommendation 58) (Paragraph 622)
128.It should be made clear in the duties laid on the Judicial Commissioners in subclauses 169(5) and (6) that they must comply with those duties in a proportionate manner. The subclauses are drafted in very broad and uncertain terms which have the potential to impact upon the work of Judicial Commissioners in unintended ways. Public confidence in the independence of the Judicial Commissioners requires clarity and transparency in both powers and duties. We recommend that Clauses 169(5) and (6) should be re-drafted to protect the Judicial Commissioners’ independence and to ensure the Judicial Commissioners are not constrained from providing effective oversight. (Recommendation 59) (Paragraph 626)
129.We recommend that the Bill should contain an explicit provision for Communication Service Providers and staff in public authorities to refer directly to the Judicial Commissioners any complaint or concern they may have with the use of the powers under the Bill or any request for clarification on the use of those powers. Where clarification is provided the Judicial Commissioners will need to have the power to make that information public should it be appropriate in the circumstances. This will enable better compliance with the provisions of the Bill and will help to reduce costs. (Recommendation 60) (Paragraph 629)
130.We recommend that members of the security and intelligence agencies should be able to contact the Investigatory Powers Commissioner with concerns over the misuse of surveillance powers without being at risk of prosecution for breaching the Official Secrets Act. The Investigatory Powers Commissioner should then have discretion whether to exercise his or her power to initiate an inquiry into the allegations. We recognise that there may be wider concerns over the role of whistle-blowers in this area. This is a matter which requires consultation and therefore this is not the appropriate Bill in which those wider concerns should be taken forward. (Recommendation 61) (Paragraph 630)
131.The law in this area is complex and developing. Judicial Commissioners will have to make decisions without the benefit of adversarial argument. We agree with the Independent Reviewer of Terrorism that Judicial Commissioners must have access to both in-house legal expertise and, on request, security-cleared independent counsel to assist them in both the authorisation and oversight functions of their role. (Recommendation 62) (Paragraph 634)
132.We recommend that the Judicial Commissioners should have a legal mandate to access all relevant technical systems required to ensure effective oversight of the powers contained in the Bill. This mandate should appear on the face of the Bill. (Recommendation 63) (Paragraph 637)
133.We recommend that the Judicial Commissioners should have access to technical expertise to assist them in fulfilling their authorisation and oversight functions. (Recommendation 64) (Paragraph 638)
134.The Judicial Commissioners should be able to communicate with the Investigatory Powers Tribunal on a point of law without consulting the Home Secretary. Clause 172(3) should be redrafted to reflect this. (Recommendation 65) (Paragraph 640)
135.The Judicial Commissioners should be able to make a direct reference to the Investigatory Powers Tribunal where they have identified unlawful conduct following an inspection, audit, investigation or complaint. (Recommendation 66) (Paragraph 642)
136.The Investigatory Powers Commissioner’s annual report must include information about the impact, results and extent of the use of powers in the Bill so effective public and parliamentary scrutiny of the results of the powers can take place. (Recommendation 67) (Paragraph 646)
137.The Investigatory Powers Commissioner should be able to inform the Intelligence and Security Committee if he or she is unhappy about the use of the Prime Minister’s power to redact his annual report. (Recommendation 68) (Paragraph 647)
138.We recommend that the Judicial Commissioners should have the power to develop guidance to public authorities to assist them in applications seeking to use investigatory powers. This will help applicant bodies to formulate focused applications saving time and resources. Where the constraints of national security allow, the guidance should be published in the interests of public transparency and foreseeability. (Recommendation 69) (Paragraph 649)
Investigatory Powers Tribunal
139.We recommend that the right of appeal from the Investigatory Powers Tribunal in Clause 181 should be amended to include cases where there has been an error of law to prevent injustice as a matter of public policy and to satisfy the rule of law. (Recommendation 70) (Paragraph 654)
140.We recommend that rulings in the Investigatory Powers Tribunal should be subject to an interim right of appeal on the grounds of an error of law to save time and costs. (Recommendation 71) (Paragraph 655)
141.We recommend that the appeal route for Scotland and Northern Ireland should appear on the face of the Bill. It is unclear to us why there is not a specified route of appeal in Scotland and Northern Ireland nor what appellants in those parts of the United Kingdom are expected to do before the Home Secretary issues regulations on this issue. (Recommendation 72) (Paragraph 656)
142.The Home Office should conduct a consultation and review of the powers and procedures of the Investigatory Powers Tribunal with the aim of improving openness, transparency and access to justice. (Recommendation 73) (Paragraph 660)
143.The Investigatory Powers Tribunal should have the power to decide whether its proceedings should be held in public. When making a decision on whether a hearing or part of a hearing should be open or not the Tribunal should apply a public interest test. (Recommendation 74) (Paragraph 663)
144.The Investigatory Powers Tribunal should be able to make a declaration of incompatibility under the Human Rights Act. (Recommendation 75) (Paragraph 666)
The Oversight Landscape
145.We have heard evidence that there is potential for the further simplification of the oversight landscape. This would improve transparency, reduce overlaps and ensure consistency of decision-making which would all contribute to ensuring oversight of the powers contained in the Bill comply with international law standards. We recommend that the Home Office should carry out a review to identify areas in which further simplification of oversight could occur. (Recommendation 76) (Paragraph 670)
146.We call on the Government to outline its plans for the establishment of the Privacy and Civil Liberties Board. (Recommendation 77) (Paragraph 671)
Remaining Issues
147.The Committee recommends that the Government keeps the issue of the inadmissibility of intercept material as evidence under review and takes note of the significant perceived benefits of using such material as evidence. (Recommendation 78) (Paragraph 675)
148.The Committee recommends that the Government should consider the Chief Coroner’s proposals and engages further with him to come to a satisfactory agreement about which judges can be included in the list in Schedule 3. (Recommendation 79) (Paragraph 679)
149.We agree with this conclusion of the DPRRC on the power in Clause 201 (2) to make consequential provision and recommend the deletion of powers to amend future enactments. (Recommendation 80) (Paragraph 682)
150.We agree with the DPRRC that the negative procedure for these powers is inappropriate and recommend that any modifications to primary legislation be subject to the super-affirmative resolution procedure. (Recommendation 81) (Paragraph 684)
151.The Committee recommends that the Bill should include a definition of national security in order to provide clarity to the circumstances in which these warrants can be issued. (Recommendation 82) (Paragraph 691)
152.The Committee recommends that the Bill should include a definition of economic well-being in order to provide clarity to the circumstances in which these warrants can be issued. (Recommendation 83) (Paragraph 696)
153.The Codes of Practice will provide essential further details on how the powers in the draft Bill will be used in practice We recommend that all of them should be published when the Bill itself is introduced to allow both Houses to conduct full scrutiny of their contents. (Recommendation 84) (Paragraph 698)
154.We urge the Investigatory Powers Commissioner to scrutinise the automated analysis of bulk datasets conducted by the security and intelligence agencies to ensure that they are conducted appropriately and proportionately and with regard to privacy and data protection requirements. (Recommendation 85) (Paragraph 703)
155.We note the reservations expressed by the Home Secretary about a sunset provision. But we are of the view that some form of review after five years would be merited. We believe that a review provision of this sort, which would require the next Parliament to revisit the powers which are in the draft Bill, would go some way to provide assurance to those who have expressed concerns over the operational case for some of these powers. The evidence of several years’ operation will inform the debate. A provision which asked Parliament to revisit the intrusive powers it gives to the Executive after a period would, in our view, be a healthy way to fulfil the welcome aspirations for greater openness and legitimacy which underpin the draft Bill. (Paragraph 708)
156.We agree with the Information Commissioner and others that the provisions of the Bill would benefit from detailed post-legislative scrutiny after an appropriate period. In our view, the appropriate vehicle to do this would be a specially constituted joint committee of the two Houses. This work should begin within six months of the end of the fifth year after which the Bill is enacted. Although the appointment of such a committee would be a matter for the two Houses, a provision in the Bill would provide a clear mandate and guarantee the timescale for this review. (Paragraph 709)
157.We recommend that a provision should be added to the face of the Bill for post-legislative scrutiny by a committee of the two Houses within six months of the end of the fifth year after the Bill is enacted. (Recommendation 86) (Paragraph 710)