Data Retention and Investigatory
1. The Data Retention and Investigatory Powers
Bill was introduced to the House of Commons on 14 July 2014. It
was taken through all its Commons stages on 15 July and is scheduled
to be fast-tracked also through the House of Lords: second reading
is scheduled for 16 July and its remaining stages are scheduled
for 17 July. The bill was announced and published in draft on
2. The Constitution Committee published in 2009
a report on fast-track legislation in which we recommended, among
other matters, that a government introducing fast-track legislation
into Parliament should comply with certain requirements.
In particular, we recommended that the Government should fully
explain and justify why, in their opinion, it is necessary for
legislation to be fast-tracked.
The then Government accepted our recommendations. In all subsequent
cases of fast-track legislation the explanatory notes accompanying
the bill have included information as to why the Government consider
that fast-tracking is necessary; the explanatory notes on the
Data Retention and Investigatory Powers Bill include that information.
We welcome this. We also welcome the fact that the bill
was published last week in draft, which allowed us three more
days than would otherwise have been available to scrutinise it
(albeit over a weekend). In our 2009 report we recommended that
there should be a presumption that fast-track bills contain a
sunset provision. We
therefore welcome clause 6(3) of this bill, which provides that
the substantive provisions of the bill are repealed on 31 December
2016. We also welcome the amendments made in the House of Commons
in clauses 6 and 7, that there will be regular reports on and
a review of the operation and regulation of investigatory powers.
3. Experience continues to bear out, however,
the risks associated with fast-track legislation. The last bill
to be fast-tracked through Parliament was the Jobseekers (Back
to Work Schemes) Act 2013. We reported that bill to the House,
noting concerns about whether the measure was "constitutionally
appropriate in terms of the rule of law".
In a judgment handed down on 4 July 2014 the Administrative Court
declared the Act to be incompatible with the Convention right
to a fair trial. This
episode underscores the constitutional undesirability of fast-track
4. The bill contains provisions on two matters:
retention of communications data and investigatory powers under
the Regulation of Investigatory Powers Act 2000 ("RIPA").
Retention of communications data
5. Government requirements for retention of communications
data are currently provided for by the Data Retention (EC Directive)
Regulations 2009 ("the
2009 Regulations"). The 2009 Regulations implemented in the
United Kingdom the Data Retention Directive (2006/24/EC). In a
judgment handed down on 8 April 2014 the Court of Justice of the
European Union ("CJEU") declared that directive invalid
on the ground that it was a disproportionate interference with
certain rights under the EU Charter of Fundamental Rights.
This ruling affects the lawfulness of the 2009 Regulations. Clauses
1 and 2 of the bill confer on the Secretary of State the powers
currently in the 2009 Regulations to require service providers
to retain communications data. In the words of the explanatory
notes "mandatory data retention is necessary because without
it data protection law requires service providers to delete data
that they no longer need for business purposes". Mandated
data retention is "crucial for law enforcement to investigate,
detect and prevent crimes".
In a statement to the House of Commons the Home Secretary said
that it has been "used as evidence in 95% of all serious
organised crime cases handled by the Crown Prosecution Service".
We recognise that, given the CJEU's judgment, the 2009 Regulations
lack legal authority and that fresh legislation is urgently required
to replace them.
6. When legislation is fast-tracked through Parliament,
the fact that the Government need to respond to a court decision
is frequently offered as the reason.
In this instance, we note that the CJEU's decision was handed
down in early April 2014. Thus the Government have had more than
three months to consider their response, yet they propose that
Parliament be given less than one week (in fact three sitting
days) to legislate.
Moreover, so far as we are aware, between April and 10 July 2014
the Government did not indicate that fast-track legislation may
be necessary to address the court judgment. The contrast between
the time taken by the Government to consider their response and
the time given to Parliament to scrutinise the bill is a matter
of concern, not least because of suspicions that are naturally
aroused when legislation is fast-tracked.
7. In addition to this procedural point there
are two issues of substance which arise in respect of clauses
1 and 2, which we bring to the attention of the House. The first
is that under clause 1(3) much of the UK law that will be needed
to replace the 2009 Regulations is to be made by secondary legislation.
The bill provides the Secretary of State with a broad power to
make further provision by regulations. The explanatory notes accompanying
the bill state, "this bill does not enhance data retention
a bill along the lines of the Draft Communications Data Bill of
2012 to be enacted, such powers would be enhanced. But the joint
committee which scrutinised that draft bill in 2012 expressed
reservations about it, stating that it paid "insufficient
attention to the duty to respect the right to privacy" and
that it went "much further than it need or should for the
purpose of providing necessary and justifiable access to communications
data". A "provisional
draft" of the regulations which it is intended in the first
instance to make under clause 1(3) has been made available to
Parliament. We welcome this. However, it is not clear to us what
would prevent the Secretary of State using clause 1(3) to enhance
data retention powers. Given that the Government's intention is
that the bill does not enhance data retention powers, the bill
should perhaps expressly so provide.
8. The second matter of substance is that the
CJEU made plain in its judgment of 8 April that EU law requires
powers relating to the retention of communications data to be
proportionate: a disproportionate interference with the right
to privacy, for example, is liable to be ruled unlawful. The CJEU
ruled that legislation on the retention of communications data
"must lay down clear and precise rules governing the scope
and application" of the measures in question, "imposing
minimum safeguards so that the persons whose data have been retained
have sufficient guarantees to effectively protect their personal
data against risk of abuse and against any unlawful access and
use of that data".
9. Clauses 3 to 7 amend certain provisions of
RIPA to put beyond doubt that those provisions have extraterritorial
effect. Clauses 3 to 7 are unconnected to the CJEU's judgment
handed down on 8 April 2014.
10. RIPA allows for law enforcement and security
and intelligence agencies to gain access to the content of communications
made by post or telecommunications. (The retention of communications
data, by contrast, is concerned not with the content of particular
communications, but with the "who, where, when and how"
of communicationswho was communicating with whom, when
and how were they communicating, and where were they when they
were communicating.) In the Government's view, "RIPA has
always had implicit territorial effect"
but some companies based outside the United Kingdom, including
some of the largest communications companies in the world, have
questioned whether the Act applies to them. According to the Government
"when RIPA was drafted it was intended to apply to telecommunications
companies offering services to United Kingdom customers, wherever
those companies were based".
Clauses 3 to 7 put this beyond doubt.
11. It is not clear why these provisions need
to be fast-tracked. The explanatory notes to the bill refer
to "the suggestion from service providers based overseas
that, in the absence of explicit extraterritorial effect, it is
not clear that RIPA applies to them".
There is evidence that the Government have known of the problem
for some time. The Joint Committee on the Draft Communications
Data Bill noted in its report (published in December 2012) that
"many overseas CSPs [communication service providers] refuse
to acknowledge the extraterritorial application of RIPA".
In our 2009 report we recommended that the Government justify
the need to fast-track each element of a bill.
1 Constitution Committee, Fast-track Legislation: Constitutional Implications and Safeguards
(15th Report, Session 2008-09, HL Paper 116). Back
Ibid., paragraph 186. Back
Ibid., paragraph 198. Back
Constitution Committee, Jobseekers (Back to Work Schemes) Bill
(12th Report, Session 2012-13, HL Paper 155), paragraph 15. Back
R (Reilly and Hewstone) v Secretary of State for Work and Pensions
 EWHC 2182 (Admin). Back
SI 2009/859. Back
Joined cases C-293/12 and C-594/12 Digital Rights Ireland and
Paragraph 4. Back
HC Deb, 10 July 2014, col 456. Back
As with clauses 1 and 2 of the bill and as with the Jobseekers
(Back to Work Schemes) Act 2013, this was also the reason offered
in respect of the Police (Detention and Bail) Act 2011, the Terrorist
Asset-freezing (Temporary Provisions) Act 2010 and the Criminal
Evidence (Witness Anonymity) Act 2008. Back
In fact, the Government will have been aware of the vulnerability
of the directive (and therefore of the 2009 Regulations) for two
years, given that they intervened in the Digital Rights Ireland
and Seitlinger cases. Back
Paragraph 32. Back
Joint Committee on the Draft Communications Data Bill, Draft Communications Data Bill
(Session 2012-13, HL Paper 79, HC 479), page 3. Back
Op. cit., paragraph 54. Back
Explanatory notes, paragraph 15. Back
Ibid., paragraph 36. Back
Op. cit., paragraph 33. Back
Op. cit., paragraph 186. Back