Data Retention and Investigatory Powers Bill - Constitution Committee Contents


Data Retention and Investigatory Powers Bill


1.  The Data Retention and Investigatory Powers Bill was introduced to the House of Commons on 14 July 2014. It was taken through all its Commons stages on 15 July and is scheduled to be fast-tracked also through the House of Lords: second reading is scheduled for 16 July and its remaining stages are scheduled for 17 July. The bill was announced and published in draft on 10 July.

2.  The Constitution Committee published in 2009 a report on fast-track legislation in which we recommended, among other matters, that a government introducing fast-track legislation into Parliament should comply with certain requirements.[1] In particular, we recommended that the Government should fully explain and justify why, in their opinion, it is necessary for legislation to be fast-tracked.[2] The then Government accepted our recommendations. In all subsequent cases of fast-track legislation the explanatory notes accompanying the bill have included information as to why the Government consider that fast-tracking is necessary; the explanatory notes on the Data Retention and Investigatory Powers Bill include that information. We welcome this. We also welcome the fact that the bill was published last week in draft, which allowed us three more days than would otherwise have been available to scrutinise it (albeit over a weekend). In our 2009 report we recommended that there should be a presumption that fast-track bills contain a sunset provision.[3] We therefore welcome clause 6(3) of this bill, which provides that the substantive provisions of the bill are repealed on 31 December 2016. We also welcome the amendments made in the House of Commons in clauses 6 and 7, that there will be regular reports on and a review of the operation and regulation of investigatory powers.

3.  Experience continues to bear out, however, the risks associated with fast-track legislation. The last bill to be fast-tracked through Parliament was the Jobseekers (Back to Work Schemes) Act 2013. We reported that bill to the House, noting concerns about whether the measure was "constitutionally appropriate in terms of the rule of law".[4] In a judgment handed down on 4 July 2014 the Administrative Court declared the Act to be incompatible with the Convention right to a fair trial.[5] This episode underscores the constitutional undesirability of fast-track legislation.

4.  The bill contains provisions on two matters: retention of communications data and investigatory powers under the Regulation of Investigatory Powers Act 2000 ("RIPA").

Retention of communications data

5.  Government requirements for retention of communications data are currently provided for by the Data Retention (EC Directive) Regulations 2009[6] ("the 2009 Regulations"). The 2009 Regulations implemented in the United Kingdom the Data Retention Directive (2006/24/EC). In a judgment handed down on 8 April 2014 the Court of Justice of the European Union ("CJEU") declared that directive invalid on the ground that it was a disproportionate interference with certain rights under the EU Charter of Fundamental Rights.[7] This ruling affects the lawfulness of the 2009 Regulations. Clauses 1 and 2 of the bill confer on the Secretary of State the powers currently in the 2009 Regulations to require service providers to retain communications data. In the words of the explanatory notes "mandatory data retention is necessary because without it data protection law requires service providers to delete data that they no longer need for business purposes". Mandated data retention is "crucial for law enforcement to investigate, detect and prevent crimes".[8] In a statement to the House of Commons the Home Secretary said that it has been "used as evidence in 95% of all serious organised crime cases handled by the Crown Prosecution Service".[9] We recognise that, given the CJEU's judgment, the 2009 Regulations lack legal authority and that fresh legislation is urgently required to replace them.

6.  When legislation is fast-tracked through Parliament, the fact that the Government need to respond to a court decision is frequently offered as the reason.[10] In this instance, we note that the CJEU's decision was handed down in early April 2014. Thus the Government have had more than three months to consider their response, yet they propose that Parliament be given less than one week (in fact three sitting days) to legislate.[11] Moreover, so far as we are aware, between April and 10 July 2014 the Government did not indicate that fast-track legislation may be necessary to address the court judgment. The contrast between the time taken by the Government to consider their response and the time given to Parliament to scrutinise the bill is a matter of concern, not least because of suspicions that are naturally aroused when legislation is fast-tracked.

7.  In addition to this procedural point there are two issues of substance which arise in respect of clauses 1 and 2, which we bring to the attention of the House. The first is that under clause 1(3) much of the UK law that will be needed to replace the 2009 Regulations is to be made by secondary legislation. The bill provides the Secretary of State with a broad power to make further provision by regulations. The explanatory notes accompanying the bill state, "this bill does not enhance data retention powers".[12] Were a bill along the lines of the Draft Communications Data Bill of 2012 to be enacted, such powers would be enhanced. But the joint committee which scrutinised that draft bill in 2012 expressed reservations about it, stating that it paid "insufficient attention to the duty to respect the right to privacy" and that it went "much further than it need or should for the purpose of providing necessary and justifiable access to communications data".[13] A "provisional draft" of the regulations which it is intended in the first instance to make under clause 1(3) has been made available to Parliament. We welcome this. However, it is not clear to us what would prevent the Secretary of State using clause 1(3) to enhance data retention powers. Given that the Government's intention is that the bill does not enhance data retention powers, the bill should perhaps expressly so provide.

8.  The second matter of substance is that the CJEU made plain in its judgment of 8 April that EU law requires powers relating to the retention of communications data to be proportionate: a disproportionate interference with the right to privacy, for example, is liable to be ruled unlawful. The CJEU ruled that legislation on the retention of communications data "must lay down clear and precise rules governing the scope and application" of the measures in question, "imposing minimum safeguards so that the persons whose data have been retained have sufficient guarantees to effectively protect their personal data against risk of abuse and against any unlawful access and use of that data".[14]

Investigatory powers

9.  Clauses 3 to 7 amend certain provisions of RIPA to put beyond doubt that those provisions have extraterritorial effect. Clauses 3 to 7 are unconnected to the CJEU's judgment handed down on 8 April 2014.

10.  RIPA allows for law enforcement and security and intelligence agencies to gain access to the content of communications made by post or telecommunications. (The retention of communications data, by contrast, is concerned not with the content of particular communications, but with the "who, where, when and how" of communications—who was communicating with whom, when and how were they communicating, and where were they when they were communicating.) In the Government's view, "RIPA has always had implicit territorial effect"[15] but some companies based outside the United Kingdom, including some of the largest communications companies in the world, have questioned whether the Act applies to them. According to the Government "when RIPA was drafted it was intended to apply to telecommunications companies offering services to United Kingdom customers, wherever those companies were based".[16] Clauses 3 to 7 put this beyond doubt.

11.  It is not clear why these provisions need to be fast-tracked. The explanatory notes to the bill refer to "the suggestion from service providers based overseas that, in the absence of explicit extraterritorial effect, it is not clear that RIPA applies to them".[17] There is evidence that the Government have known of the problem for some time. The Joint Committee on the Draft Communications Data Bill noted in its report (published in December 2012) that "many overseas CSPs [communication service providers] refuse to acknowledge the extraterritorial application of RIPA".[18] In our 2009 report we recommended that the Government justify the need to fast-track each element of a bill.[19]


1   Constitution Committee, Fast-track Legislation: Constitutional Implications and Safeguards (15th Report, Session 2008-09, HL Paper 116). Back

2   Ibid., paragraph 186. Back

3   Ibid., paragraph 198. Back

4   Constitution Committee, Jobseekers (Back to Work Schemes) Bill (12th Report, Session 2012-13, HL Paper 155), paragraph 15. Back

5   R (Reilly and Hewstone) v Secretary of State for Work and Pensions [2014] EWHC 2182 (Admin). Back

6   SI 2009/859. Back

7   Joined cases C-293/12 and C-594/12 Digital Rights Ireland and SeitlingerBack

8   Paragraph 4. Back

9   HC Deb, 10 July 2014, col 456. Back

10   As with clauses 1 and 2 of the bill and as with the Jobseekers (Back to Work Schemes) Act 2013, this was also the reason offered in respect of the Police (Detention and Bail) Act 2011, the Terrorist Asset-freezing (Temporary Provisions) Act 2010 and the Criminal Evidence (Witness Anonymity) Act 2008. Back

11   In fact, the Government will have been aware of the vulnerability of the directive (and therefore of the 2009 Regulations) for two years, given that they intervened in the Digital Rights Ireland and Seitlinger cases. Back

12   Paragraph 32. Back

13   Joint Committee on the Draft Communications Data Bill, Draft Communications Data Bill (Session 2012-13, HL Paper 79, HC 479), page 3. Back

14   Op. cit., paragraph 54. Back

15   Explanatory notes, paragraph 15. Back

16   Ibid. Back

17   Ibid., paragraph 36. Back

18   Op. cit., paragraph 33. Back

19   Op. cit., paragraph 186. Back


 
previous page contents


© Parliamentary copyright 2014