Third Report Contents

Appendix 1: Agreement Between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime (CP 178)

Additional information from the Home Office

Q1: Para 11 says that a serious crime is defined as one with a maximum term of at least 3 years—how contiguous are the UK and US penalties?

A1: The definitions of serious crimes are broadly similar, but the reality is that they will not be contiguous. This risk has been offset by our assessment of the United States as a country governed by a strong rule of law, with a strict codified constitution including respect for fundamental human rights. As a consequence, the individual lists may differ, but the overall effect is unlikely to be that different.

Part of the reason that this will differ is that certain activity may be criminalised in different ways in different countries. Consequently, you will have different offences that hit the threshold in each country, as well as the same offences that attract slightly different sentences. We expect the differences that do exist to be limited in nature. This of course cuts both ways: we know for example that some UK offences, particularly those in relation to hate speech and on-line support for proscribed organisations are offences in the UK, but not in the United States.

Q2: Para 14—who can you obtain data on? It would be useful if you could clarify with a few illustrative examples of how each of the parties could use these provisions

A2: If a UK or US authority wishes to request Agreement data from a communications service provider (CSP) located in the other party’s jurisdiction, it may only do so if they have an approved domestic authorisation for the data. For the UK this means an interception warrant or communications data authorisation pursuant to the Investigatory Powers Act (IPA) 2016, or an overseas production order pursuant to the Crime (Overseas Production Orders) Act 2019, and the request is compliant with the terms of the Agreement.

The UK cannot use the Agreement to request data on a US person (person (regardless of their geographical location), and neither can it request data on a non-US person who is geographically located in the US when the CSP is giving effect to the request. In other words, the UK can only use the Agreement to request data on non-US persons who are geographically outside of the US when the CSP is giving effect to the request.

The US cannot use the Agreement to request data on a person of any nationality if they are geographically located in the UK when the UK CSP is giving effect to the request. In other words, the US can target any person of any nationality who are geographically outside the UK when the CSP is giving effect to the request.

The following scenarios illustrate these restrictions. All examples assume a domestic authorisation has been obtained and that the data sought is held by a CSP in the other party’s jurisdiction.

Example UK requesting scenarios that would be permitted under the Agreement

Example US requesting scenarios that would be permitted under the Agreement

Example UK requesting scenarios that would not be permitted under the Agreement

Example US requesting scenarios that would not be permitted under the Agreement

Q3: Could the US ask the UK for information on a UK citizen who was being held in the US in connection with a crime that might result in either:

(a)The death penalty?

(b)That person being removed to the Guantanamo Bay detention facility (GTMO)?

A3: The manner in which the Agreement works is that the US and UK directly request data from telecommunications operators (TO) and communications service providers (CSP) respectively in the other country. The US could therefore request data relating to a UK citizen from a UK TO—if that UK citizen was not in the UK. The US cannot use the Agreement to target data related to an individual located in the UK but can target data relating to UK citizens not located in the UK.

In relation to a UK citizen’s data being sought in relation to the death penalty, the Agreement and relevant side note covers data which the US designated authority has received from a UK TO. Before a US prosecutor could seek to use that data as evidence in a case for an offence where the death penalty is sought, permission has to be granted by the UK’s designated authority. The decision to grant such permission is a decision for the relevant Minister, equivalent to the current arrangements for obtaining data under the Mutual Legal Assistance Treaty process. If permission is not granted, the Agreement states that the US prosecutor shall not use the data. It is the UK’s long-standing position that we oppose the use of the death penalty in all circumstances.

In relation to a UK citizen’s data being sought in relation to transfer to GTMO, the relevant side note covers data which the US intends to request from a UK TO under the Agreement and data which it has already obtained from a UK TO under the Agreement. The US has committed to inform the UK if it intends to use the Agreement to target data for the purpose of obtaining evidence or information to support or justify the detention of a current or future detainee at GTMO. The US has also committed to inform the UK if it intends to use data known to have been previously obtained under the Agreement:

(i)as evidence in the prosecution’s case at GTMO;

(ii)as information to be used against a detainee in reviews of such detention;

(iii)as evidence to support the US’s case in legal proceedings challenging the Department of Defence’s authority to detain a current or future GTMO detainee;

(iv)as intelligence in support of military detention operations where the target has been nominated or designated for detention at GTMO.

If the US informed the UK that it intended to use the Agreement to target data in relation GTMO or use data known to have been obtained under the Agreement in relation to GTMO in the circumstances set out above, the UK would have the ability to make appropriate diplomatic representations to challenge any such use in line with the UK Government’s long-standing position is that the detention facility at Guantanamo Bay should close. In extremis, both the UK and the US also have the power to terminate the Agreement through written notification.

HMG judge the risk of data being obtained under the Agreement being used in this way as very limited. Whilst it is theoretically possible, it is extremely unlikely that data obtained from a UK company under the Agreement would ever be used in this way. This is due to:

(i)The limited US use of GTMO (there have been no new transfers to the facility since 2007, and despite President Trump’s Executive Order reversing his predecessor’s decision to close it, no-one has been transferred there during his term); the criteria for transferring detainees to GTMO, and the status of those already there.

(ii)The likely limited US use of the Agreement overall; and

(iii)The fact that those vulnerable to being transferred are unlikely to be using the services of UK TOs.

Q4: Could the information provided under this Treaty be used to extradite someone to the USA for prosecution there?

A4: There are no restrictions on the use of the UK US Data Access Agreement (the “Agreement”) in relation to extradition. Extradition between the US and the UK takes place within a separate legal framework. It is governed by the UK/US Extradition Treaty which in turn is implemented by Part 2 of the Extradition Act 2003.

As with evidence exchanged currently under the framework of Mutual Legal Assistance, evidence shared with the US under the Agreement could ultimately form part of the content of an extradition request. Such extradition requests would be considered by the UK’s courts and the Secretary of State in the normal way.

Extradition from the UK is barred where it is incompatible with a person’s human rights or where the person concerned could be, has been, or will be sentenced to death, unless the Secretary of State receives credible assurances that the death penalty will not be imposed or, if imposed, will not be carried out. Article 8 (4) of the Agreement requires that the US obtain permission to use any evidence obtained as part of the prosecution’s case if the evidence relates to an offence for which the death penalty is sought, and the UK has declared that its essential interests may thereby be implicated. If the UK declares that its essential interests would be implicated prior to an extradition request being made, it could then decline to give permission for the evidence to be used.

It is worth reiterating that the Agreement prevents the US from targeting individuals located in the UK. For an individual to be extradited from the UK to the US using data obtained under the Agreement, they would need to have been outside the UK when the data was obtained, and subsequently entered the UK in order to be extradited. We assess the likelihood of such a scenario to be extremely low.

Information received 15–29 October

16 An EU person is used simply illustratively here, information can be sought on any third party national.

© Parliamentary copyright 2019