Regulation of Investigatory Powers (Communications Data) (Amendment) Order 2015
Baroness Williams of Trafford
That the Grand Committee do consider the Regulation of Investigatory Powers (Communications Data) (Amendment) Order 2015
Relevant document: 17th Report from the Joint Committee on Statutory Instruments
Baroness Williams of Trafford (Con)
My Lords, this order concerns the important government commitment to reduce the number of organisations that can access communications data. Noble Lords will be aware of the significance of this subject and of the provisions on the retention of communications data currently being considered by this House in the Counter-Terrorism and Security Bill.
As noble Lords will know, communications data are the who, where, when and how of a communication but not its content. It is a crucial tool for fighting crime, protecting children and combating terrorism. Access to communications data is governed by the Regulation of Investigatory Powers Act 2000, known as RIPA. RIPA contains robust safeguards, including tests of necessity and proportionality. In July last year, in response to an adverse judgment of the European Court of Justice on the EU data retention directive, Parliament passed the Data Retention and Investigatory Powers Act, or DRIPA. This Act ensured that important capabilities were not undermined, while increasing safeguards.
While that legislation concerned data retention, the Prime Minister also announced a number of safeguards concerning access to communications data. One of those safeguards was a commitment to reduce the number of organisations with access to that data. This order fulfils that important commitment. A further safeguard in the Data Retention and Investigatory Powers Act will ensure that data retained under that Act can be accessed only via RIPA or through a court order or warrant. This order therefore replicates a power to access communications data that already exists in the Financial Services and Markets Act 2000.
I will now turn to the substance of the order. As I have said, it reduces the number of organisations that can access communications data. This is a crucial safeguard. I know that this Committee will agree that only those authorities that can make the strongest possible case should be allowed access. Following a recommendation from the Joint Committee on the draft communications data Bill, the Home Office conducted an exercise to ascertain whether some authorities should lose their powers to access communications data. This order removes powers from the following 13 authorities identified in that exercise: the Charity Commission; the Civil Nuclear Constabulary; the Department of Agriculture and Rural Development, Northern Ireland; the Department for Business, Innovation and Skills; the Department for Environment, Food and Rural Affairs; the Department of the Environment, Northern Ireland; the Environment Agency; the Food Standards Agency; the Pensions Regulator; the Port of Dover Police; the Port of Liverpool Police; the Royal Mail; and the Scottish Environment Protection Agency.
Some noble Lords may consider that we should have gone further and taken away powers from more authorities. The Government considered the business cases for all the authorities with communications data powers. I can assure noble Lords that there are very good reasons why the authorities that have retained their powers have been allowed to do so. When deciding which authorities should retain access, the Government considered a number of issues, including the statutory responsibilities of the authorities with access, the seriousness of the offences they investigate and the number of requests that they made. Although identifying authorities to lose powers was not easy, the authorities identified in this order were not able to demonstrate that their continued access was strictly necessary.
It is worth noting that there is also a substantial amount of transparency on this issue. The most recent report by the Interception of Communications Commissioner listed all the authorities with access to communications data and the purposes for which they can access those data, as well as the number of requests that they made in the calendar year. I hope that the approach the Government have taken and the transparency available will assure noble Lords that the Government are taking the right action concerning which authorities should have investigatory powers. This brings me on to the other provision in this order.
The order also amends the Regulation of Investigatory Powers (Communications Data) Order 2010 to add a new purpose for which communications data may be acquired for the purposes of the Regulation of Investigatory Powers Act. This new purpose is specifically designed to replace powers that are currently available in the Financial Services and Markets Act 2000. The order specifies that only two public authorities will be able to use this purpose to access communications data: the Financial Conduct Authority and the Prudential Regulation Authority. The measure will ensure that all their requests for communications data are subject to the safeguards in RIPA. These two authorities are currently able to access communications data under RIPA for the purpose of the prevention or detection of crime. They are also able to access communications data under the Financial Services and Markets Act when investigating civil abuse of our financial system.
Noble Lords will understand, particularly in the light of experiences over the past few years, how serious and damaging the impact of abuse of our financial system can be. Communications data are capable of showing who contacted who and at what time. This power is fundamental in, for example, proving that insider dealing has taken place. So to be clear: this new purpose replaces powers that have been available in the Financial Services and Markets Act 2000 but ensures that they are subject to the robust safeguards in RIPA.
I know that the Committee will appreciate why we are bringing forward the provisions in this order. Equally, I know that the Committee will want to feel confident that we will keep under review whether the right authorities have the right powers. I can assure the Committee that we will. The Data Retention and Investigatory Powers Act 2014 provided for David Anderson QC, the Independent Reviewer of Terrorism Legislation, to undertake a review of investigatory powers and report by 1 May 2015. DRIPA also contains a sunset clause of December 2016. Therefore, legislation on communications data will be needed in the next Parliament. We look forward to the findings of the review and to using those findings to inform future legislation.
In closing, the order fulfils the important government commitment to reduce the number of organisations with access to communications data. It also ensures that all requests for communications data by the financial regulators are subject to the safeguards in RIPA. I beg to move.
Lord Rosser (Lab)
My Lords, I thank the Minister for explaining the background and purpose of the order which, as she said, removes some public authorities from the list of bodies allowed to access communications data under the Regulation of Investigatory Powers Act 2000, and increases the grounds under that Act on which the Financial Conduct Authority and the Prudential Regulation Authority can access data to include non-criminal enforcement of financial services regulation.
However, why are the Government bringing forward the order now? The Explanatory Memorandum refers to the draft communications data Bill, as did the Minister, and a Joint Committee report published more than two years ago. The Explanatory Memorandum also states that while that Bill was being considered there was substantial consultation with the authorities from which this order removes powers, as well as with the Treasury in relation to the change affecting the Financial Conduct Authority and the Prudential Regulation Authority. All this appears to have been some time ago, and it is only now that the order is being brought forward, yet there have been other developments since the Joint Committee report on the consultations to which I have referred. As the Explanatory Memorandum itself says in paragraph 12—to which the Minister has already made reference—the Data Retention and Investigatory Powers Act of last July,
“requires the Independent Reviewer of Terrorism Legislation to carry out a review of investigatory powers, including communications data”.
That review should be completed by 1 May, in just over three months’ time. In addition, the Intelligence and Security Committee is determining how we can properly balance both security and liberty in online communications.
Why then have the Government decided to bring this already delayed order in now rather than wait for the pending reports and views on issues relating to communications data from the independent reviewer and the ISC? Is bringing this order forward now rather a case of jumping the gun in the light of developments in recent months, bearing in mind that this order appears to have been somewhat delayed? It would be helpful if the Minister could say why the Government deem it appropriate for the 13 organisations listed to lose access to communications data. One of them has undergone a fundamental change in ownership since the Government first started considering this issue. What were the criteria against which the decision that they should lose access to communications data was reached?
On the consultation that took place some time ago, which is referred to in the Explanatory Memorandum, can the Minister confirm what I think she said in her opening comments that all the 13 authorities concerned had agreed to the removal of their powers to access communications data? Will she also say whether the relevant Ministers did likewise in respect of the authorities that came under their departments? Were any authorities originally on the list subsequently taken off the list of 13 we now have? Were any organisations that were not originally on the list subsequently added it?
During a debate in this House in July last year, reference was made to the Food Standards Agency, which is included in the list of 13 organisations and, in particular, to the egg inspectorate of the Food Standards Agency using RIPA. We were told that in the past few years people have gone to prison for multimillion-pound frauds restamping eggs. In that debate, we were told that billions of eggs were being brought in from France unstamped and processed in a factory in the Midlands. The egg inspectorate had to know about this, and there was a tip-off. The point being made in that debate was that any idea of the egg inspectorate not being able to use RIPA would seriously weaken the efforts of those who are there to protect us from the kind of activity I have just described. Will the Minister comment on that in the light of the fact that the Food Standards Agency is listed as one of the organisations losing access to communications data under RIPA?
We are not opposing the order, but I should be grateful if the Government respond in some detail—if not today, then subsequently—to the questions I have asked and the points that I have made.
Baroness Williams of Trafford
My Lords, I thank the noble Lord, Lord Rosser, for the questions he has raised. I am very grateful that he will allow me to write to him in due course, given that I have not had a Box behind me for most of the debate.
On why the order is required now and why we cannot do everything together, DRIPA has a sunset clause and everything will have to be reviewed in the next Parliament. In addition, the independent reviewer David Anderson QC will report his findings on 1 May 2015. There is no doubt about it: the Government and subsequent Governments will need to review the whole thing in the round anyway, and the sunset clause in 2016 will underline that need to review the whole issue.
The noble Lord also asked why we specifically chose the 13 organisations to lose power and whether they were satisfied with that loss. I understand that some concern was expressed by the Royal Mail. I do not know of any concern expressed by any other organisation. The primary reason they were chosen was they had made little if any use of the powers, and therefore were taken off the list. It is also important to note that the Joint Committee found it difficult to say which organisation should lose its powers.
Lord Rosser
As I understand it, the Joint Committee basically said that organisations should be looked at. That has been done and the 13 have emerged. It would certainly be helpful to know the criteria that we use to decide which ones should be on the list.
Baroness Williams of Trafford
I hope that I have explained that. It was the case that either little use or no use had been made of the powers. I assume that, as time goes on, organisations may be added to the list or be taken off it, depending on events. The noble Lord asked a specific question about the egg inspectorate. As I understand it, the inspectorate does not have powers to access communications data. I hope that that helps.
Lord Rosser
Is the Minister saying that it does not have powers at present—not that it will not have them but that it does not have them at present?
Baroness Williams of Trafford
It has never had them, I understand. I will have to write to the noble Lord because I know that I have not answered all his questions, but I hope that he will be satisfied with that.