Crime (Overseas Production Orders) Bill [HL]
Monday 10th September 2018
(6 years, 1 month ago)
Grand CommitteeCrime (Overseas Production Orders) Act 2019 View all Crime (Overseas Production Orders) Act 2019 Debates Read Hansard Text Read Debate Ministerial Extracts Amendment Paper: HL Bill 113-II Second marshalled list for Grand Committee (PDF) - (6 Sep 2018)
The Deputy Chairman of Committees (Lord Lexden) (Con)
My Lords, if there is a Division in the Chamber while we are sitting, the Committee will adjourn as soon as the Division Bells are rung and will resume again after 10 minutes.
The Minister of State, Home Office (Baroness Williams of Trafford) (Con)
My Lords, before we start today’s proceedings I will take the opportunity to correct something that I said last Wednesday in response to Amendment 16. I said that Section 8 of the Police and Criminal Evidence Act 1984 requires a justice of the peace to be satisfied that material on the premises is likely to be of substantial value before authorising a production order. In fact, Section 8 concerns the authorisation of a search warrant, not a production order. A production order is made under Schedule 1 to the Act. None the less, there is still reference to a judge needing to be satisfied that the material is likely to be of substantial value to the investigation, whether by itself or with other material, before issuing a production order. I apologise for that.
Clause 5: Contents of order
Baroness Hamwee
“( ) the mechanism for enforcement.”
Baroness Hamwee (LD)
My Lords, this amendment is grouped with Amendment 22 in the name of the noble Lord, Lord Rosser. We are both interested in how orders are to be enforced. I have to say that I think both amendments are slightly circular. That might mean that they are elliptical—I am not sure. However, we are probing at this stage; I hope that the Minister will take that point.
There are obvious difficulties with enforcement in respect of data held by an entity that is not in the UK and which does not have a base or assets in the UK. We are told in Clause 6(4)(a) that the provisions apply regardless of where the data is stored. I do not know whether “extraterritorially” in the sense of outside the earth, as distinct from in another country, applies here. I simply do not understand how the technology works.
It seems to me that the enforcement will have two aspects: a sanction for non-compliance and ensuring the actual production of the data. So my first question is: will the mechanism for enforcement be in the co-operation arrangement and, generally, how are we to expect the issues that I have raised to be dealt with? I beg to move.
Lord Rosser (Lab)
I shall speak to the amendment in my name, which, as the noble Baroness, Lady Hamwee, said, has in effect the same objective as the amendment which she has just spoken to and moved. The purpose of our amendment is likewise to find out to what extent and by what means overseas production orders can and will be enforced where there is a bilateral or wider international agreement for an overseas production order made by a court in this country and one made in another country and served on a provider in the UK.
In Committee last Wednesday the Government stated that the reference at Second Reading that,
“UK-based providers will not be compelled to comply with overseas orders”,—[Official Report, 11/7/18; col. 929.]
meant that while,
“UK companies are not compelled by UK law”,
to comply with a production order,
“they may be compelled by the other jurisdiction … depending on the country in question”.—[Official Report, 5/9/18; col. GC 143.]
Bearing in mind that considerable progress appears to have already been made towards concluding a bilateral agreement on overseas production orders with the United States in line with the Bill, will an overseas production order made by our courts in respect of an American-based service provider be enforceable—and, if so, how, by whom and with what sanctions available if there is non-compliance?
Likewise, in the light of the Minister’s comment last Wednesday that UK companies might be compelled by the other jurisdiction to comply with their production order, how will such an order made by an American court in respect of a British-based service provider be enforceable, by whom and with what sanctions available if there is non-compliance? In addition, what do the Government consider would be the basis of appropriate and acceptable enforcement arrangements in both directions for any other countries with whom we might conclude bilateral arrangements in respect of production orders under the Bill?
Last Wednesday in Committee, the Government said that,
“it is reasonable to expect that some form of dispute resolution mechanism would be in place to help determine any differences in the event that there is a dispute over compliance with an order”.—[Official Report, 5/9/18; col. GC 141.]
That statement was, of course, in line with what the Government had said in the Minister’s letter of 20 July following Second Reading. That letter referred to the Government expecting any bilateral agreement to include a mechanism for escalating any dispute over compliance.
But should the letter not have said that the Government “will” require a bilateral agreement to include such processes and procedures, rather than just that they expect that it will? Would the decision of such a dispute resolution mechanism be legally binding? If so, on whom? If not, what would happen if the dispute resolution mechanism failed to resolve the dispute? As I understand it, some service providers have welcomed the Bill because it will provide them with cover when making available electronic data, if done under the Bill’s provisions, from other potential legal proceedings. If that is the case, would that legal protection be provided by the Bill if it was not capable of being legally enforced in one or both directions?
What kind of issues in dispute could be addressed through the suggested dispute resolution procedure mechanism? Who would mediate or arbitrate if such a mechanism was in place? Would there be legal representation? How would the mechanism be activated and by whom? Who would pay the costs? Would the dispute procedure have to reach a conclusion or decision within a fixed maximum timescale? Would the dispute resolution mechanism for any bilateral agreement on production orders with the United States be the same in the United States and the UK, working to the same standard and principles and applying or not applying the same sanctions? If there is to be any enforcement by the courts, through which court would an overseas production order made in this country be enforceable, and through which court would an overseas production order made in the US or another country in respect of a British service provider be enforceable? After at least two years of discussion with the United States on the proposed agreement, the Government must have some specific answers to these questions.
Baroness Williams of Trafford
I thank both noble Lords for their points. As they said, overseas production orders will be used where an international co-operation arrangement exists and, as such, orders will be used in an environment where they are readily complied with or where there is confidence that such orders will be complied with.
As I explained when the Bill was read for a second time, the Bill provides an alternative route to accessing evidence to the existing mutual legal assistance channels. However, those channels will still be available. As such, if there is any doubt about compliance, appropriate officers may well opt to seek the evidence required via that existing route to ensure that compliance can be effected through another country’s own domestic sanctions.
Amending this provision to include the means by which an order could be enforced would be a departure from legislation in relation to existing production orders. It goes without saying that non-compliance of an order is a breach of such an order. To answer one of the noble Lord’s questions, the very nature of this being a Crown Court order is that it attracts contempt of court proceedings if there is non-compliance—which will be dealt with by way of court rules.
Failure to comply with an overseas production order made by an English judge will carry the same consequences as failure to comply with a domestic production order—namely, the person will become liable to punishment for contempt of court in the same way as if an order of the Crown Court had been breached. Specifying on the face of the order the means by which contempt proceedings will be brought will not change the legal position.
On the point made by noble Lords about enforcement. I accept that the Bill does not provide an enforcement mechanism in respect of Clause 13(1), which prohibits a person from concealing, destroying, altering or disposing of the data, or disclosing the application to anyone else once they are given notice of the application. This is currently the case with domestic orders made under Schedule 1 to PACE. As I mentioned, these orders can be made only where the relevant international arrangement exists. Orders will be applied for and used in an environment where they are readily complied with and where there is confidence that such orders will be complied with.
In reality, enforcement mechanisms for such requirements are unlikely to be needed—again, this reflects the domestic position. I say this because, where there is a risk that a person on whom an order is served might tip off a subject of interest or destroy evidence, a search warrant is likely to be used or the evidence would not be sought at all. Therefore, where there is a risk of concealing, destroying, disposing of or altering the data, an overseas production order will not be an appropriate method of obtaining that information. As I said, MLA will still be available and, where there is doubt about compliance with an overseas production order, appropriate officers may well opt to seek the evidence required via the MLA route to ensure that the information can be obtained by other means.
The noble Lord, Lord Rosser, asked whether the enforcement mechanism would be in the co-operation agreement. We envisage that the co-operation arrangements will require obstacles to compliance to be removed, but the requirement to comply with an order will be a matter for the law of the jurisdiction in which it is made. We have provided for enforcement orders in the Bill via the contempt of court mechanism.
The noble Lord also asked about dispute resolution. Any mechanism for dispute resolution will be subject to negotiation with any country with which we wish to enter into an agreement. Therefore, it would not be appropriate to speculate on the terms of such dispute resolution mechanisms—although I can of course discuss this further with noble Lords ahead of Report. With those explanations, I hope that the noble Baroness will feel able to withdraw her amendment.
Lord Rosser
Perhaps I may ask for clarification. As I understand from what the noble Baroness said— I may well have misunderstood it—if an overseas production order made in this country had to be enforced, it would be on the basis of contempt of court. That would be enforced against a provider in America if we were talking about the agreement with the States. How would contempt of court proceedings against a court decision in this country work in practice in relation to a provider in the United States who did not comply?
Baroness Williams of Trafford
I think it would be made under Schedule 1 of PACE—no, I am wrong. The answer is winging its way to me. While I am waiting, clearly if there was any doubt about that—
Lord Rosser
In the other direction, would an order made in an American court against a British provider that is not complied with lead to contempt proceedings in a United States court, and how would that court enforce it against a British provider?
Lord Paddick (LD)
While we are waiting, am I right in thinking that in the recent Facebook case it was not that the service provider did not want to provide the information that would be of use to UK law enforcement but that domestic law in America did not allow it to provide that information, and that in the overwhelming majority of cases to which this legislation would apply we anticipate that the service provider would be more than keen to provide the data, provided it can be done lawfully, and that this mechanism provides the lawful means of doing that?
Baroness Williams of Trafford
I think the noble Lord is probably quite right. It goes back to what I was saying at the beginning of my response. If there were doubts about compliance, or that began to become apparent, MLA would be the process that we would revert to if this was not forthcoming. Ditto, the American side would probably institute the MLA process to ensure compliance.
Lord Rosser
On the point the noble Lord, Lord Paddick, made, does it stand up that the service provider—he spoke about the situation in America, I think—would be protected from any other legal action if it provided the data under a law that it did not have to comply with?
Baroness Williams of Trafford
The current Facebook case is a good case in point. There is no requirement for it to provide the information because of its terms, conditions and processes. I am sure that this would ensure that it had to comply with the process, because we are introducing this agreement with the US which places an obligation on CSPs to comply—whereas at this point in time they do not have to.
Baroness Hamwee
My Lords, perhaps when I read all this I will understand it a little better than I have while listening to it. It is not how I had approached the Bill. As it has been described, there is an element of optionality which I had not expected.
We will want to ask our colleagues who practise in this area to comment on how contempt of court is dealt with. I have just turned up the notes made by my noble friend Lord Thomas of Gresford, who had a look at the Bill before Second Reading. He wrote—I assume this is rhetorical—“Is contempt of court a realistic and effective sanction in respect of international bodies?” Of course we will discuss this, as the Minister said, before Report. This is certainly going to be a matter on which we will want to put down another amendment for Report in order to tidy up, as far as we can, in the Bill, or to get on the record in Hansard, the quite unusual situation which we are discussing.
Baroness Williams of Trafford
I do not usually intervene on noble Lords but, if I may, the noble Baroness is absolutely correct when she talks about optionality. There is now optionality. There is MLA, which by its very nature is a longer process—and this is the option for a much speedier access to data requirement.
Baroness Hamwee
Indeed it is optional, but one expects there to be an effective sanction. In this context, contempt of court really amounts to little more than a slap on the wrist, with probably nothing much to follow.
Baroness Williams of Trafford
But of course—I am sorry to interrupt the noble Baroness again—there is also reputational damage, as for example with Facebook.
Baroness Hamwee
Yes, I take that point. I had wondered whether I should have apologised at the beginning of this debate that I had so little to say, in comparison with the stacks of paper which officials behind the Minister have in front of them. However, perhaps we have given this more of an airing than I expected. I look forward to discussing it further and beg leave to withdraw the amendment.
Baroness Hamwee
Baroness Hamwee
My Lords, Clause 6(4)(c) provides that the requirements in the Bill have effect,
“in spite of any restriction on the disclosure of information (however imposed)”.
This amendment seeks to understand what the impact is of that. I am not of course impugning what the Minister said about compliance with human rights and so on, but can we be sure, given that exception, about how that will fit in with legal and human rights protections? What if there is a clash with the local laws or the terms of the co-operation agreement? Given our previous discussion, I wonder whether, if there were to be such a restriction, this route would be not taken at all. Specifically, does this subsection allow for Clause 3, which is about excepted data, to be overridden? That would be concerning. I beg to move.
Baroness Williams of Trafford
I thank the noble Baroness for her amendment, which gives me the opportunity to set out to the Committee the intention of Clause 6(4)(c). First, let me stress that the aim of an overseas production order is to provide law enforcement officers and prosecutors with the ability to apply to the court to acquire electronic data that can be used in proceedings or an investigation into serious crime. The effects of such an order are outlined in Clause 6.
The Government accept that a company may have obligations to the customers who use its services. The effect of subsection (4)(c) is to make it clear that, in spite of those obligations or any that a company may owe to its shareholders, for example, it is obliged to comply with the requirement to give effect to an overseas production order. Of course, there will be duties on those who are served an order to adhere to data protection obligations, but the Government are satisfied that the rights and duties that would be imposed by the provisions of the Bill are compliant with data protection legislation. On receipt of any evidence, for example, the appropriate officer would be required to handle such data in accordance with the Data Protection Act 2018—as they would any other data, including that sought under an existing production order issued under PACE for data held in the UK for the purpose of investigating or prosecuting serious crime.
Any international arrangement that is concluded will be premised on a requirement that the two contracting countries will make compliance possible. The purpose of this clause is therefore to ensure that the recipients of a disclosure can comply with it even where there is conflict in the law of the UK. For example, where the recipient owes a duty of confidence in respect of a third party, Clause 6(4)(c) will allow the recipient to produce the data without breeching that duty. This approach reflects the domestic framework used for making and granting production orders under Schedule 5 to the Terrorism Act 2000 and Section 348(4) of the Proceeds of Crime Act. A judge cannot issue an overseas production order unless it meets the criteria set out in the Bill. The provision in Clause 6(4) of the Bill is only about ensuring that a lawful order has absolute effect. It does not provide that the courts can sidestep other statutory provisions such as the Data Protection Act 2018 when making an overseas production order.
The noble Baroness asked about safeguards. The Bill contains robust safeguards governing the application and issuing of an overseas production order. The judge must be satisfied that there are reasonable grounds for believing that the data sought is likely to be of substantial value to the investigation, and that it would be in the public interest for this data to be produced before an order is granted. The judge is also required to exercise the power to consider and grant orders compatible with human rights obligations, including privacy.
These orders are intended to be used where law enforcement officers and prosecutors are investigating terrorism or have reasonable grounds to believe that an indictable offence has been committed, or proceedings in respect of an offence have been instituted. The Bill does not provide access to any data that is not already available through mutual legal assistance. It simply ensures that the data can be obtained more quickly.
The noble Baroness, Lady Hamwee, talked about clashes with local laws. The point of an agreement is that an international arrangement removes those barriers to compliance, as I have already said, so it will be a prerequisite for a country to ensure that compliance is possible. The noble Baroness also asked whether this paragraph allows for Clause 3 on “excepted data” to be set aside. Clause 6(4)(c) does provide that an overseas production order made by the court has effect in spite of any restrictions. A court will not make an order in respect of excepted data as the Bill provides that it cannot—so Clause 6(4)(c) does not allow for orders to be made in respect of excepted data.
The noble Baroness looks quite confused, but I hope that I have satisfied her and persuaded her that her amendment can be withdrawn.
Baroness Hamwee
My Lords, this is another occasion when I shall have to read the reply carefully. But, with regard to the relationship between Clause 6(4)(c) and Clause 3, can I be clear that the Minister said that it does not allow for Clause 3 provisions to be set aside? I see the Minister is nodding. I thank her for that and, as I said, I will read the response. I beg leave, for the moment, to withdraw the amendment.
Baroness Hamwee
Baroness Hamwee
My Lords, my Amendments 25, 26, 28 and 35 are also in this group. The noble Lord, Lord Rosser, has given notice that he intends to oppose Clause 7 standing part of the Bill. I assume that that is to probe the operation of the clause. I am sure he takes the view that I do—that one would not want to accept that these orders can be made without the possibility of variation, revocation or, in the most general sense, appeal.
On Amendment 24, I am ready to be told that it is not necessary to spell out that revocation or variation can be,
“in whole or in part”.
I realise that a part-revocation is probably a variation. We also find the non-disclosure requirements rather troublesome. Amendment 25 seeks to probe the procedure for opposing the non-disclosure requirements. Amendment 26 is part of the same question about how you appeal against them.
Clause 8 provides for non-disclosure of the existence of an order, as distinct from non-disclosure of its contents. There is something rather concerning about not being able to say that an order is in existence. If a data subject asks the internet service provider, it cannot even say, “We will have to refer to the judge”—or can it? I am not sure. The sanction here, presumably, would be contempt of court. I have already referred to whether that is an effective sanction in the case of an overseas or international body. I was reminded of super-injunctions when I read this. They do not have the greatest reputation. Presumably the Minister will remind us that disclosing the existence of an order to a subject could hamper the work of law enforcement or security. All my instincts are that somebody who is affected by an order should know about it. Perhaps the Minister could take this opportunity to explain the operation of it.
Amendment 35 is another probing amendment, about how one appeals, in this case against Clause 13. But my major concerns are around Clause 8. I beg to move.
Lord Rosser
As the noble Baroness, Lady Hamwee, said, I have tabled a Clause 7 stand part debate, which is intended to provide an opportunity for the Government to explain in a bit more detail why this clause is deemed necessary and how and in what circumstances it is intended to operate. In what kinds of circumstances do the Government envisage it being necessary to vary or revoke an overseas production order, and how many times has that happened in respect of domestic production orders, compared to the number of such domestic orders issued? Does the varying or revoking referred to in Clause 7 apply to overseas production orders made in this country or to such orders made in the country with which we have a bilateral agreement and applying to British service providers—or, indeed, does it apply to both? In what circumstances would the Secretary of State, rather than the appropriate officer who applied for the order or any person affected by the order, be likely to seek to vary or revoke an overseas production order?
Will the application to vary or revoke be heard by the judge who made the original order, and what information, or indeed anything else, will be required from an applicant seeking to vary or revoke an overseas production order before court time is granted to hear their application? What will be the test, if any, in terms of the extent or otherwise of a proposed variation being sought before it can be considered or granted? Does the reference in Clause 7 to the requirements in Section 4(2) to (6) continuing to be fulfilled, or being fulfilled, apply to the variation that is being sought or to the original overseas production order as altered by the variation?
Once an overseas production order has been served, the recipient has, I believe, as a standard, seven days to act on it. Presumably that means that an application to vary or revoke by the recipient as a person affected by the order has to be made within those seven days. Is that in fact the case? If it is, is it not a very short period of time, particularly if it is also envisaged that a judge will have to deal with any application to vary or revoke within that seven-day period, or will a judge be able to extend the period already laid down for the electronic data specified in an overseas production order to be produced if an application to vary or revoke has been made?
Finally, what will be the maximum period of time within which applications to vary or revoke must be determined by a judge, and who will be given notice of an application to vary or revoke an overseas production order, and in what circumstances, and thus have the opportunity to support or contest the application?
Baroness Williams of Trafford
I thank the noble Baroness and the noble Lord for their points. I will give them a very long answer because a full explanation is being sought. I shall speak first to Clause 7 standing part of the Bill and then cover the individual amendments.
The purpose of Clause 7 is to allow an appropriate officer who applied for the order, or an equivalent officer, any person affected by the order, the Secretary of State or the Lord Advocate the ability to apply to a judge to vary or revoke an overseas production order. The clause broadly reflects the existing domestic framework; for example, a production order made under the PACE Act 1984 does not contain provision about applications that can be made to vary or revoke a production order. However, court rules allow for the respondent of an order, or any person affected by it, to apply for the order to be varied or discharged. In addition, a judge’s decision to make a domestic production order may be challenged by way of judicial review.
Inclusion of this clause is an important safeguard to ensure that anyone affected by an order has an opportunity to challenge it and its contents, especially because appeal rights as such do not exist in respect of production orders. The intention behind Clause 7 was to make clear the existence of the power to vary or revoke an overseas production order and the circumstances under which that power might be used, and to set out the categories of persons who might apply for such variations or revocations. These persons include the person subject to the order, who is therefore required to produce the data sought, the person who applied for the order and anybody else who might be affected by it; for example, the person to whom any personal data sought relates. For example, where notice is given, an innocent third party who was communicating with the suspect over email may not want certain data to be disclosed or may challenge the existence of the order to protect information of a private nature disclosed to the suspect. Ultimately, a judge, when considering whether such an order should be varied, will need to be satisfied that the requirements in Clause 4 continue to be fulfilled.
Clause 7 also recognises that in some cases an appropriate officer may wish to apply to vary or revoke an order; for example, the electronic data sought may not be valuable to the investigation any more or the data may have been sourced elsewhere. In addition, the power to apply to vary or revoke an order exists for the Secretary of State and the Lord Advocate. Given that they are responsible for serving an order on a person, they will need to ensure that the order reflects the international co-operation arrangement terms.
It is right that any application to vary an order should satisfy the same requirements as those that should be satisfied when an application for such an order is made in the first instance. This will include specifying the international co-operation arrangement and specifying or describing the electronic data for which the varied order is sought. Similarly, an application may not be made to vary an order to include data which the applicant reasonably believes consists of or includes excepted electronic data. When considering a varied order, the judge will need to take into account the same factors as when the order was originally granted. This will ensure that the data sought still serves a purpose to the investigation.
Amendment 24, moved by the noble Baroness, Lady Hamwee, seeks to clarify that the power to vary or revoke an overseas production order given to a judge under Clause 7(1) can be used to revoke part of an order. I reassure her that the amendment is not needed. Subsection (1)(a) already gives a power to vary an overseas production order, which would include revoking it in part—for example, by narrowing the scope of electronic data to be produced—and I therefore hope that she will withdraw the amendment.
The noble Baroness asked whether a provider can say that it will refer this to the judge. The noble Lord, Lord Rosser, asked a similar question. The provider must refer to the judge but cannot actively say it is doing so because of a potential non-disclosure requirement. It is up to the judge whether an order can be disclosed, including the fact of it.
On Amendment 25, when making an overseas production order, a judge may also include a non-disclosure requirement as part of that order, in line with my previous comment. It is not mandatory and whether a non-disclosure requirement is necessary will depend on the facts of each case. Clause 7(1) already includes a provision for revoking or varying an overseas production order. Where a non-disclosure requirement is part of that production order, Clause 7(1) will also apply, allowing the judge to consider an application to vary the order so that it no longer includes such a requirement. There are further provisions in subsections (4) and (5) of Clause 8 that provide a discretion for the judge, when revoking an overseas production order, to order that an unexpired non-disclosure requirement continues to operate. The judge can specify a time when the non-disclosure requirement is to expire that is different from that specified in the revoked overseas production order.
It is the Government’s intention that such orders—that is, an order which maintains a non-disclosure requirement even when the overseas production order has been revoked to ensure that an ongoing or future investigation is not prejudiced—should be capable of being varied or revoked on application. We intend to use court rules to provide for this. The Government will review whether these provisions can be made in court rules and will come back to this issue on Report.
On Amendment 26, the Bill makes it clear that a non-disclosure requirement can be imposed as part of an overseas production order. With the leave of the judge under Clause 8(2)(a), or with the written permission of the appropriate officer who applied for the order or an equivalent officer under Clause 8(2)(b), a person who is subject to a non-disclosure requirement could disclose the making of an order or its contents to any person.
Therefore, a mechanism exists by which a person against whom the order is made has a route to challenge and disapply the provisions of the non-disclosure order under Clause 8. Furthermore, when a non-disclosure requirement is included as part of an overseas production order, that order is capable of being varied under Clause 7 in its entirety as it currently stands. No further clarification is needed for non-disclosure requirements separately, as is proposed by Amendment 25.
Lord Rosser
Could I ask for some clarification? Do the seven days apply at present for domestic orders? In other words, has a view been taken that if seven days is sufficient for a domestic order, it is presumably also sufficient for an order made in this country affecting somebody in the States to apply within seven days? Will it not be a rather more complicated process to apply within a seven-day period, if it is an order made in this country applying to somebody in the States? Does this clause work in the situations of an overseas production order made in this country and orders made in the country with which we have a bilateral agreement applying to British service providers, or does it apply in only one direction?
Baroness Williams of Trafford
As I understand it, seven days is a standard timeframe. I totally take what the noble Lord says in the sense that we are talking about overseas production orders, but the whole purpose of the Bill is that it is a simpler process in the governing of electronic data. It is a standard period of time that we feel to be proportionate.
Lord Rosser
Would the Minister not agree that somebody in the United States must have a pretty good working knowledge of our legal system to know where to apply if they want to revoke or vary an order within seven days?
Baroness Williams of Trafford
I take the noble Lord’s point. I imagine that all of that would be laid out in the agreement, given that it would be set out, but I can certainly have a think about that. Perhaps we can talk about it when we meet.
Baroness Hamwee
My Lords, I am grateful for the long explanation. I had correctly anticipated what the Minister would say about non-disclosure and the impact it might have on an operation. Perhaps I may pursue what happens if a customer asks, “Is there a non-disclosure order in force?” When receiving that inquiry should the answer be, “No comment”, which implies yes? What should it be and how is this dealt with in the real world?
Baroness Williams of Trafford
My guess—I am sure that the Box will correct me if I am wrong—is that if a non-disclosure order is in train then nobody can comment on it, so whether one was in train or not it would be a “no comment” procedure anyway because there would otherwise be a breach.
Baroness Hamwee
I thank the Minister. I beg leave to withdraw the amendment.
Lord Rosser
Lord Rosser
I will be very brief. Clause 9(1) states that an overseas production order that is not served within a period of three months is automatically quashed. My Amendment 29 would reduce the three months in the Bill to two months. The purpose of the amendment is to give the Government the opportunity to say why it is felt that as long a period as three months is needed before an order is quashed if it has not been served.
As the Minister said in the previous discussion, the purpose of the Bill is to provide a much faster means of obtaining electronic data than is currently available under the mutual legal assistance process, which can and does take months. Bearing in mind the need for greater speed in respect of serious crime and terrorism offences or investigations, why could it then take as long as three months to serve an overseas production order once it had been made, and for the specific requirements set out in Clause 4(2) to (6) to be met? Why would two months, as suggested in this amendment, be insufficient, and if it is deemed by the Government to be insufficient, in what kind of cases or circumstances would that be the position? I beg to move.
Baroness Hamwee
I have not got a lot to say on this—but I will say it nevertheless. On Amendment 29, I agree with the noble Lord, Lord Rosser, that if there is an order it should be served quickly—although my reaction was, “If it’s so objectionable that the period should be reduced, there shouldn’t be an order at all”. However, in light of his remarks, perhaps I misunderstood the direction in which he is going.
Amendments 36 and 37 are grouped with Amendment 29 and relate to Clause 14, which is about “means of service”. Clause 14(3) refers to service on a person outside the UK by delivering the order or notice, or whatever it is, to that person’s office or place of business. I wonder whether a person could be outside the UK but at the same time have an office in the UK—unless its base is outside. I am not quite sure what those words mean in context.
Amendment 37 relates to Clause 14(3)(a), which says that service can be made by delivery to a place,
“in the United Kingdom where the person carries on business or conducts activities”.
What does “conducts activities” mean if it does not amount to carrying on business? Is this just a bit of belt and braces? If it is, I would not take exception, but I wonder whether the phrase is normally used, because it seems to be part of carrying on business.
Baroness Williams of Trafford
I thank the noble Baroness and the noble Lord for their comments. The noble Lord, Lord Rosser, made a valid point about consistency. The aim of the Bill is to strike a balance between the operational need to have flexibility for serving such an order and the legal certainty of the obligations that are placed on those who are subject to an order. There is a similarity with PACE, which also provides a three-month time limit from the date an order is issued for an entry and search to be completed. The Government do resist the amendment—but, given what the noble Lord pointed out, I would be open to discussing this ahead of Report.
On Amendment 36, the notice provisions under Clause 14 have been drafted to allow for flexibility, and reflect the complexity surrounding the service of notices on those based overseas. A “person” is taken to mean an individual or a body corporate. In addition, the Government have been careful to construct the clauses in such a way as to avoid persons hiding behind corporate identities and structures, where they may be based or registered elsewhere in one place but operate out of another country. If a person is located outside the UK and the other conditions for granting a production order are fulfilled, a production order can be served. Adding terminology such as “resident” will confuse what is otherwise a straightforward matter of being able to serve on those persons, legal or otherwise, based outside the UK.
On Amendment 37, Clause 14(3)(a) seeks to reflect the model in the Investigatory Powers Act 2016 where the availability of a method of service is not based solely on the establishment of a business pursuant to any domestic or foreign law but instead should depend on where a person actually conducts their business activities. Amendment 37 would narrow the availability of the method of service described in Clause 14(3)(a) in cases where the person is outside the UK but has no principal office here. The Bill currently provides that that service could be effected by delivering the notice,
“to any place in the United Kingdom where the person carries on business or conducts activities”.
The amendment would restrict this to places where the person carries on business. I hope that that is not too complicated. I think that the restriction would be unhelpful. Perhaps it would help if I explained what is intended by “conducts activities”—which is the very question the noble Baroness asked.
The Government intend that “activities” in this sense would mean the corporate activities or business activities according to a common interpretation of the provision. The Government have been careful to construct the clauses in such a way as to avoid persons hiding behind corporate entities and structures, where they may be based or registered elsewhere in one place but operate out of another country. If a person is located outside the UK and the other conditions for granting a production order are made, a production order can be served. Limiting the service to places where business is conducted will introduce complexity where it is not required. However, if there is more we can do to make clear what is intended by “conducts activities”, I am happy to consider whether it is possible to clarify these terms further in the Explanatory Notes.
Baroness Hamwee
I am grateful for that. Reading the clause, it occurs to me that one could avoid being served by moving around from place to place, whether “carrying on business” or “conducting activities”, because at the point of service you might no longer be conducting activities in that place. The terminology is in the present tense. Has thought been given—I am sure it has, because officials are always way ahead of me—to whether that is an issue?
Baroness Williams of Trafford
As I said, if the noble Baroness is confused, that is an indication to me to look at what the Explanatory Notes say—because if she is confused by it, others will be, too.
Baroness Hamwee
I am a bit confused, but that last point is not something to answer now. It is about whether we are talking about the present or whether, having been at an address in, say, Newcastle at one point, and you have moved to Liverpool, there can be service in Newcastle.
Lord Rosser
Bearing in mind that the Minister has said, without making any commitment, that she will reflect further on the amendment, I beg leave to withdraw it.
The Deputy Chairman of Committees
I have to inform the Committee that if Amendment 30 is agreed to, I cannot call Amendments 31 or 32 for reason of pre-emption.
Amendment 30
Baroness Hamwee
Baroness Hamwee
I do not suppose that that will trouble us in Grand Committee.
Clause 10 deals with the retention of data and its use as evidence. Clause 10(1) provides that data,
“may be retained for so long as is necessary in all the circumstances. This includes retaining it so that it may be used as evidence in proceedings in respect of an offence”.
“Necessary in all the circumstances” is quite a wide term. It may be unkind of me but, when I reread it yesterday, it felt as though the writer had run out of steam. One example is given but I would have expected more information about protections and clarification; otherwise, how does one challenge this? Therefore, the amendment is intended to ask the Minister how the Home Office envisages that this clause will operate in practice.
Given the example included, I wonder whether the Home Office anticipates producing guidance regarding retention, and that is the subject of Amendment 31. Amendment 32 is intended to probe the term “an offence”. Does this mean any offence? In particular, if an offence other than the object of this exercise is disclosed, is a fresh application needed or can this be—I will use the extreme term—an unending fishing expedition? I beg to move.
Lord Kennedy of Southwark (Lab Co-op)
My Lords, the noble Baroness, Lady Hamwee, raises three important amendments here and I look forward to the Minister’s response. She is right that, as written, the provision appears to be very wide in scope, and it would be better to have more clarification. The terms “in all the circumstances” and “an offence” are very wide, and it would be good to hear what they are. As the noble Baroness said, it would appear that there could be a never-ending fishing expedition, which in itself would not serve justice. I look forward to hearing the response to the very valid points raised.
Baroness Williams of Trafford
I thank the noble Baroness and the noble Lord for their points. I turn to the first point that the noble Lord, Lord Rosser, made—I am sorry, he did not speak, so it must have been the noble Baroness, Lady Hamwee; they do not look anything like each other. Where material is provided in compliance with a PACE production order, police are in principle able to use that material where it is relevant and necessary for another policing purpose, including a separate criminal investigation. The intention behind the overseas production order is basically to replicate the powers available to law enforcement under current domestic production powers. Under the Bill, the same will apply to electronic data obtained under overseas production orders. This ensures that law enforcement officials can use their independent discretion to consider what is appropriate to help with the conduct of their duties.
The effect of Amendment 32 would be to restrict the retention of the evidence produced in respect of an overseas production order to the offence for which the order was made. The Bill’s provisions do not dictate when an officer should apply for a new production order in respect of data received that is to be used for a different purpose. Again, this is consistent with existing practice. The Bill simply makes the same provisions in relation to orders which can be served on an entity outside the UK, where a relevant agreement is in place, as in relation to orders which can be served on a company based here.
It will always be appropriate for law enforcement officers and prosecutors to consider what can be used in an investigation and for evidential purposes. They will assess the likelihood of challenge in court where evidence produced in relation to a production order is adduced for a separate criminal offence. That is already their bread and butter. In all likelihood in those situations an appropriate officer may well decide that it would be more appropriate for a new production order to be obtained for the material produced that points to a separate offence.
A question was asked about guidance. The Government will consider whether it is necessary to produce policy guidance to assist an appropriate officer in these circumstances but, given that the Bill reflects existing practice in relation to production, I do not see that it brings about a new challenge for our law enforcement or prosecution professionals and I do not think it is necessary to mandate it in the Bill. For these reasons, I ask the noble Baroness to withdraw the amendment.
Lord Kennedy of Southwark
That was a very long explanation of why the clause is as it is and I thank the Minister for it. She referred to how this in effect mirrors what we have in PACE. Is guidance provided on PACE?
Baroness Williams of Trafford
There is a code of practice for PACE. We will look at whether some guidance is necessary for this replicated process.
Lord Kennedy of Southwark
I thank the Minister for saying she will look at those points. If we are mirroring PACE then we can mirror the guidance as well.
Baroness Hamwee
My Lords, I think I am going to have to spend some time between now and Report familiarising myself with PACE or hand this over to my noble friend Lord Paddick, whose bread and butter it was at one time. I take the point made by the noble Lord, Lord Kennedy, but I remain faintly uneasy about how open this is. Nevertheless I thank the Minister and I beg leave to withdraw the amendment.
Lord Paddick
“Priority
In the event of any conflict between this Act and the Data Protection Act 2018 (“the DPA”) or the General Data Protection Regulation 2018 (“the GDPR”), the provisions of the DPA or the GDPR shall prevail.”
Lord Paddick
My Lords, Amendment 39 is in my name and that of my noble friend Lady Hamwee. I am grateful for the briefing from techUK, which raises concerns about how this legislation might affect a deal between the EU and the UK on adequacy should the UK leave the European Union. We are unsure how to address those concerns and this amendment is very unlikely to be the means by which to do so, but at this stage it is a means of raising them. It is a bit of a Second Reading amendment, if noble Lords get my drift.
Throughout our debates it has been emphasised that the sole purpose of this legislation is to enable UK law enforcement agencies to find a faster legal means to secure data held overseas that may contain vital evidence in serious criminal cases being prosecuted in the UK than the current mutual legal assistance treaty process. Data handled in the UK is subject to the protections of the Data Protection Act 2018 and the EU general data protection regulations. Indeed, the Data Protection Act ensures that the GDPR continues to have effect, even if the UK does leave the EU.
Throughout our debates on this legislation we have expressed our concerns that the designated international co-operation arrangements that enable overseas production orders to have effect in the target state will give as much right to overseas law enforcement agencies to demand data from UK service providers as the right this legislation will give UK law enforcement agencies to demand data from a service provider in a foreign state. Those foreign states, such as the United States of America, are not bound by the Data Protection Act or the GDPR.
For a third country to exchange data with the EU it must persuade the EU that it has adequate protections for personal data equivalent to or exceeding the standards that EU countries have to comply with under the GDPR. Indeed, EU states are not bound by EU regulation relating to data used for national security purposes, but third-party states are. For the first time, if we leave the EU, the EU will scrutinise the way we handle data in relation to national security because we will become a third-party country, involving more scrutiny than currently takes place. I think that is called “taking back control”. Whether in relation to national security or not—we have already debated the weaker safeguards proposed in relation to terrorism offences—such arrangements could result in personal data from an EU country and shared with a UK service provider being passed to a law enforcement agency in a state that falls short of the protections provided by the GDPR.
In summary, our concern is that, by entering into international co-operation agreements enabling overseas law enforcement agencies directly to access personal data held in the UK by UK service providers, sensitive personal data will be accessed by overseas law enforcement agencies whose standards fall below those set out in the Data Protection Act and the GDPR, thereby jeopardising the EU granting the UK an adequacy certificate. Could the Minister explain what discussions have taken place with the EU on this issue and how the UK’s adequacy status will be protected? I beg to move.
Lord Kennedy of Southwark
My Lords, I fully support the amendment moved by the noble Lord. I recall our debates in the Chamber on the GDPR and how important it is to get the adequacy certificate to make sure that we are compliant with all these regulations, and we cannot put that at risk in subsequent legislation. I am looking for the Minister to address that point. The noble Lord has raised a very valid point. We need to get this right before this legislation reaches the statute book.
Baroness Williams of Trafford
I thank the noble Lord, Lord Paddick, for the point that he has made, and the noble Lord, Lord Kennedy, for backing it up. I smiled when the noble Lord, Lord Paddick, asked about countries that fall short of our data protection laws. We are probably at the top of the EU league table in terms of the rigour of our data protection legislation—I can think of some countries that might fall into the category that the noble Lord talks about—but the Bill will put on an equal footing the means by which UK law enforcement officers or prosecutors can apply to the court for access to electronic evidence, irrespective of whether the data is held by an entity based in the UK or based elsewhere in the world. UK law enforcement will be bound by the very robust Data Protection Act 2018 when processing personal data obtained pursuant to an overseas production order or where access has been given to data pursuant to such an order.
The noble Lord asked what discussions have been taking place. Those discussions are above my pay grade. I have not been involved in them personally but I know that they will have been going on, certainly in the background. However, the noble Lord makes a very good point about the adequacy decision. He also asked how we will ensure that data is used for the correct purposes. That is all part and parcel of what our Data Protection Act provides for. I am absolutely convinced that we in the UK have the right data protection safeguards in place and, when it comes to data protection and other countries, we will ensure that the same rigour is in place in the country with which we have made an agreement.
Clause 6(4)(c) states that an overseas production order,
“has effect in spite of any restriction”.
The noble Lord asked whether that means that UK CSPs do not need to comply with data protection. Having effect “in spite of any restriction” relates only to the effect of an order served on a CSP outside the UK, so the restrictions can only be in UK law, as we obviously cannot seek to override laws in other countries.
It might be helpful to reiterate that, when making a production order, a judge must consider the requirements set out in Clause 4. In doing so, he or she will need to consider whether the evidence is of substantial value to the investigation or proceedings and whether it is in the public interest to produce the information, balancing these factors with the right to privacy. It stands to reason that the more sensitive the data, the harder it will be for the applicant to justify the public interest test. I hope that the noble Lord will be happy to withdraw his amendment.
Lord Kennedy of Southwark
The noble Lord’s amendment seeks to put it into the Bill that, in cases of dispute, the GDPR shall prevail. Is the noble Baroness saying that this is implied anyway, or not necessary? If we end up with this on the statute book as it is now, and the matter of which Act applies were to become a matter of dispute in the courts, that is not where we would want to be.
Baroness Williams of Trafford
I agree with the noble Lord, but I am saying there would be an underlying basis for data protection, which is the Data Protection Act. Therefore, while there are many things we could put on the faces of many Bills, it is not necessary in this case—we already have laws governing the protection of data.
Lord Kennedy of Southwark
With that comment, is the Minister saying that, actually, GDPR will prevail?
Baroness Hamwee
My Lords, as the Minister is responding, it seems that this falls into a similar category to a point we raised last week about how one balances the different public interests involved. I think the Minister is saying that there is a public interest in the application of the Data Protection Act and the GDPR, which takes us back to the clause about assessing public interest. The Minister is nodding at that. Perhaps, before Report, we should go back and look at how that might apply in this context as well.
Lord Paddick
My Lords, I am grateful to the Minister, and to other noble Lords, for their contributions. In essence, my question is: if the EU has to assess whether we are safeguarding its data, yet we are entering into agreements to give away that data to another country, will the EU need to be satisfied that that other country also has standards of data protection equivalent to or better than the GDPR? If not, we might be putting the adequacy judgments at risk. That is the essence of the amendment. I would be grateful for an opportunity to discuss this further with the Minister in the meetings between now and Report but, at this stage, I beg leave to withdraw the amendment.