Investigatory Powers (Amendment) Bill [HL]
Tuesday 23rd January 2024
(10 months, 4 weeks ago)
Lords ChamberInvestigatory Powers (Amendment) Act 2024 View all Investigatory Powers (Amendment) Act 2024 Debates Read Hansard Text Read Debate Ministerial Extracts Amendment Paper: HL Bill 36-I Marshalled list for Report - (19 Jan 2024)
16:24 - Division on Amendment 1 - Ayes: 201 / Noes: 227 - Amendment 1 disagreed.
Lord Fox
Member’s explanatory statement
This amendment requires a person granting an authorisation in urgent cases to notify a Judicial Commissioner within, at most, 24 hours that they have done so.
Lord Fox (LD)
My Lords, I will speak also to Amendment 7, which is in my name. These amendments require a person granting an authorisation in urgent cases to notify a judicial commissioner within, at most, 24 hours. This amendment would make it mandatory that, when the intelligence services use type 7A and 7B data for urgent operational purposes, they must report this to a judicial commissioner within 24 hours.
As your Lordships know, the current proposal in the Bill is three days. As it stands, the intelligence services can use those three days to interrogate a dataset that is ultimately ruled offside by the judicial council—three days to deploy AI models that work very quickly, in moments. The Minister responded, highlighting extra cost as a possible reason not to pursue this. Plainly, with all due respect, that is not true, because the data has to be reported anyway, and bringing it forward by a couple of days is not a relevant concern.
The spectre of weekends has also been raised. I assume that, given that this process is to facilitate urgent investigations, the intelligence services themselves will be working on Saturday and Sunday, and it is up to them to report their activity. Amendments 1 and 7 do not change the time duty for the judiciary to respond, so this would not affect the operation of the urgent inquiry. Should they not respond until Monday or otherwise, it is not the concern of the services. Clearly, it puts pressure on the judicial commission to some extent, but the intelligence services will have met their side of the obligation and can carry on with their important and urgent work until such time as the judicial commissioner makes a ruling. In any case, I am sure that there will be duty rosters and such things going on for this, so, again, I am not sure that the weekend is a concern.
Another argument that has been advanced and may yet return is that other legislation uses three days, so this should, too. The whole point of the Bill is to take advantage of new and innovative technology. It seeks to recognise the differences and change regulations accordingly. If the technology changes, as it does as a result of the Bill, so should reporting criteria. If there are other times that are different, perhaps we should be looking at those rather than at this amendment. In this case we are dealing with new technology, where artificial intelligence, once trained, can be deployed on data—which may or may not be allowed until such time as the judicial commissioner has ruled—and AI can produce its answers in minutes, perhaps hours.
In Committee I proposed that the use of this data for urgent operations should be reported immediately. I recognise that that was a very unreasonable suggestion, which is why these amendments specify within 24 hours, which is a fairer proposal.
In Committee, the Minister’s words on what happens to information retrospectively ruled unusable were helpful:
“The relevant information must be removed from the low/no dataset and either deleted or a Part 7 warrant sought”.—[Official Report, 11/12/23; col. 1743.]
However, additionally in Committee, various ex-services Peers confirmed what I knew, which is that once a fact is known by service personnel, it is not forgotten—it cannot be unknown. The noble Baroness, Lady Manningham- Buller, and other noble Lords were very clear on that.
This amendment is designed to limit the amount of unforgettable information that can be derived from inappropriate datasets. I will listen hard to the Minister’s words, but, unless he has found a different and more compelling argument than those already deployed, I will press Amendment 1.
I am pleased that the Government have agreed that, in the event of Amendment 1 being agreed, Amendment 7 will be treated as consequential. I beg to move.
Lord West of Spithead (Lab)
My Lords, I rise to speak to Amendments 2, 3 and 6. As I made clear in Committee, the Intelligence and Security Committee broadly welcomes the introduction of this legislation as a means of addressing significant changes to the threat and technological landscapes that have the potential to undermine the ability of our intelligence agencies to detect threats and protect our country. There are, however, several areas in which the Bill must be improved and, in particular, safeguards strengthened.
The draft codes of practice published by the Government contain indicative safeguards. This is not a substitute, however, for putting such provisions on the face of the Bill, which is essential if we are to ensure that those safeguards cannot be changed or diluted by subsequent Administrations. This is particularly important when we are discussing necessary scrutiny and oversight. The ISC is still, therefore, seeking amendments to several sections of the Bill.
It is important to remember that the Bill seeks an expansion of the investigatory powers available to the intelligence services. We consider that this expansion is warranted. Any increase in those powers, however, must be accompanied by a proportional increase in oversight. Sadly, the Government have previously been reluctant to ensure that democratic oversight keeps track of intelligence powers—particularly where it is related to the remit and resources of the ISC. This House has made its views on this long-standing failure known during debates on several recent Bills, and yet again in Committee on this Bill. The Government have so far refused to update the remit of the ISC or provide the necessary resources for its effective functioning, such that it has
“oversight of substantively all of central Government’s intelligence and security activities to be realised now and in the future”—
as was the commitment given by the then Security Minister during the passage of what became the Justice and Security Act.
The House of Lords made its views on this long-standing failure known in debates over several recent national security Bills, including what became the National Security and Investment Act, the Telecommunications (Security) Act and the National Security Act. Despite these repeated attempts by this House to ensure effective oversight, this has been ignored by the Government. The Government cannot continually expand and reinforce the powers and responsibilities of national security teams across departments, and not expand and reinforce parliamentary oversight of those teams as well. The committee expects the Government to take this opportunity to bolster the effective oversight it purports to value. It is therefore imperative that Parliament ensures that, in relation to this Bill, the role of the ISC and other external oversight bodies, such as IPCO, is well defined and immovable from the outset. Fine words in a code of practice are, I am afraid, hardly worth the paper they are written on. They must be written into statute.
On the detail of Amendment 2, as I have noted in my previous speeches, Section 226DA of the current Bill requires that each intelligence service provide an annual report to the Secretary of State detailing the individual bulk personal datasets it retained and examined under either a category authorisation or an individual authorisation during the period in question. My amendment would ensure that there was independent oversight of this information, rather than just political oversight, as at present. It would achieve this by providing that the annual report be sent also to the Intelligence and Security Committee of Parliament and the Investigatory Powers Commissioner.
IPCO does have a degree of oversight included in the Bill already, alongside its existing powers of inspection, but it is not full oversight. Further, there is currently no parliamentary oversight of category authorisations at all. This is not appropriate. My amendment will, therefore, enshrine within legislation that IPCO and the ISC will have oversight of the overall operation of this regime.
At this point, I acknowledge the amendment tabled by the Government. I thank the Minister for his engagement with the ISC; we have had some useful dialogue and I thank him very much for that. It is reassuring that there may finally be some recognition of the strength of feeling in this House that was apparent through noble Lords’ interventions at Second Reading and in Committee that the ISC must have a role in scrutinising this new regime.
However, what is not clear is why the Government chose to table their own amendment rather than accept the ISC’s amendment. Both amendments would seemingly provide the ISC with information on category authorisations that are granted or renewed in the given period. Without wishing to sound suspicious, I think the House requires an explanation as to what the Government see as the difference.
The first difference appears to be that the government amendment is less specific on the information to be provided and does not include individual authorisations within its scope. It therefore does not give the same level of assurance to Parliament and the public that the ISC is fully sighted on the operation of the regime.
The second difference is that the government amendment would seem to create more work for the intelligence community, as rather than simply sending the existing annual report to the ISC, a separate report would have to be produced instead. The Minister has been very keen to emphasise the need to minimise the burden on the agencies—we agree entirely with him; they are very busy—when it comes to other elements of the Bill, so it is most peculiar that the Government are deliberately choosing to increase the burden.
The third point I would note is that if the intention of this proposal is to carefully curate the information provided to the ISC regarding the Part 7A regime, it is rather undermined by the fact that the committee would still be able and willing to request a full report be provided to the Secretary of State, under the existing powers in the Justice and Security Act.
My fourth and final point is that the government amendment excludes the Investigatory Powers Commissioner. It is not clear why. IPCO and the ISC are both essential to oversight.
I trust noble Lords can recognise that, despite what I am sure are the Government’s best intentions, the ISC amendment provides the most robust assurance to Parliament and the public regarding oversight of the new regime, and the most streamlined mechanism for delivering this. I therefore urge the Minister and noble Lords to support this amendment to ensure that the robust safeguards and oversight mechanisms so carefully considered by Parliament in respect of the original legislation are not watered down by changes under this Bill. If investigatory powers are to be enhanced, so must oversight. This is what the ISC seeks to achieve by this amendment and those others that I have tabled.
I will touch very briefly on my noble friend Lord Coaker’s Amendment 5. I support it fully and I have raised those issues to do with the ISC.
On Amendment 6, this Intelligence and Security Committee amendment is required in order to close a 12-month gap in oversight. This relates to the new Part 7A, to be introduced by this Bill, which provides for a lighter-touch regulatory regime for the retention and examination of bulk personal datasets by the intelligence services where the subject of the data is deemed to have low or no reasonable expectation of privacy. Approval to use such a dataset may be sought either under a category authorisation, which encompasses a number of individual datasets that may be used for similar purpose, or by an individual authorisation, where the authorisation covers a single dataset that does not fall neatly within a category authorisation or is subject to other complicating factors.
In the case of the category authorisation, a judicial commissioner will approve the overall description of any category authorisation before it can be used. A judicial commissioner will also approve any renewal of category authorisation after 12 months, and the relevant Secretary of State will receive a retrospective annual report on the use of all category and individual authorisations.
However, as I highlighted in Committee, this oversight is all retrospective. What is currently missing from the regime is any form of real-time oversight. Under the current regime, once a category authorisation has been approved, the intelligence services then have the ability to add any individual datasets to that authorisation through internal processes alone, without any political or judicial oversight. They will be able to use those datasets for potentially up to a year without anyone being the wiser. This would mean relying on the good intentions of a particular intelligence service to spot and rectify any mission creep up until the 12-month marker for renewal. Although we have every faith in the good intentions of the intelligence services, no legislation should be dependent on the good will of its subjects to prevent misuse of the powers granted therein, particularly where those powers concern national security.
It is important that we fill that 12-month gap in oversight, and my amendment does so very simply by providing a new Section 226DAA in Clause 2, which would ensure that IPCO is notified whenever a new, individual bulk personal dataset is added by the agencies to an existing category authorisation. The Government’s primary argument against this proposal appears to be that it would be too onerous for the intelligence community and would impair its operational agility. I do not believe this is the case.
Notification would entail the agency sending a one-line email to the Investigatory Powers Commissioner containing the name and description of the specific bulk personal dataset as soon as reasonably practicable after the dataset was approved internally for retention and examination by that intelligence service. The amendment would not require that the use of the dataset be approved by the Investigatory Powers Commissioner, merely that the commissioner be notified that it had been included under the authorisation. It does not, therefore, create extra bureaucracy or process—certainly not in comparison with an entire new annual report, as the Government were proposing in relation to my previous amendment.
Crucially, this will provide for IPCO to have real-time information to enable it to identify any concerning activity or trends in advance of the 12-month renewal point. Any such activity could then be investigated by the commissioners as part of their usual inspections. Aside from the supposedly onerous burdens that these one-line emails will place on the agencies, the Government are also seeking to argue that the safeguards of the Bill are currently calibrated to the lowest level of intrusion associated with low or no expectation of privacy datasets and that it would therefore be inconsistent for the agencies to provide notification regarding category authorisations, given that they do not provide notification for datasets under the current Part 7 class warrant regime.
This argument is similarly unpersuasive. In the first instance, the light-touch nature of our amendment, requiring simple notification rather than approval, is already calibrated to the lower level of intrusion. However, the key point is that the agencies do not have the same powers under Part 7 and Part 7A. This new regime gives the agencies greater powers specifically to internally add individual datasets to those categories without external approval. This is not a power given under the current Part 7 regime. The ISC agrees that the agencies should have this power in relation to low or no reasonable expectation of privacy datasets. However, to rehearse this argument yet again, we should not be creating greater intrusive powers without data oversight. This is a new power that should not be available without some form of real-time external oversight, which is what my amendment provides.
This combination of real-time oversight through the notification stipulated in this amendment and retrospective oversight through the involvement of judicial and political oversight bodies, as set out in my previous amendment, is necessary to provide Parliament and the public the reassurance that data is being stored and examined in an appropriate manner by the intelligence services. The ISC believes that this amendment strikes the right balance between protecting the operational agility of the intelligence services, which remains very important to us, and safeguarding personal data. I therefore urge noble Lords to support my amendment.
Baroness Manningham-Buller (CB)
My Lords, first, I apologise. Like the noble Lord, Lord West, who during Committee had a bionic knee, I may not last, because I had a new one installed a couple of weeks ago. My eyes turned to the noble Lord, Lord Fox, as he possibly expected, but I am out of reach today and I cannot hit him with my crutch.
It might help the House if I described the circumstances in which an emergency warrant is sought. There is a very long-standing system for this. In the days before we had judicial commissioners, it was if a Minister was unavailable, and now it is if the Minister and, of course, the judicial overseers decide that a warrant sought is wrong or inappropriate, all the material is destroyed.
At the earlier stage, I said that you cannot legislate to forget, but the noble Lord, Lord Fox, has slightly twisted what I was trying to say then. Of course, if the material is destroyed because the warrant was not approved, some people will remember what they read, but it cannot be used in any way.
These occasions occur nearly always at times when people are unavailable—in the middle of the night or at weekends—when there is a brief window of opportunity where it is a matter of life and death. I can see that, on the surface, it is appealing to bring the notification time down to 24 hours, but this is not rational or consistent with the rest of the legislation that we have. For far more intrusive techniques such as planting a microphone or intercepting a communication, it is three days. That said, I know that my former colleagues will endeavour to do it as soon as possible, but over the weekend the Investigatory Powers Commissioner’s Office is not open. People are not available. They will try to do it as soon as possible, but it does not make sense to reduce the time needed in these cases of low intrusion, with datasets of no or low expectation of privacy, to require a stricter regime than for very much more intrusive techniques such as the planting of a microphone in your house.
Lord Murphy of Torfaen (Lab)
My Lords, I rise very briefly to support my noble friend Lord West in his excellent speech regarding the Intelligence and Security Committee, which I had the honour of chairing for two years some years ago. I hope that the Government take great heed of my noble friend’s words. The ISC is probably the most important oversight committee in the world, and it is certainly held in great respect by countries throughout the western world. I have never known the committee to be in any way partisan, and it consists of Members of both Houses of Parliament of great distinction. Therefore, I support what my noble friend said.
However, I also support the amendment tabled by my noble friend Lord Coaker regarding the Prime Minister. Something has gone wrong in the last few years in relations between the Government and the Intelligence and Security Committee. It would seem that the Prime Minister, whoever it might be, has not met with the ISC—as he should do—for years. Perhaps the Minister will tell us when the ISC last had a formal meeting in the Cabinet Room of No. 10 Downing Street with an incumbent Prime Minister. It is hugely important because, inevitably, the work of the ISC is secret but may need to be discussed with the Prime Minister of the day. My noble friend’s amendment puts that obligation for the Prime Minister to meet with the committee in statute. I have no doubt that the Minister will dismiss this as impractical. However, it shows the strength of feeling of Members of this House and, I am sure, of the other place, regarding the importance of the ISC, the importance of the agencies reporting to it—especially since, as a result of this Bill, the agencies will have more power—and for there being a direct link between the Prime Minister and the committee on a regular basis.
Lord Coaker (Lab)
My Lords, I thank the Minister for his continued engagement with us on all aspects of this important Bill. I would be grateful if he could pass that on to his officials as well. I wish the noble Baroness, Lady Manningham-Buller, well with her knee, and I hope she will soon be able to make do without the crutch.
I very much support what my noble friends Lord West and Lord Murphy said about the amendments moved by my noble friend Lord West regarding the ISC. I look forward to the Minister’s response. I will come to my amendments in a moment, but it goes to the heart of what many of us have been saying—that the Intelligence and Security Committee is extremely important. Part of the problem is that, when the Minister responds to us on these points, he often says, “Don’t worry: there’s ministerial oversight”. However, what my noble friends have talked about is that this is not the same as parliamentary oversight. There is an important distinction to be made. I hope that the Minister can respond to that.
I turn to the noble Lord, Lord Fox, and his amendments. Again, we thank the Government for the communication we have had regarding Amendments 1 and 7. As I have intimated before, we support the noble Lord, Lord Fox, on his Amendments 1 and 7. With the addition of the low/no datasets authorisation and third-party data warrants to the bulk personal datasets warrants regime, and the extension of powers that this represents, it seems appropriate that additional safeguards are put in place to ensure the judicial commissioner is informed as quickly as possible of the use of these urgent warrants. Importantly, that does not change how long the judicial commissioner has to consider the warrant, and to revoke access if necessary; it is just on the importance of notification as quickly as possible. If urgent powers, as the noble Baroness, Lady Manningham-Buller, has pointed to, need to be used, nobody is suggesting that they are not used; the suggestion is that the notification to the judicial commissioner should be made as soon as possible and, with respect to the amendment of the noble Lord, Lord Fox, within 24 hours.
I turn to my Amendment 47. This amendment aims to try to get the Minister to put some of this on the record, rather than to seek to divide the House on it. Amendment 47 seeks to ensure that the Government report on the potential impact of the Bill on the requirement to maintain data adequacy decisions from the EU. The adequacy agreement is dependent on the overall landscape of UK data protections. Although the UK protections are currently considered adequate, deviations from this under this legislation could put our current status at risk. Losing this designation would have serious consequences for digitally intensive sectors, such as telecommunications and financial services as well as tech services. In his response, could the Minister provide some reassurances on this particular aspect of the legislation and say whether any specific analysis has been done on the impacts of the Bill on the data adequacy agreement?
I turn to my Amendment 5, which, just for clarity, is a probing amendment but is extremely important. The Minister will know that I have raised this point again and again on various pieces of legislation over the last year or two. To be fair, the Minister has said that he will raise it with the appropriate people, and I am sure that he has done that—I am not questioning that at all. As the noble Lord, Lord Murphy, said, and the Intelligence and Security Committee said in its report of 5 December 2023—hence my Amendment 5 to probe this—no meeting between the Prime Minister of our country and the Intelligence and Security Committee has taken place since December 2014. I am pleased that we have the noble Lord, Lord Cameron, here—not present in the Chamber now, but here within your Lordships’ House—because he was the last Prime Minister that met with the committee. I find it absolutely astonishing that that is the case.
We are informed by the committee that many invitations have been made to various Prime Ministers to attend the Intelligence and Security Committee. I do not want to go on about this—well, I will to an extent—but it is incredibly important. I cannot believe—people say that it cannot be right, and I show them the report—that it has been 10 years since a Prime Minister has gone to the body, which has been set up by Parliament to ensure there is liaison between Parliament and the intelligence and security services. Obviously, matters can be discussed in that committee. Some of those cannot be discussed in the open, but that is one way in which it is held to account.
Can the Minister explain what on earth is going on? Why is it so difficult for the Prime Minister to meet the committee? I am not intending to push this amendment to a vote, as I say, and I am sure the Minister will try to explain again, but it is simply unacceptable that the Prime Minister of this country has not met the ISC for 10 years. For the first 20 years of its existence, and my noble friend Lord West will correct me if I am wrong, I think it was an annual occurrence that the Prime Minister met the ISC—my noble friend Lord Murphy is nodding—yet that has not happened since 2014. That is unacceptable, and my Amendment 5 seeks to ask the Minister what on earth we are going to do to try to get the Prime Minister to attend. I would not have thought that was too much to ask.
The Parliamentary Under-Secretary of State, Home Office (Lord Sharpe of Epsom) (Con)
My Lords, I have listened with interest to the points made in this debate. As noble Lords will be aware, we have considered carefully the amendments that have been debated. I place on record my thanks to the noble Lords, Lord West, Lord Coaker and Lord Fox, for their constructive engagement in the run-up to today’s debate on these issues and various others that will be debated later today.
I turn first to the topic of oversight of the new Part 7A regime containing bulk personal datasets, BPDs, where there is low or no expectation of privacy. Alongside the proportionate set of safeguards set out in Part 7A, the Bill currently provides for executive political oversight and accountability by requiring the heads of the intelligence services to provide an annual report to the Secretary of State about Part 7A datasets. The intention of the report is to ensure that there is a statutory mechanism for political oversight, given that the Secretary of State will not have a role in Part 7A authorisations. That is set out in new Section 226DA in Clause 2 of the Bill.
The Investigatory Powers Commissioner will continue to provide full, independent and robust oversight of the investigatory powers regime, including this new part. Nevertheless, the Government have listened to the points made by noble Lords and colleagues in the other place, and we understand their concerns about increasing parliamentary oversight. Government Amendment 4 therefore recognises the important role of the ISC in providing parliamentary oversight of the intelligence services. It places a statutory obligation on the Secretary of State to provide the ISC with an annual report containing information about category authorisations granted under the Act during the year. The amendment will ensure that the ISC is proactively provided with information about the operation of Part 7A on an annual basis. That will support the ISC in continuing to fulfil its scrutiny role and will enhance the valuable parliamentary oversight the committee provides.
It is appropriate for the ISC to be privy to certain information relating to Part 7A in the exercise of its functions, and that a statutory obligation be placed on the Secretary of State to provide it. This obligation is intended to be consistent with the provisions set out in the Justice and Security Act, and due regard will be had to the memorandum of understanding between the Prime Minister and the ISC when meeting it. It is likely that Amendments 2 and 3, tabled by the noble Lord, Lord West of Spithead, which would require that the report provided to the Secretary of State be also shared with the ISC, would not be in step with that. The information required by the Secretary of State to fulfil their responsibilities in respect of the intelligence services will not necessarily be the same as that which would assist the ISC in performing its functions. The report will almost certainly contain information about live operations, which is outside the scope of the ISC’s remit, as well as other information that it may not be appropriate to share with the ISC and which the Secretary of State could properly withhold from the ISC were the ISC to request it.
For that reason, we think it more appropriate that a report be written to meet the ISC’s functions that the Secretary of State will send to the ISC. This will provide the additional parliamentary oversight the committee is seeking and would be akin to the existing arrangements in place for operational purposes.
Lord Coaker (Lab)
I thank the Minister for giving way, because this is an extremely important point. He mentioned with respect to my Amendment 5 that somebody will formally reach out. Does that mean that the Prime Minister will formally reach out to the ISC and meet with it, so that we get a resolution to this non-meeting?
Lord Sharpe of Epsom (Con)
I cannot say whether or not that someone will be the Prime Minister at the moment.
As I said, the Government are clear that the MoU review is the correct forum to discuss relevant potential changes to the agreement between the Prime Minister and the ISC. But the Government do not believe a report of this kind is appropriate or necessary and do not support the amendment. The noble Lord, Lord Coaker, has already answered the question from the noble Lord, Lord Murphy, and all I can say from the Dispatch Box is that I will try again.
I turn to the second of the amendments from the noble Lord, Lord Coaker, Amendment 47, which would require the Government to publish a report assessing the potential impact of this legislation on the EU’s data adequacy decision. The Government are committed to maintaining their data adequacy decisions from the EU, which play a pivotal role in enabling trade and fighting crime. The Home Office worked closely with the Department for Science, Innovation and Technology when developing the proposals within this Bill to ensure that they would not adversely impact on the UK’s EU data adequacy decisions. As the European Commission has made clear, a third country is not required to have the same rules as the EU to be considered adequate. We maintain regular engagement with the European Commission on the Bill to ensure that our reforms are understood. Ultimately, the EU adequacy assessment of the UK is for the EU to decide, so the Government cannot support this amendment.
I turn to the amendments retabled by the noble Lord, Lord Fox, on urgency provisions for individual authorisations under Part 7A and third party dataset warrants under Part 7B. The Government remain opposed to these iterations of the amendments for the following reasons. Urgency provisions are found throughout the IPA and the Government’s approach is to mirror those provisions in the regimes in new Part 7A and new Part 7B. Making the proposed amendment solely for these parts would reduce consistency—as the noble Lord, Lord Fox, predicted—and ultimately risk operational confusion where there is no good reason to do so.
It will always be in the interests of the relevant intelligence service—as the noble Baroness, Lady Manningham- Buller, said; I add my comments to those of the noble Lord, Lord Coaker, about a speedy recovery—to notify a judicial commissioner of the granting of an urgent authorisation or the issuing of an urgent warrant as soon as is reasonably practicable. These urgent instruments are valid only for five working days. A judicial commissioner must review and decide whether to approve the decision to issue or grant the instrument within three working days. If the judicial commissioner refuses to approve the decision within that time, then the instrument will cease to have effect. It would be counter- intuitive for an intelligence service to make untimely notifications, as this increases the risk of the urgent authorisation or warrant timing out because the judicial commissioner is left without sufficient time to make a decision.
In an operational scenario where the urgency provisions are required, such as a threat to life or risk of serious harm, or an urgent intelligence-gathering opportunity, it may not be practical or possible for the intelligence services to ensure completion of paperwork within a 24-hour period, as the noble Baroness, Lady Manningham- Buller, explained rather more eloquently than I have done.
The intelligence services work closely with the Investigatory Powers Commissioner’s Office to ensure that the processes for reviewing decisions are timely and work for judicial commissioners. For those reasons, I ask that the noble Lord, Lord Fox, does not press his amendments.
This group also includes the two modest but worthwhile government amendments, Amendments 8 and 9. These make it clear beyond doubt that the new third party BPD regime will fall under the oversight of the Investigatory Powers Commissioner. The robust oversight that IPCO brings will ensure compliance, ensuring that robust safeguards are in place when information is examined by the intelligence services on third parties’ systems. I hope that noble Lords will welcome these amendments and support them.
Lord Butler of Brockwell (CB)
My Lords, as a former member of the Intelligence and Security Committee, perhaps I may say how much I endorse what has been said by the noble Lords, Lord West and Lord Murphy, and welcome many elements in the—
Lord Fox (LD)
We have had the speeches on this group and are moving to a vote. I am sorry to interrupt the noble Lord.
I thank the Minister for his comments and, indeed, the noble Baroness, Lady Manningham-Buller. My interpretation—perhaps I am wrong—of the nature of this Bill was that it was to introduce a new class of data and to deal with it. It was not to reach back into existing law and change it. The noble Baroness raised some important points about why I should have been concerned about the other data, which I did not reach back into. I am happy to advise my colleagues in the Commons and perhaps they can do that, too. However, taking on face value the nature of what we were seeking to achieve today, we looked at this data and came up with this conclusion. We have heard the arguments, but I am afraid that I am not persuaded by them and I would like to test the will of the House.
Lord Sharpe of Epsom
“226DAA Report to Intelligence and Security Committee(1) The Secretary of State must for each relevant period provide to the Intelligence and Security Committee of Parliament a report setting out information about category authorisations and renewals of category authorisations granted in that period.(2) In subsection (1) “relevant period” means—(a) a period of at least one year and no more than two years beginning with the date on which this Part comes fully into force, and(b) subsequent periods of no more than one year, beginning with the end of the period to which the previous report related.(3) Each report must be provided to the Committee as soon as reasonably practicable after the end of the period to which the report relates.”Member’s explanatory statement
This amendment requires the Secretary of State to provide to the Intelligence and Security Committee of Parliament reports about category authorisations and renewals of such authorisations under new Part 7A of the Investigatory Powers Act 2016.
Lord Sharpe of Epsom
Member’s explanatory statement
This amendment is consequential on the amendment in the name of Lord Sharpe of Epsom at page 25, line 30.
“(3A) In section 229 (main oversight functions), in subsection (9), in the definition of “bulk personal dataset”, after “199” insert “(and includes a third party bulk personal dataset (see section 226E))”.”Member’s explanatory statement
This amendment clarifies that the Investigatory Powers Commissioner’s oversight functions include, amongst other things, keeping under review the use of third party bulk personal datasets by an intelligence service.
Lord Sharpe of Epsom
“(aa) deciding under section 90(11) or 257(10) whether to approve a decision of the Secretary of State,”Member’s explanatory statement
This amendment provides that the function of the Investigatory Powers Commissioner (“IPC”) of deciding, under section 90(11) or 257(10) of the Investigatory Powers Act 2016 (review of notices), whether to approve decisions may be delegated to a Deputy IPC only where the IPC is unable or unavailable to exercise the function.
Lord Sharpe of Epsom (Con)
My Lords, I will speak to the government amendments in this group, Amendments 10 to 14.
The Investigatory Powers Act contains world-leading oversight arrangements and safeguards that apply to the use of investigatory powers. The Bill strengthens these to ensure that the oversight regime is resilient and that the Investigatory Powers Commissioner is able to carry out his functions effectively. These government amendments are designed to maintain this approach, and to tighten the drafting in certain areas to ensure that the scope of the measures in Part 3, in respect of communications data, cannot be interpreted more broadly than is intended.
I will start with government Amendment 12, which will ensure that there is clarity for telecommunications operators regarding their obligations to report personal data breaches relating to warrants issued under the IPA. The proposed new clause will also make provision for such breaches to be reported to the Information Commissioner and the Investigatory Powers Commissioner. This amendment will also ensure that the Investigatory Powers Commissioner has the ability to notify an individual affected by the personal data breach, if it is deemed to be in the public interest to do so and if the Information Commissioner considers the breach to be serious. Such a notification will inform an individual of any rights that they may have to apply to a court or tribunal in relation to the breach. This important amendment will bring much-needed clarity in respect of how personal data breaches committed by tele- communications operators are regulated, and ensure that there is a clear statutory basis for the Information Commissioner and the Investigatory Powers Commissioner to be notified of certain personal data breaches.
I move on to government Amendments 10 and 11. Amendment 11 adds Scottish Ministers to the list of parties, at Clause 9(5), who are to be notified by the Investigatory Powers Commissioner of the appointment of a temporary judicial commissioner. This must be as soon as practicable after any temporary judicial commissioner has been appointed. This will ensure that Scottish Ministers are kept abreast of crucial developments in the investigatory powers oversight regime. A similar requirement already exists in the Bill, which requires the IPC to notify certain persons, including the Secretary of State and the Lord President of the Court of Session, of an appointment of a temporary judicial commissioner.
Government Amendment 10 to Clause 8 allows the Investigatory Powers Commissioner to delegate to deputy Investigatory Powers Commissioners the power to approve decisions following the review of a notice. This brings this function in line with the commissioner’s other functions in the Act with regards to delegation and, as with those powers, allows for delegation in only when the commissioner is unavailable or unable.
I turn now to government Amendments 13 and 14, both of which concern communications data, which I will refer to as CD. Government Amendment 13 clarifies the extent of Clause 11 to ensure that its scope is not wider than intended. Section 11 of the IPA creates the offence of acquiring CD from a telecommunications operator without lawful authority. Clause 11 seeks to carve out from the scope of Section 11 the sharing of CD between public authorities, where one of those authorities was a telecommunications operator.
This amendment to Clause 11 ensures that the public authority carve-out from the Section 11 IPA offence of acquiring CD without lawful authority does not go wider than intended. The new definition is based on the definition of public authority in the Procurement Act 2023. The previous definition was based on the definition of public authority in the Human Rights Act 1998. This latter definition could, in some circumstances, have created doubt over whether it included certain private sector telecommunications operators.
This amendment removes that doubt and clarifies that the public authority carve-out will apply only to telecommunications operators wholly or mainly funded by public funds—in other words, they are public authorities themselves. The IPA was designed to ensure that the acquisition of CD from private sector tele- communications operators for the statutory purposes set out in the Act was subject to independent oversight to safeguard against abuse. This amendment maintains this important safeguard in relation to private sector telecommunications operators.
I turn to government Amendment 14. It is critical that the legislation is absolutely clear on what constitutes CD and the lawful basis for its acquisition. Without this clarity, we risk placing CD that is crucial to investigators out of their reach. Government Amendment 14 therefore seeks to clarify that subscriber data used to identify an entity will be classed as CD.
This amendment is necessary as the existing Act creates a carve-out in the definition of CD to ensure that the content of a communication cannot be acquired under a Part 3 acquisition request. This reflects Parliament’s view during the initial passage of the IPA 2016 that the content of a communication is inherently more sensitive than the underpinning metadata: the “who”, “where”, “when”, “how” and “with whom” of a communication. Clause 12 amends the definition of CD in Section 261 of the Act to exclude certain types of data from the carve-out of content from the definition of CD. The effect of this is to include those data types within the definition of CD.
Government Amendment 14 restricts the effect of Clause 12 to ensure that it is not overly broad and cannot be applied to bring unintended, inappropriate types of data within the definition of CD. For example, the amendment will put beyond doubt that the content of recorded calls to contact centres or voicemails is not in scope of the amended CD definition and will not be accessible with an authorisation under Part 3 of the Act. The amendment to Section 261 does not affect the oversight function of the Investigatory Powers Commissioner’s Office, which continues to inspect and highlight any errors and provide prior independent authorisation for the acquisition of CD in most cases.
I hope I have convinced noble Lords of the necessity of these government amendments; I ask that they support them. I also hope that these amendments provide reassurance to noble Lords, ahead of the debate on this group, of the Government’s commitment to ensuring that the clauses in Part 3 are drafted as tightly as possible and with a proportionately narrow scope.
Lord Anderson of Ipswich (CB)
My Lords, I know that the noble Lord, Lord West, will want to speak to his own amendments, but, perhaps for the sake of good order, I could comment relatively briefly on government Amendment 14 before he does so.
I entirely accept what is said in the explanatory statement, that the amendment is intended to ensure that “unwanted cases” are not brought
“within the definition of ‘communications data’ in section 261 of the Investigatory Powers Act 2016”.
That is a good objective, and I applaud the sentiment behind it. I also accept that the amendment may well be an improvement on the original Clause 12. My concern is that the wording used at the end of the amendment may inadvertently leave that definition broader than it should be, putting within the definition of “communications data” material that should plainly be classed as content.
Proposed new subsection 5B(b) is intended to limit the categories of content defined in new paragraph (a) which are classed as “relevant subscriber data” and thus as communications data. Instead of defining subscriber data tightly, by reference to information identifying an entity or the location of an entity, which would be reasonable, the limiting words in new paragraph (b) provide, more loosely, that it should be
“about an entity to which that telecommunications service is … provided”.
That is a wide formulation indeed if you apply it to something such as Facebook or an online dating site. The information that customers may be required to provide to initiate or maintain their access to such services is likely to be very much broader than simply who and where they are. For example, I have it on the best authority that, in the case of a dating site, this information may, for example, include a full online dating profile, which sounds very like content to me. It would be most unfortunate if the wording of new paragraph (b) were to result in an interpretation of this clause—for example, by police reading it in good faith—than was far broader than was intended.
I offer more than the conventional gratitude to the Bill team, who have engaged with me intensively on this issue in an extremely short timescale. It is too late to seek an amendment to Amendment 14, but the Minister would help us and law enforcement out if he could confirm, perhaps in response to this intervention or in his own time, that the aim of Clause 12 in its amended form is to class as communications data only information which is truly needed to obtain or maintain access to a telecommunications service—traditional subscriber data such as name, location and bank details—and that there is no intention to cover information provided as part of using the service, such as the online dating profile that you might be asked to fill out to operate or fully activate an account.
Lord West of Spithead (Lab)
My Lords, I rise to speak to Amendments 15 to 20. In Committee, I moved amendments seeking to remove Clause 13 and its associated schedule. This was to retain the current arrangements, which wisely restrict a number of public authorities from being able to compel the disclosure of communications data from telecommunications operations. Parliament restricted this power in the original legislation because it considered it to be potentially very intrusive.
What this means is that, at present, authorities such as the Environment Agency or the Health and Safety Executive are required to take further procedural steps to compel disclosure of communications data. They must obtain an authorisation under the current IPA, a court order or other judicial authorisation, or under regulatory powers in relation to telecommunications or postal operators, or they must obtain the communications data as the secondary data as part of a valid interception or equipment interference warrant.
The Bill seeks to remove that requirement for further procedural steps in relation to a wide range of public regulatory authorities. The Government’s argument for removing these restrictions is that a broader array of communications now fall into the category of communications data and a wider number of organisations now constitute telecommunications operators. As a result, the current restrictions prevent some regulatory authorities from acquiring the information necessary to exercise their statutory functions in a way that was not anticipated at the time of the original legislation.
These organisations have argued that this is particularly relevant to bodies with a recognised regulatory or supervisory function which would collect communications data as part of their lawful function but are restricted under the current Act if their collection is not in service of a criminal investigation; in particular, the changes focused on improving the position of certain public authorities responsible for tax and financial regulation, the powers of which were removed in 2018 as a result of rulings by the European Court of Justice. The ISC recognises that such bodies much be able to perform their statutory function effectively; however, we have been told that the Bill delivers only the urgent, targeted changes needed, and we have not thus far been presented with the case for that.
This was a highly scrutinised issue during the passage of the original Act. Parliament rightly ensured that the power to gather communications data was tied to national security and serious crime purposes only, to avoid impinging on the right to privacy without very good reason. We should not lightly brush that aside.
There have been a number of reported incidents of the intrusive use of investigatory powers by local councils and other public authorities for purposes that are subsequently deemed neither necessary nor proportionate; for example, things such as dog mess. The Minister said in Committee that the clause
“applies to a relatively small cadre of public authorities in support of specific regulatory and supervisory functions”.
Yet in response to my question on which bodies would see their powers restored, he said that
“it is not possible to say with certainty how many public authorities have some form of regulatory responsibilities for which they may require data that would now meet the definition of ‘communications data’”.—[Official Report, 11/12/23; col. 1759.]
How can it be right to expect Parliament to reintroduce sweeping powers for a wide range of public bodies when a previous Parliament deemed that that was too intrusive—and when we cannot even be told which bodies they will be? Noble Lords will need to be sufficiently satisfied that these powers are to be given to bodies that cannot function without them; this cannot be a case of just giving powers back by default. I urge the Minister to consider this further. As it stands, we have not been given the information, or a convincing case, to persuade Parliament of the need for such a complete about-turn. The ISC will continue to pursue this amendment unless robust assurance can be provided that these powers will be restored in a sufficiently limited and targeted way.
Amendment 17 and its two consequential amendments seek to remove the ability of the agencies to internally authorise the use of this new, broader power to obtain internet connection records for target discovery. My amendment would require the agencies to seek approval from IPCO, thereby ensuring proper oversight. As I noted in Committee, Clause 14 creates a new, broader power for the agencies and the NCA to obtain ICRs for the purpose of target discovery. It represents a significant change from the current position because it removes the current requirement that the exact service used, and the precise time of use, be known. Under these new provisions, the agencies will be able to obtain ICRs to identify which person or apparatus used internet services in a period of time—a far broader formulation that will capture a far broader number of individuals.
As I also noted previously, the ISC agrees with broadening the power; what it does not agree with is that there is no oversight of it. The principle remains that increased powers must mean increased oversight. This new, expanded power is potentially very intrusive: it allows the agencies to obtain ICRs from a range of internet services over a potentially long period of time, and they could therefore potentially intrude on a large number of innocent people who would not have been captured previously.
It is essential in a democracy that there are appropriate safeguards on such powers, but in all cases relating to national security and economic well-being, the agencies are able to authorise use of this newly expanded, broader power internally. They make the assessment as to whether it is necessary and proportionate; there is no independent oversight of the agencies’ assessment. The Minister argued in Committee that the ISC amendment inserts a disproportionate limitation on the agencies’ ability to use condition D, as the Government
“do not assess that the new condition creates a significantly higher level of intrusion”.—[Official Report, 11/12/23; col. 1761.]
With respect, the ISC not only disagrees with this assessment but finds it incomprehensible. This is about depth and breadth. The new condition D may not represent a new depth of intrusion as ICR requests under the new regime will still return the same type of information, but it certainly represents a much wider breadth of intrusion as a far greater number of innocent internet users’ details will be scooped up by these ICR requests.
The Government may argue that, because those individuals’ details will not be retained once they have been checked and found not to be of intelligence interest, this is therefore not an intrusive power. Again, with respect, this is not an answer that Parliament or indeed the public can or should be satisfied with. I doubt any individual would feel that their privacy had not been intruded on if they had been scooped up just because they had not been retained, particularly when the retention of details is currently contingent entirely on the judgment of the agencies themselves, with no external input on whether the judgment is proportionate. The ISC very firmly believes that the new condition is more intrusive, and therefore greater oversight is required to ensure the power is always used appropriately.
Oversight will act as a counterbalance to the intelligence community’s intrusive powers and provide vital assurance to Parliament and the public. This amendment and my two linked amendments therefore remove the ability of the agencies to authorise use of this power internally. The agencies would instead be required to seek the approval of an independent judicial commissioner from IPCO to authorise the obtaining of ICRs under this new, broader power. This strikes the right balance between security and privacy and minimises any burden on the agencies.
I move on to Amendment 18 in relation to the new same broader target discovery power in Clause 14. This amendment is to limit the purposes for which this new power would be used. As I outlined previously, target discovery has the potential to be a great deal more intrusive than target development as it will inevitably scoop up information of many who are of no intelligence interest. This is why we must tread very cautiously in this area and be quite satisfied of the need for the power, that the power is tightly drawn and limited, and is properly overseen.
The ISC agrees with the noble Lord, Lord Anderson, who, in his excellent report reviewing the Government’s proposal for this Bill, supported the need for this change. The ISC has considered the classified evidence and recognises that due to technological changes the current power is less useful than envisaged due to the absolute precision it requires. However, as this House also recognised, Parliament deliberately imposed a high bar for authorising obtaining internet connection records, given their potential intrusiveness.
The noble Lord, Lord Anderson, also recommended, therefore, that the purposes for which this new broader target discovery power could be used be limited to national security and serious crime only, and that use of it should be limited to the intelligence community. However, the Bill as drafted departs from his recommendations in both respects. Not only does it include the National Crime Agency as well as the intelligence community, but it allows the intelligence community to use the new, broader target discovery power for a third, far less-defined purpose of:
“the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security”.
In Committee, the Government argued that this decision had been taken because it is consistent with the statutory functions of the agencies and Article 8 of the European Convention on Human Rights. That is, of course, true. It is consistent, but that is not an argument in favour of simply transporting it here. Not every intrusive power should be available for every purpose that the security services have. Given the potential intrusiveness of this new power, it must be constrained appropriately and the purposes for which it can be used must be crystal clear.
However, what is not yet at all clear is exactly what critical work must be enabled under the umbrella of “economic well-being” as it relates to “national security” which is not already captured under the straightforward national security category. It must be clear exactly what harm would occur if this purpose were not included in the Bill. At the moment, the addition of “economic well-being” serves only to blur the lines between what an ICR can or cannot be used for, something which Parliament should not accept. Therefore, in addition to requiring independent judicial oversight, which is the subject of a separate amendment, this amendment seeks to prevent the agencies from using this newly expanded power for the purposes of economic well-being relating to national security. This will ensure that the rather vague concept of economic well-being is not being used as a catch-all justification for the exercise of these powers.
The agencies will of course still be able to use this power in relation to national security more broadly, and in urgent cases of serious crime. This is proportionate and indeed more in line with the recommendations of the noble Lord, Lord Anderson. Unless the Minister can provide the House with information as to exactly why it is critical to retain economic well-being for the use of these specific powers, not the agency’s powers more broadly, I urge noble Lords to support my amendment and strike this from the Bill.
Lord Fox (LD)
I shall be brief. Not for the first time, your Lordships are in debt to the noble Lord, Lord Anderson, for intervening on an issue that I think all of us failed to note. His request of the Minister is helpful, and I hope the Minister will be able to respond. There is an alternative process which I could suggest to the Minister—I have not had a chance to talk to the noble Lord, Lord Coaker, about this. If the Minister wanted to withdraw this amendment and bring it back at Third Reading, which is applicable in certain circumstances. I am sure we would be very flexible in permitting that as well.
Lord Ponsonby of Shulbrede (Lab)
My Lords, we support the introduction of the Government’s amendments. I echo what the noble Lord, Lord Fox, said about the amendment in the name of the noble Lord, Lord Anderson, and I look forward to the Government’s response on that point.
I would also be interested to hear what the Government have to say about my noble friend Lord West’s amendments. He has taken a keen interest in this part of the Bill, and I hope the Government will be able to answer the questions, in particular on data disclosure powers, as I think they can give a more detailed response to the expansion of disclosure powers to regulatory bodies than was given in the original legislation. It is also very likely to be further analysed and looked at as the Bill moves down to the other end of the Corridor. Nevertheless, we support the amendments as they are currently.
Lord Sharpe of Epsom (Con)
My Lords, I thank noble Lords for this short debate and the scrutiny on these important issues. First, I will address Amendments 15 and 16 tabled by the noble Lord, Lord West of Spithead, which seek to remove Clause 13 and the Schedule from the Bill. We have covered some of the same ground as we did in Committee, and I am afraid that much of my response will make similar points to those I made then. However, I can appreciate why he has raised the points he made about these provisions, and I hope that I can still provide him with assurance on why these measures are needed and proportionate.
As the Government have been clear, the purpose of Clause 13 is to ensure that bodies with regulatory or supervisory functions are not inhibited from performing the roles expected of them by Parliament. It restores their pre-existing statutory powers to acquire CD in support of those functions. When the IPA was passed in 2016—under the expert stewardship of the noble Lord’s fellow ISC member in the other place, the right honourable Member for South Holland and The Deepings—it made specific provision, at Section 61(7)(f) and (j) respectively, for the acquisition of CD for the purposes of taxation and oversight of financial services, markets and financial stability. The noble Lord and his fellow committee members have queried whether we are “unmaking” these measures in the 2016 Act through Clause 13 of the Bill. I would therefore like to put beyond doubt what has happened since then to lead us to this point of needing to refine rather than unmake these provisions.
Following the Tele2 and Watson judgment from the Court of Justice of the European Union in 2016, the Government took the opportunity to streamline the statute book, including but not limited to some changes in response to that judgment. This streamlining included the removal of the regulatory provisions contained in the IPA because, at that time, those public authorities with regulatory or supervisory functions were able to acquire the data they needed using their own information-gathering powers, and Section 12 of the IPA had not yet been commenced, removing many of those powers. The relevant data was outside of the provisions of the IPA at this time and therefore not considered to come within the definition of CD.
Since then, businesses have operated their services more and more online. This has meant that many have become, in part at least, telecommunications operators as defined by the IPA. As a consequence, growing amounts of the data that they collect—which regulatory and supervisory bodies would have previously been able to access using their own information-gathering powers—now fall within the IPA’s definition of CD. The effect of this is that public authorities are increasingly unable to acquire the CD that they need to perform their statutory civil or regulatory functions.
In summary, the IPA has been changed since it was commenced in 2016 to remove tax-related and financial stability-related powers to acquire CD and to introduce the serious crime threshold. Technology and society have moved on, with the result that more relevant data amounts to CD. Section 12 of the IPA has been commenced to remove general information powers. The combination of these changes has meant that public authorities are experiencing increased difficulty in carrying out their statutory functions. For example, the Financial Conduct Authority, His Majesty’s Revenue & Customs and the Treasury are all examples of public authorities that already have the power to acquire CD using a Part 3 request but that may be unable to do so in the exercise of some of their functions as a result of the issue I have just set out.
These bodies perform a range of vital statutory functions using CD, including tackling breaches of sanctions regimes, enforcing the minimum wage and providing oversight of banking and financial markets. Schedule 4 to the IPA provides a list of public authorities that can acquire CD under Part 3 of the Act. The new definition of public authorities inserted by this clause will apply in the context of the sharing of CD between public authorities. This will include government departments and their arm’s-length bodies, and executive agencies administering public services. While data sharing between government entities is covered under other legislation including the Data Protection Act and GDPR, or under separate data-sharing agreements, its sharing for legitimate purposes should not be discouraged or prevented by the IPA.
Clause 13 is needed to ensure that such bodies can continue to fulfil these existing statutory duties in the context of a world that takes place increasingly online. It strikes an appropriate balance between necessity and proportionality. In particular, I re-emphasise that it makes clear that the acquisition by these regulatory bodies should be only in support of their civil and regulatory functions, and not used in support of criminal prosecutions. Furthermore, the Government have retained the serious crime threshold that applies when acquiring CD for the purposes of a criminal prosecution.
The codes of practice will also provide additional safeguards and clarity on how this should work in practice. The Government published these in draft ahead of Committee to illustrate this. Any changes to the existing codes will be subject to statutory consultation before being made and will require approval from Parliament under the affirmative procedure. I am therefore confident that the changes will be subject to a high level of scrutiny. To be clear, this applies to a limited cadre of public authorities with the necessary statutory powers conferred on them by Parliament and only specifically when in support of regulatory and supervisory functions—it is not creating a way to circumvent the safeguards in the IPA. It ensures that the acquisition routes and associated strong oversight by the Investigatory Powers Commissioner are reserved for those areas where it is most essential and has the most serious potential consequences in terms of criminal prosecutions.
I am happy to provide the reassurance—or I hope I am—that the noble Lord, Lord Anderson, sought. I am grateful to him for his comments regarding government Amendment 14, for engaging with officials to work through the concerns they raised and for his generous comments about the officials.
Our view is that the amended Clause 12 will be narrower in scope than the original drafting, which carried a risk of permitting access beyond the “who” and “where” of an entity. I assure noble Lords that the codes of practice will set out the further safeguards and details on the practical effect of Clause 12 so that operational partners are clear on the lawful basis of CD acquisition. It is appropriate that the technical detail is set out in this way rather than in primary legislation. The codes of practice will be subject to a full public consultation and will be laid in Parliament under cover of an SI, via the affirmative procedure. I reassure the noble Lord that we will consult with partners and the regulators of the IPA to ensure that the high standards of the CD acquisition regime remain world leading. I am happy to continue this conversation, and for my officials to continue with the extensive engagement already undertaken with the users of the CD powers, to see whether any further refinement is needed.
Finally, I confirm that the intention behind the amendment is to include the type of subscriber data that is necessary to register for, or maintain access to, an online account or telecommunication service. Examples of such data would include name, address and email address. It is not intended to include all types of data that an individual might give a telecommunication service that is not necessary for the purpose of maintaining or initiating access to that service.
I turn to Amendments 17, 19 and 20 on internet connection records, also tabled by the noble Lord, Lord West. Much of the argument I have heard relies on a perception that the new condition D is inherently more intrusive than the existing conditions B and C. I will set out why this is not the case.
The safeguards for the new condition D replicate the well-established and extensive safeguards already in place for CD authorisations. The authorisation process for CD varies according to the purpose for which the data is being sought and the type of CD to be acquired. This regime works effectively and has been considered by the Court of Appeal and found to be lawful.
The purpose of new condition D is to enable ICRs to be used for target detection, which is currently not possible under existing Part 3 authorisations. The level of appropriate oversight and safeguards is linked to the sensitivity of the data to be disclosed and the impact that disclosure may have on the subject of interest.
As I have said, the Government do not believe that condition D is inherently more intrusive than conditions B or C. Conditions B and C authorise “target development” work, and as such enable the applicant to request data on a known individual’s internet connections. As an example, this means that the NCA could request records of the connections a known subject of interest has made in a given time period, provided that request was judged to be both necessary and proportionate by the Office for Communications Data Authorisations. In comparison, condition A enables the requesting agency to request who or what device has made a specific connection to an internet service.
Similarly, condition D would enable an agency to request details about who has used one or more specified internet services in a specified timeframe, provided it was necessary and proportionate—for example, accessing a website that solely provides child sexual abuse imagery. The actual data returned with condition D will most likely constitute a list of IP addresses or customer names and addresses. No information concerning any wider browsing that those individuals may have conducted will be provided. Information about that wider activity would be available only under a further condition B or C authorisation. Condition D is therefore no more intrusive than conditions B and C in terms of what data is actually disclosed. As such, we see no benefit or logic to imposing a different authorisation route for condition D when the existing safeguards have proven sufficient in terms of ICRs applications under conditions A, B and C.
I use this opportunity to remind all noble Lords of the importance of this new condition D and how it will support investigations into some of the most serious crimes, as well as supporting the critical work against both state and cyber threats. ICRs could be used to detect foreign state cyber activity. For examples, ICRs could be used to illuminate connections between overseas state actors and likely compromised UK infra- structure. We understand that these actors have an intent to target UK-based individuals and organisations, including government and critical national infrastructure, from within UK infrastructure, which we typically would not see. The ICR data returned from TOs would be highly indicative of the extent of malicious infrastructure and could assist with victim exposure. Furthermore, improved access to ICR data would enable the National Cyber Security Centre to detect such activity more effectively and in turn inform incident management and victims of compromises. Using data to flag suspicious behaviour in this way can lead to action to protect potential UK victims of foreign espionage and attacks.
I now turn specifically to the ability of the intelligence agencies and the NCA to internally authorise condition D applications. The intelligence agencies and the NCA must obtain approval from the Investigatory Powers Commissioner for ICR applications for the purpose of preventing or detecting serious crime, other than in urgent circumstances. In urgent circumstances, such as threat to life or serious harm to an individual, the intelligence agencies and the NCA are able to obtain CD authorisations from internal designated senior officers in the same way that police forces are. In practice, the volumes of non-urgent requests are such that the IPC delegates responsibility for the authorisation of ICR and other CD requests to the OCDA.
In terms of oversight, the IPC could, if he wished to, consider specific types of CD authorisations himself. The IPC also has the power to directly inspect any part of the CD regime. If he wishes to focus attention on condition D applications, he has the necessary powers to do so. The approach we have adopted for condition D authorisations is therefore consistent with the wider CD regime and gives the IPC flexibility in how he exercises his powers and resources.
As is also consistent with the wider CD regime, condition D applications relating to national security will be authorised by a designated senior officer within the intelligence agencies. The CD codes of practice state that the designated senior officer must be independent of the operation and not in the line management chain of the applicant. This independence is declared within each application, and each designated senior officer completes training prior to taking up this role. Furthermore, each agency has one or more single point of contact officer, accredited by the Home Office and the College of Policing, who facilitates lawful acquisition of CD.
Lord Fox
Member's explanatory statement
This amendment specifies that enforcement of retention notices applies only to UK recipients of such notices.
Lord Fox (LD)
My Lords, I will move Amendment 21 and speak to the other amendments in this group in my name.
Amendment 21 specifies that the enforcement of retention notices applies only to UK recipients of such notices. It is one of a suite of amendments in this group that return to the issue of extra-territoriality— I see the Minister blow out his cheeks at the prospect. Amendments 22, 25, 28 and 31 are similarly directed and each largely seeks to limit extra-territoriality by ensuring that operators can make changes to their services for users outside UK jurisdiction.
The reason for tabling the amendments, the others of which I will not move, is that there remains a huge gulf of understanding between the tech companies and the Government when it comes to the interpretation of the Bill with respect to its territorial reach. I am again presenting the Minister with a golden opportunity to set out in clear language the territorial ambitions that the Government have for this Bill. I believe there is some element of miscommunication going on here, though I am not sure in which direction. I hope that the Minister can dispel that.
Clearly, we have international tech companies that are incorporated in another country with subsidiaries all around the world and data residing in many different domains—companies that offer services to customers all over the world. In essence, we need to understand what would happen as a result of this Bill if such a business proposed to change a global service that is used by consumers all over the world, including in the UK. How do the Government use this Bill to deal with such situations? I am looking forward to the response.
Amendments 23, 24, 29 and 30 would raise the threshold for calling in a change from “negative effect” to “substantially limit”. Again, this increases the bar before the Government can start the process. Negative effect is a very low bar which will catch almost everything. It is not in the interests of the authorities to have everything coming through. There needs to be some sense of funnel. This is an opportunity for the Minister to define what negative effect is and what it is not, because it is a very low bar. He would be wise to take our advice and look at the language there, certainly when it comes to the code coming later.
Moving on, my Amendment 27 is a retread of an amendment I tabled in Committee, and it was there as a placeholder. I am pleased to see that it is unnecessary, as government Amendments 26 and 32 very much embrace the spirit of what I was seeking to achieve in that amendment. I thank the Minister for responding, and therefore will not be speaking to or indeed moving Amendment 27.
I now turn to Amendment 35. Currently, while there is a requirement for the Secretary of State to consult the operator before giving notice, there is no requirement on the Secretary of State to consult ahead of making regulations that will specify what “relevant change” includes, and therefore what needs to be notified. My Amendment 35 therefore introduces a requirement for pre-legislative consultation on the definition of “relevant change”. The amendment specifies that the Secretary of State must consult the Technical Advisory Board. There is a precedent for consultation with this board in Section 253(6) of the 2016 Act. As your Lordships know, the Technical Advisory Board is comprised of independent and industry representatives; the amendment also specifies a wider range of consultees.
The amendment then requires the Secretary of State to have regard to the impact on users, including on their privacy and on operators’ ability to innovate. Again, there is precedent for this in the 2016 Act. Such considerations must be taken into account when a public authority is deciding whether to issue a TCN or NSN, or where a judicial commissioner approves a DRN. As such, we feel it is worth while also to consider these factors when legislating for a “relevant change”, because delaying a critical security update could negatively impact users and operators. In a sense, all we are asking for is consultation. We are not asking to change the law, and this gives the Government a power to abide by that consultation or not. But we feel that this is an important definition, and it needs to be more widely consulted on.
I hope the Minister will agree, but in the event that he declines, I will be moving Amendment 35. I beg to move Amendment 21.
Lord Ponsonby of Shulbrede (Lab)
My Lords, we have had much welcome interaction from stakeholders on the issues summarised in this group, as well as some useful briefings from the Home Office and the noble Lord’s team, for which we are grateful.
As the noble Lord, Lord Fox, has just said, there appears to be a gulf in both position and understanding between the Government and the tech companies, both on the principle of the notice and its details, which is, in a sense, frustrating scrutiny of the Bill. I understand that there is a disagreement about the introduction of notification notices in general. It is right that we look at the details to ensure that the process takes place in a way that reflects the realities of international law, and the need of the intelligence services to maintain levels of data access and the necessary safeguards.
Concerns raised by stakeholders keep striking at the same places: how this notice would work with access agreements with other countries; why there is no double lock on the notification notice, despite the clear impact it would have on tech companies’ activities; and why the definition of telecoms operator is perhaps in reality wider than the Government intend.
We will not be supporting Amendment 35, in the name of the noble Lord, Lord Fox, although we understand the intent behind it. We encourage the Government to keep talking to stakeholders, and we believe that this part of the Bill will benefit from further discussion in the other place.
Lord Sharpe of Epsom (Con)
My Lords, I thank the noble Lords, Lord Ponsonby and Lord Fox, for their remarks in this debate. I reassure the noble Lord, Lord Fox, that any cheek-blowing he witnessed was more a reflection of the previous marathon speech than a reflection on his amendments.
Amendment 21, moved by the noble Lord, Lord Fox, would require that the enforcement of data retention notices—DRNs—would apply only to UK recipients of those notices. DRNs and technical capability notices—TCNs—can be given to a person overseas, but only TCNs are currently enforceable overseas. Clause 16 seeks to amend Sections 95 and 97 of the IPA to allow the extraterritorial enforcement of DRNs in order to strengthen operational agility when addressing emerging technology, bringing them in line with TCNs. It is vital to have this further legal lever, if needed, to maintain the capabilities that the intelligence agencies need to access the communications data they need to, in the interests of national security and to tackle serious crime.
The Government therefore oppose Amendment 21 as it goes fundamentally against what the Government are seeking to achieve through Clause 16 and would not provide any additional clarity to telecommunications operators. As DRNs are already enforceable against UK recipients, there is no need to re-emphasise that in the Bill.
I turn to the amendments to Clause 17 concerning the notice review period. This clause is vital to ensure that operators do not make changes that would negatively impact existing lawful access while a notice is being comprehensively reviewed. Maintaining lawful access is critical to safeguard public safety, enabling law enforcement and the intelligence community to continue protecting citizens during the review period.
Let me be clear: operators will not be required to make changes during the review period to specifically comply with the notice. Rather, under Clause 17 they will be required to maintain the status quo so that law enforcement and intelligence agencies do not lose access to any data that they would have been able to access previously. The review process is an important safeguard, and that right of appeal will remain available to companies.
On Amendment 27, tabled by the noble Lord, Lord Fox, the Government have noted the strength of feeling from parliamentarians and industry regarding the current uncertainty over the timeframe for conducting a review of a notice. We have therefore tabled Amendments 26, 32 and 33 to Clause 17 to address that uncertainty and provide further clarity and assurances regarding the notice review process.
The existing powers within Sections 90 and 257 of the IPA do not give the Secretary of State the power to specify in regulations the time period within which a review of a notice must be completed. The Government are therefore introducing a new regulation-making power to enable the Secretary of State to specify in regulations the length of time the Secretary of State can take to reach a decision on the review of a notice upon receipt of the report by the judicial commissioner and the Technical Advisory Board, and the overall length of time that a review can take.
The amendments will also make provision for a judicial commissioner to issue directions to the Secretary of State and the person seeking the review, as they see fit, to ensure the effective management of the review process. That will give the judicial commissioner the power to issue directions to both parties, specifying the time period for providing their evidence or making representations, and the power to disregard any submissions outside those timelines. These amendments will provide operators the certainty they require regarding how long a review of a notice can last, and therefore how long the status quo must be maintained under Clause 17. They will also provide further clarity on the process and management of that review.
Specifying timelines will require an amendment to the existing regulations concerning the review of notices. The Government commit to holding a full public consultation before the amendment of those regulations and the laying of new regulations relating to Clause 20, which provides for the introduction of the notification notices. Representations received in response will be considered and used to inform both sets of regulations, which we have clarified in the Bill are subject to the affirmative procedure.
Amendment 35, tabled by the noble Lord, Lord Fox, seeks to specify in statute who the Secretary of State must consult before laying regulations relating to Clause 20 and the introduction of notification notices, and the factors that the Secretary of State must have regard to when making those regulations. I hope the commitment that I have just made to hold a full public consultation provides the necessary reassurance to the noble Lord that all relevant persons will be consulted before making the regulations, and that he will agree that is it unnecessarily prescriptive, and potentially restrictive, to put such details in the Bill.
Amendments 22, 25, 28 and 31, also tabled by the noble Lord, Lord Fox, seek to limit the extraterritoriality of Clause 17 and ensure that operators can make changes to their services and systems for users in other jurisdictions during a review. To be clear, the Bill as currently drafted means that companies can make changes to their services during a review. They could choose to roll out new technologies and services while the review is ongoing, including in other jurisdictions, so long as lawful access is built into them as required to maintain the status quo. Furthermore, the status quo will apply only to whichever of their systems and services are covered by the notice in question. Naturally, anything outside the scope of the notice is unaffected by the requirement. I also emphasise that the control of telecommunications systems used to provide telecommunications services in the UK does not stop at borders, and it is highly likely that any such arbitrary geographical limitations would in fact be unworkable in practice.
Amendments 23, 24 and 29 seek to raise the threshold with regard to relevant changes that an operator must not make during a review period to a change that would “substantially limit” their ability to maintain lawful access. This would not make the position any clearer as “substantially” is a subjective test. Moreover, it would constrain Clause 17 in a way that would fundamentally prevent it from achieving its objectives: to ensure that the same level of lawful access available before the notice was issued is maintained during a review period.
Lawful access provides critical data to law enforcement and intelligence agencies. Constraining access to data that was previously available, in a limited capacity or substantially, may seriously undermine investigations and the ability to protect our citizens. It is therefore vital that the status quo is maintained during the review period. It would also be difficult to define “substantially limit” without referring to a “negative effect on” a capability.
Amendments 36 to 38 to Clause 20, also spoken to by the noble Lord, Lord Fox, seek to raise the threshold and provide more proportionality. As I have emphasised on every occasion we have debated the Bill, necessity and proportionality constitute a critical safeguard that underpins the IPA. Authorisations are approved by an independent body and all warrants and notices must be approved by a judicial commissioner. There is considerable oversight of authorisations, meaning that the threshold is already high. Necessity and proportionality justifications are considered for every request for a notice, warrant or authorisation and, by extension, whether it is reasonable to issue that request to the operator. Once operators are in receipt of such a request, they are required to provide assistance. The proposed amendments are therefore not required.
Finally, government Amendment 34 is a consequential amendment necessitated by the introduction of Clause 19, which amends the functions of a judicial commissioner to include whether to approve the renewal of certain notices.
I am grateful to all noble Lords who have spoken in this debate—
Lord Fox (LD)
Before the Minister sits down, winding back to the point about territoriality, he spoke of national boundaries as being arbitrary. It would help me to understand what kind of activity the Government envisage reaching across those boundaries, which he refers to as arbitrary; in other words, what would the Government be seeking to do extraterritorially?
Lord Sharpe of Epsom (Con)
If it would help, I am happy to write to the noble Lord with some sensible and practical scenarios because I do not think it is appropriate to make them up at the Dispatch Box, if that is acceptable.
I was just about to thank the noble Lord for the time he has taken to talk me through his concerns ahead of Report and at various other stages of the Bill on various other issues. However, I hope that I have provided reassurances through my comments at the Dispatch Box and the government amendments that we have tabled. I therefore invite the House to support these amendments and invite the noble Lord to withdraw Amendment 21 and not move the others he has tabled.
Lord Sharpe of Epsom
“(b) in subsection (5)—(i) after “must” insert “, before the end of the review period,”;(ii) after “(1)” insert “(and accordingly decide what action to take under subsection (10))”;(c) after subsection (5) insert—“(5A) In subsection (5) “the review period” means—(a) such period as may be provided for by regulations made by the Secretary of State, or(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (14)), such extended period.”(d) after subsection (9) insert—“(9A) The Commissioner may give a direction to the operator concerned or the Secretary of State specifying the period within which the operator or the Secretary of State (as the case may be) may provide evidence, or make representations, in accordance with subsection (9)(a).(9B) If the Commissioner gives such a direction to the operator or the Secretary of State, the Board and the Commissioner are not required to take into account any evidence provided, or representations made, by the operator or the Secretary of State (as the case may be) after the end of that period.”;(e) in subsection (10)—(i) for “may” substitute “must”;(ii) after “Commissioner” insert “but before the end of the relevant period, decide whether to”;(f) after subsection (11) insert—“(11A) In subsection (10) “the relevant period” means—(a) such period as may be provided for by regulations made by the Secretary of State, or (b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (15)), such extended period.”(g) after subsection (13) insert—“(14) Regulations under subsection (5A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State where the extension is agreed by the Secretary of State, the telecommunications operator concerned and a Judicial Commissioner.(15) Regulations under subsection (11A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State—(a) where the Secretary of State considers that there are exceptional circumstances that justify the extension, or(b) in any other circumstances specified in the regulations.(16) Where regulations under subsection (11A)(a) include provision mentioned in subsection (15), the regulations must also include provision requiring the Secretary of State to notify a Judicial Commissioner and the telecommunications operator concerned of the duration of any extended period.””Member's explanatory statement
This amendment enables the Secretary of State to make regulations, and a Judicial Commissioner to give a direction, setting time limits in connection with reviews carried out under section 90 of the Investigatory Powers Act 2016 (review of retention notices).
Lord Sharpe of Epsom
“(b) in subsection (4)—(i) after “must” insert “, before the end of the review period,”;(ii) after “(1)” insert “(and accordingly decide what action to take under subsection (9))”;(c) after subsection (4) insert—“(4A) In subsection (4) “the review period” means—(a) such period as may be provided for by regulations made by the Secretary of State, or(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (13)), such extended period.”(d) after subsection (8) insert—“(8A) The Commissioner may give a direction to the person concerned or the Secretary of State specifying the period within which the person or the Secretary of State (as the case may be) may provide evidence, or make representations, in accordance with subsection (8)(a).(8B) If the Commissioner gives such a direction to the person or the Secretary of State, the Board and the Commissioner are not required to take into account any evidence provided, or representations made, by the person or the Secretary of State (as the case may be) after the end of that period.”;(e) in subsection (9)—(i) for “may” substitute “must”;(ii) after “Commissioner” insert “but before the end of the relevant period, decide whether to”; (f) after subsection (10) insert—“(10A) In subsection (9) “the relevant period” means—(a) such period as may be provided for by regulations made by the Secretary of State, or(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (14)), such extended period.”(g) after subsection (12) insert—“(13) Regulations under subsection (4A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State where the extension is agreed by the Secretary of State, the person concerned and a Judicial Commissioner.(14) Regulations under subsection (10A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State—(a) where the Secretary of State considers that there are exceptional circumstances that justify the extension, or(b) in any other circumstances specified in the regulations.(15) Where regulations under subsection (10A)(a) include provision mentioned in subsection (14), the regulations must also include provision requiring the Secretary of State to notify a Judicial Commissioner and the person concerned of the duration of any extended period.””Member's explanatory statement
This amendment enables the Secretary of State to make regulations, and a Judicial Commissioner to give a direction, setting time limits in connection with reviews carried out under section 257 of the Investigatory Powers Act 2016 (review of national security and technical capability notices).
“(6) In section 267(3) (regulations: affirmative procedure)—(a) in paragraph (e), after “90(1)” insert “, (5A)(a) or (11A)(a)”;(b) in paragraph (j), after “257(1)” insert “, (4A)(a) or (10A)(a)”.”Member's explanatory statement
This amendment applies the affirmative procedure to regulations made under section 90(5A)(a) or (11A)(a) or 257(4A)(a) or (10A)(a) of the Investigatory Powers Act 2016 (time limits in connection with reviews of notices).
Lord Sharpe of Epsom
“(4A) In section 229 (main oversight functions), in subsection (8)(e)(i), for “or varying” substitute “, varying or renewal”.”Member's explanatory statement
This amendment is consequential on clause 19(4) and (6) (renewal of notices). It inserts into section 229 of the Investigatory Powers Act 2016 (main oversight functions) a reference to the Investigatory Powers Commissioner deciding whether to approve the renewal of certain notices.
“(3A) Before making regulations under this section the Secretary of State must consult the following persons—(a) the Technical Advisory Board;(b) persons appearing to the Secretary of State to be likely to be subject to any obligations specified in the regulations;(c) persons representing persons falling within paragraph (b); and(d) persons with statutory functions in relation to persons falling under that paragraph.(3B) When making regulations under this section the Secretary of State must have regard to—(a) the public interest in the integrity and security of telecommunications systems and postal services;(b) the impact on users arising from any delay to implementing relevant changes;(c) the desirability of encouraging innovation by relevant operators; and(d) any other aspects of the public interest in the protection of privacy.”Member's explanatory statement
This amendment, together with others in the name of Lord Fox, place a duty on the Secretary of State to consult with relevant persons before making regulations that will specify what a “relevant change” will include.
Lord Fox (LD)
I heard what the Minister said on Amendment 35, and it is reassuring that the consultation will be occurring, so I do not intend to move Amendment 35.
Lord West of Spithead
Member's explanatory statement
This amendment would specify that the only exceptional circumstances in which the Prime Minister would be permitted the use of a designate is when he or she is unable to make a decision due to incapacity (ill-health) or lack of access to secure communications.
Lord West of Spithead (Lab)
My Lords, this is the first of three amendments I have tabled in relation to Clause 21 and the so-called triple lock for targeted interception and targeted examination of communications relating to Members of relevant legislatures—that is, people like us and MPs et cetera. These changes are replicated in the three amendments I have tabled to Clause 22, which we shall come to later, which relate to the triple lock for targeted equipment interference warrants.
Noble Lords will, I am sure, agree that the communications of Members of relevant legislatures should not be intercepted and read unless it is absolutely essential to do so in the most serious of circumstances. That is why Parliament added a third layer of safeguards to the approval of any such warrant in the IPA. This ensures that these warrants would not only be issued by a Secretary of State and reviewed by a judicial commissioner but approved by the Prime Minister personally. This is a robust and necessary oversight mechanism, and it is essential that any changes as a result of this Bill do not undermine these three layers.
The ISC recognises that, on occasion, the requirement that a warrant be approved by the Prime Minister personally may affect the operations of the intelligence agencies where they are seeking a targeted interference warrant that is very time sensitive, and the Prime Minister is unavailable. We therefore support the intention to provide an element of resilience whereby, in truly exceptional circumstances, it may be appropriate for a Secretary of State to temporarily deputise for the Prime Minister on these matters. However, the clauses as drafted go too far.
My three amendments are designed to ensure that decisions are delegated only in the most exceptional circumstances; that the decision may be designated only to the limited number of Secretaries of State who are already responsible for authorising relevant warrants; and that the Prime Minister retains sight of all warrants relating to Members of a relevant legislature. The first of the three amendments relates to the circumstances in which a decision may be delegated by the Prime Minister to a Secretary of State. These circumstances must be very clearly specified—there can be no ambiguity —and they should be limited to situations in which the Prime Minister is genuinely unable to take a decision.
My amendment specifies that the Prime Minister must be “unable” to decide whether to give the necessary approvals, rather than simply “unavailable”, which is rather a subjective test. It then very clearly sets out those circumstances, which are “incapacity” or
“inability to access secure communications”—
for example, if the Prime Minister is extremely ill, or is abroad and unable to securely access the relevant classified documentation. The draft codes of practice published by the Government give these two scenarios as examples of the circumstances in which the Prime Minister might use this designation power. This is a step in the right direction. But the first problem is that they give them only as examples, which means that there could be any number of other unspecified circumstances about which Parliament would be kept in the dark. That cannot be acceptable.
There should be no question of the delegation of this power becoming routine, so there must be absolute clarity as to the exact scenarios when the power can be used. If, in future, other scenarios arise in which the Government seek to use this designation power— I note that they are currently unable to conceive of what they might be, as they have never arisen before—they must return to Parliament to make the case for it.
The second problem is that to which I referred in my opening remarks: matters as important as this must be in the Bill, where they cannot be amended or diluted by Administrations present or future without first returning to Parliament. This amendment provides what the agencies require but, when combined with the requirement
“that there is an urgent need for the decision”,
it also provides the necessary assurance to Parliament that the Prime Minister’s responsibility will be deputised only in specified exceptional circumstances.
Lord Anderson of Ipswich (CB)
My Lords, it is a pleasure to follow such a strong and powerful speech, and to agree with so much of it. I will speak to Amendment 40, which is based on my report of last year and repeats an amendment that I tabled in Committee and that was introduced there by the noble and learned Lord, Lord Hope of Craighead, my co-signatory then as now. The amendment has two objectives. The first is to ensure that the third part of the triple lock is not too easily wrested away from the Prime Minister.
We are often told that someone is unavailable when they are travelling, are in a meeting, have stepped out of the office or have simply asked not to be disturbed for the afternoon. Indeed, the noble Baroness, Lady Manningham-Buller, used the word in the first of today’s debates on the Bill, albeit in a different context, to describe the status of a Minister, as she put it, during the night or over the weekend. Nobody suggests that reasons such as these should be sufficient for the third lock of the triple lock to be handed to someone else. Unavailable is simply the wrong word. The public interest, in clear and accessible laws, requires us to use the right word. Using the wrong word and then glossing it by guidance or Statements from the Dispatch Box is not a good alternative. I suggest that the right word is “unable”, and I am delighted that the Intelligence and Security Committee and the noble Lord, Lord West, had the same thought in their Amendments 39 and 43.
The second objective of Amendment 40 is to allow provision to be made for the situation in which a Prime Minister is available to apply the third lock but might be considered, or consider himself, unable to do so by reason of conflict of interest. This could be the case if the communications in question were addressed to or from a Prime Minister’s sibling in Parliament. I see that the noble Lord, Lord Johnson of Marylebone, has just left his place. It could be the case if those communications were addressed to or from the Prime Minister himself or herself. Nobody doubts that the agencies currently have the power, and will continue to have the power after the Bill is passed, to request a Prime Minister’s communications to be intercepted. Nor is there any mystery about what will happen if such a request is ever made. It will be put to a Secretary of State for authorisation—presumably the Home Secretary or the Foreign Secretary, depending on the context. If that authorisation is granted, a judicial commissioner—presumably the most senior of them, the Investigatory Powers Commissioner—will be asked to approve it. So far, so uncontroversial.
The issue that arises is what should happen next. Under Clause 21, the request must be put before the Prime Minister unless it happens that he is ill or away from secure communications, in which case the third lock can be passed on to another Secretary of State and the Prime Minister’s communications can be intercepted without his knowledge. A precedent for the delegation of this most sensitive of powers already exists; indeed, it exists in the text of this Bill. But what if the Prime Minister is available? In such a case, the third lock must, under Clause 21, be left in the hands of the Prime Minister himself. He is statutorily barred from passing it on to anyone else, even if he—or, let us say, the Cabinet Secretary on his behalf—took the view that he is unable to take the decision for reasons of conflict of interest. That is notwithstanding the fact that conflict of interest, as the noble and learned Lord, Lord Hope, said in Committee,
“surely is a reason why a Prime Minister, although available, should not exercise the power”.—[Official Report, 13/12/23; col. 1902.]
That principle is so important that perhaps the undoubted practical difficulties to which the noble Lord, Lord West, referred need to take second place to it.
The triple lock was designed to ensure that the communications of parliamentarians could be intercepted only with the consent of the Prime Minister. It was not designed to give the Prime Minister himself an effective veto over the interception of his own communications. Immunities or quasi-immunities of that kind might have their place in some presidential systems, but they seem out of place in a parliamentary system in which the Prime Minister is primus inter pares. However, just such an immunity is perpetuated by Clause 21, and the amendments on this theme from the noble Lord, Lord West, which I otherwise support, do not remedy the situation.
Amendment 40 does not prescribe a detailed solution to this sensitive problem, but it leaves the door open to one. My concern in tabling it was to ensure that we do not legislate in such a way as to prevent a solution being found to the situation in which a conflict of interest arises in circumstances that would be vanishingly rare but that, if they ever did arise, could be of the highest importance to our national security.
I have reflected on what could be done without Amendment 40 if there were serious grounds to intercept a Prime Minister’s personal communications because one of his correspondents or the Prime Minister himself were under suspicion. Perhaps a possible answer would be to wait until the Prime Minister was out of reach of secure communications and then proceed with the interception if the approval of a judicial commissioner and two Secretaries of State could be secured. That is not a very principled or satisfactory answer to the issue of conflict of interest, but it is permitted by Clause 21 and might still be better than a prime ministerial veto. I should say that everything I have said about Clause 21 and interception applies also to equipment interference under Clause 22.
I hoped to generate a debate on this topic by tabling this amendment and, thanks to your Lordships’ indulgence, I have had a chance to do so. I would like to have invited the House of Commons to debate it too, but without the numbers to press this amendment to a vote there will be no such invitation, at least by this route. None the less, I am grateful to the ministerial team and to their shadows in your Lordships’ House and the Commons for discussing this issue with me in a degree of detail. Neither team suggested to me that the prospect of intelligence interest in the communications of a Prime Minister was too fanciful a prospect to be worth considering, although it may be that the two teams have different examples in mind of why it is not. However, I detected a developing sense on both Front Benches that the conflict issue might be one for the “too difficult” box.
I will not divide the House, but I close with these questions to the Minister: is it the Government’s position that the Prime Minister, uniquely among members of the Government, should have a veto over the interception of his own communications in circumstances in which the normal authorisation and approval criteria have been met? If so, why? If not, what answer do they have to the issue of conflict of interest?
Lord Carlile of Berriew (CB)
My Lords, it is a pleasure to follow that brilliant exposition by my noble friend of the problem that he tries to deal with in Amendment 40. After yesterday’s slightly more tense proceedings in this House, I have had a pleasant afternoon supporting the Government. In that spirit, I wish briefly to add some words to what has been said by my noble friend.
The notion of conflicts of interest is not a difficult one. Lawyers dealing with extremely complex cases have to deal with that problem more or less every day. It is something with which we are familiar. The notion that a Prime Minister could face a conflict of interest is not ludicrous. If we just look at the way in which proceedings have proceeded so far in the Covid inquiry, for example, we know that the most intense examination is now given to past communications. We are in a different age from the era when Prime Ministers did not use social networking. We are coming to a period when there will be a Prime Minister whose youthful exchanges with his or her friends will be available to public inquiries in the years to come. It is easy to imagine circumstances in which conflicts of interest might occur. For example, there could be conflicts of interest arising from kinship, as my noble friend Lord Anderson mentioned. Conflicts of interest could arise from earlier employment or from books and articles that person has written. We recently had a Prime Minister who has written quite a lot of interesting books but certainly provoked some interest of another kind when he was Prime Minister.
I urge the Minister not to brush aside this issue of conflict of interest, because it could happen, and it is better to anticipate these things than to leave them till later. I ask the Government to take seriously Amendment 40, for the reasons that have been given by the noble Lord, Lord Anderson, so we can return to this matter before the Bill is passed.
Lord Evans of Weardale (CB)
My Lords, I was not intending to speak in this debate, but it is a pleasure to follow the noble Lords, Lord Carlile and Lord Anderson. I will make two brief observations.
First, I support the suggestion that airing this question of conflict of interest is important. I remember from when I was in the service considering with colleagues —purely theoretically, I hasten to add—what one would do if one had serious national security concerns about a Prime Minister. You would certainly go to the Cabinet Secretary. Would you go to the Palace? I see that the noble Lord, Lord Young of Old Windsor, is in his place. How would you resolve this issue? It was unresolved—it is not an easy issue to resolve, and it may well not be an issue to be resolved in the margins of a separate Bill. But it is worth at least airing these issues, rather than merely considering them in private. I welcome the opportunity to put these issues into the public domain, since it is not impossible to conceive that they might become real issues at some future point.
Secondly, I support Amendment 41 from the noble Lord, Lord West of Spithead, and particularly the second proposed new subsection, which says that any individual designated as one of the five individuals to whom the Prime Minister can delegate powers under the triple lock should be an experienced Minister who is used to signing warrants. I have had experience myself of trying to explain to inexperienced Ministers for whom this was unfamiliar territory what on earth they were being asked to do. The occasional look of either panic or horror when it was revealed what they were being asked to do stick in the mind. It is really important that, if these powers are to be delegated, they should be delegated to Ministers who are experienced and understand the judgments of proportionality and necessity that are made in these important decisions relating to authorisation of intrusion. Therefore, I strongly support in particular that aspect of the amendment proposed by the noble Lord, Lord West.
Lord Fox (LD)
My Lords, at Second Reading I raised the issue of the Prime Minister in a slightly different context, but it has taken the legal brains of the noble Lord, Lord Anderson, and the noble and learned Lord, Lord Hope, to put it into a frame. I am happy to have co-signed that, and happy to find myself back on the same side as them on this argument.
It is clear that we will not resolve this here today, but it is perhaps something that we will take to the gap between here and the Commons to try to resolve. I rely on the wisdom of noble Lords who have spoken to take this forward.
On the other point, I support the amendments of the noble Lord, Lord West, and I hope that the Government will find his persuasion conducive.
Lord Hope of Craighead (CB)
My Lords, I spoke in Committee about the difference between “unavailable” and “unable”. I am greatly encouraged by Amendments 39 and 43 proposed by the noble Lord, Lord West. The one point of difference between us is that he narrows the meaning of “inability”, for reasons he has explained. If it came to a vote, I think I would support his amendments—but, like the noble Lord, Lord Anderson, I think that further thought needs to be given to whether that narrowing of “inability” or “unable” is really appropriate, considering the effect that it has, particularly in situations of conflicts of interest.
Lord Coaker (Lab)
My Lords, I do not have much to add to the debate. From these Benches, we fully support the amendments proposed by the noble Lord, Lord West, and the excellent way in which he presented them. They have the support of the whole ISC, which in this respect has done a great service to us all in taking forward the discussion. These amendments certainly improve the Bill.
The point that the noble Lord, Lord West, made is exceptionally important—the fact that this has to be in the Bill, and that we need it to guide us in how we take this forward. For those who read our proceedings, it is important to repeat that what we are discussing here is the interception of communications of parliamentarians, and the fact that the triple lock was introduced to give additional protection to that. The role of the Prime Minister becomes crucial in that, for obvious reasons.
I join others in thanking the noble Lord, Lord Anderson, for the way in which he has presented his arguments, and the discussions and debates that have gone on in this Chamber and outside it. He has done a great service to all of us by tabling what seems on the face of it a simple amendment—simply changing one word, from “unavailable” to “unable”—but is actually of huge significance. We have concerns about it, which we have expressed in this Chamber and elsewhere— indeed, the noble Lord, Lord West, explained them. Notwithstanding the remarks of the noble Lord, Lord Carlile, and others, we are worried about where it takes us with respect to conflicts of interest, and who decides that there is a conflict of interest for the Prime Minister in circumstances in which the Prime Minister themself does not recognise that there is a conflict of interest. I agree with the noble Lord, Lord Anderson, and others, that there may be a need for this discussion to continue—but who decides whether the Prime Minister has a conflict of interest, if the Prime Minister themself does not recognise that, is an important discussion to have. In the end, the system rests on the integrity of the Prime Minister.
The way in which the ISC has tried to bring forward some conditions to what “unavailable” means is extremely important, and we support that, as indeed we support the amendments that try to ensure that those who take decisions are those various Secretaries of State who may be designated under the Bill to take decisions, should the Prime Minister be unavailable. It is extremely important for those Secretaries of State to have experience of the use of those warrants. Again, the amendments proposed by the noble Lord, Lord West, deal with that, and we are very happy to support them.
Lord Sharpe of Epsom (Con)
My Lords, I offer my thanks to the noble Lords, Lord Anderson of Ipswich, Lord Fox, and Lord West of Spithead, and the noble and learned Lord, Lord Hope of Craighead, for their amendments and for the points that they have raised during this debate. I also thank the noble Lord, Lord Evans, for his perspective, and the noble Lord, Lord Carlile, for supporting the Government, which obviously I hope becomes a habit.
I have discussed the triple lock at length with noble Lords and many others in Parliament and across government. We are all in agreement that this is a matter of the utmost importance, and it is imperative that we ensure that the triple lock operates correctly. That means that the triple-lock process, when needed urgently, has the resilience to continue in the most exceptional circumstances, when the Prime Minister is genuinely unavailable, while ensuring that the alternative approvals process is tightly and appropriately defined.
On Amendment 40, I thank the noble Lord, Lord Anderson, for the valuable engagement he has taken part in with my ministerial colleagues, Home Office officials and me regarding this amendment. I take this opportunity to explain why the Government do not support this amendment. The expressed intention of the noble Lord’s amendment is twofold: first to tighten the requirement in the current clauses, which use the word “unavailable”; and, secondly, to introduce a potential provision for dealing with a conflict of interest, as one of the circumstances in which the alternative approvals process could be used.
There is certainly merit in limiting the circumstances in which the alternative approvals process may be used. However, the noble Lord’s amendment introduces the requirement for a judgment to be made on the Prime Minister’s ability to consider a warrant application, for any number of reasons, including conflict of interest. This raises a number of challenges.
The first challenge is that “unable” draws into the legislation the principle of ministerial conflict of interest. This poses a constitutional tension and a challenge to Cabinet hierarchy. The inclusion of “unable” would allow for someone other than the Prime Minister to decide whether the Prime Minister is subject to a conflict of interest in a particular scenario, which goes against clear constitutional principles regarding the Prime Minister’s powers. This would be a subjective decision on the Prime Minister’s ability, rather than an objective decision on his availability.
As such, rather than strengthening the current drafting, the amendment as proposed could be considered to constitute a watering down of the triple lock, in that it was always designed to be exercised by the Prime Minister. Someone else making a decision about whether the Prime Minister is able to make a decision, given they can be said to be available and therefore technically able to consider an application, risks the intention of the triple lock. As drafted, the original clauses require a binary decision to be made about whether the Prime Minister is available or not, whereas, in deciding whether the Prime Minister may have a conflict of interest, a judgment must be made which is not binary and therefore has much less legal clarity.
The noble Lord, Lord Anderson, asked me if it is right that the Government believe that it is proper for the Prime Minister to consider a warrant application relating to the Prime Minister’s own communications. The best answer I can give is that the Bill is intended not to tackle issues relating to Prime Ministerial conflicts of interest, but rather to improve the resilience of the warrantry process. Conflict of interest provisions and considerations relating to propriety and ethics are therefore not properly for consideration under this Bill. The Prime Minister is expected, as are all Ministers, to uphold the Nolan principles in public life. For these reasons, the Government cannot support this amendment.
The Government have, however, recognised the concerns expressed by Members of both Houses, and the seeming consensus that a more specific, higher bar should be set with relation to the circumstances in which the alternative approvals process may be used. This high bar is of particular importance because of the seriousness of using these capabilities against Members of relevant legislatures. We accept that we are not above the law and it is appropriate for it to be possible for us to be subject to properly authorised investigatory powers. However, it is right that the significance that this issue was given in the original drafting of the Investigatory Powers Act is respected, and the communications of our fellow representatives are properly safeguarded.
I therefore thank the noble Lord, Lord West of Spithead, for his amendments, and for the close engagement on this Bill which I, the Security Minister and my officials have had with the members and secretariat of the Intelligence and Security Committee. Following engagement with Members of both Houses on these amendments, it is clear that there is good consensus for these measures, and the Government will not be opposing them today. While they will reduce the flexibility of the current drafting somewhat, the Government agree that these amendments strike an important and delicate balance between providing the flexibility and resilience that the triple-lock process requires, while providing the legal clarity and specificity to allow for its effective use. The amendments will also provide further confidence to members of relevant legislatures, including those of this House, that the protection and safeguarding of their communications is of paramount importance.
I should note that the Government do not quite agree with the precise drafting of these amendments, and we expect to make some clarifications and improvements in the other place, particularly to the references to routine duties under Sections 19 and 102 of the Investigatory Powers Act 2016, but I am happy that we seem to have reached broad agreement today.
Lord West of Spithead (Lab)
I just want to be clear, as I have never had an amendment accepted in 14 years —is the Minister saying that the Government accept my Amendments 39 and 41?
Lord Sharpe of Epsom (Con)
Yes. The noble Lord, Lord Fox, says, “Don’t get too excited”, and he is right.
I now turn to the government amendment in this group, Amendment 46. This proposed new clause amends the Investigatory Powers Act’s bulk equipment interference regime to ensure that sensitive journalistic material gathered through bulk equipment interference is subject to increased safeguards. Currently, Section 195 of the IPA requires that the Investigatory Powers Commissioner be informed when a communication containing confidential journalistic material or sources of journalistic material, following its examination, is retained for any purpose other than its destruction.
This amendment introduces the need for independent prior approval before any confidential journalistic material or sources of journalistic material are selected, examined, and retained by the intelligence agencies. It also introduces an urgency process within the new requirement to ensure that requests for clearance to use certain criteria to select data for examination can be approved out of hours.
The Government recognise the importance of journalistic freedom and are therefore proactively increasing the safeguards already afforded to journalistic material within the IPA. In doing so, we are also bringing the IPA’s bulk equipment interference regime into alignment with bulk interception, which is being amended in the same way through the Investigatory Powers Act 2016 (Remedial) Order 2023; that is being considered in the other place today.
In wrapping up, I once again thank noble Lords for the constructive engagement we have had on the Bill, singling out in particular the noble Lords, Lord Anderson, Lord West, Lord Coaker and Lord Fox. With that, I hope that noble Lords will support the Government’s amendment.
The Deputy Chairman of Committees (Lord Beith) (LD)
If Amendment 39 is agreed to, I cannot call Amendment 40 by reason of pre-emption.
Lord West of Spithead
“(2C) The Prime Minister may designate up to five individuals under this section.(2CA) The Prime Minister may designate an individual under this section only if the individual holds the office of Secretary of State and is required in their routine duties to issue warrants under section 19 or section 102.”Member's explanatory statement
This amendment would permit the Prime Minister to nominate up to five Secretaries of State to act for the Prime Minister if he or she is unable to decide whether to give approval under subsection (2A). The amendment also specifies that those nominated Secretaries of State must already have responsibility for the issuing of warrants under sections 19 or 102 of the Investigatory Powers Act 2016 (which governs warrantry for Interception and Examination of Communications, and Equipment Interference).
Lord West of Spithead
Member's explanatory statement
This amendment would specify that the only exceptional circumstances in which the Prime Minister would be permitted the use of a designate is when he or she is unable to make a decision due to incapacity (ill-health) or lack of access to secure communications.
“(7C) The Prime Minister may designate up to five individuals under this section.(7CA) The Prime Minister may designate an individual under this section only if the individual holds the office of Secretary of State and is required in their routine duties to issue warrants under section 19 or section 102.”Member's explanatory statement
This amendment would permit the Prime Minister to nominate up to five Secretaries of State to act for the Prime Minister if he or she is unable to decide whether to give approval under subsections (3) or (6). The amendment also specifies that those nominated Secretaries of State must already have responsibility for the issuing of warrants under sections 19 or 102 of the Investigatory Powers Act 2016 (which governs warrantry for Interception and Examination of Communications, and Equipment Interference).
Lord Sharpe of Epsom
“Bulk equipment interference: safeguards for confidential journalistic material etc(1) The Investigatory Powers Act 2016 is amended as follows.(2) For section 195 (additional safeguard for confidential journalistic material) substitute—“195 Additional safeguards for confidential journalistic material etc (1) Subsection (2) applies if, in a case where material obtained under a bulk equipment interference warrant (“BEI material”) is to be selected for examination—(a) the purpose, or one of the purposes, of using those criteria to be used for the selection of the BEI material for examination (“the relevant criteria”) is to identify any confidential journalistic material or to identify or confirm a source of journalistic information, or(b) the use of the relevant criteria is highly likely to identify confidential journalistic material or identify or confirm a source of journalistic information.(2) The BEI material may be selected for examination using the relevant criteria only if the use of those criteria has been approved by—(a) the Investigatory Powers Commissioner, or(b) in a case where a senior official acting on behalf of the Secretary of State considers there is an urgent need to do so, the senior official.(3) The Investigatory Powers Commissioner or a senior official may give an approval under subsection (2) only if the Commissioner or official considers that—(a) the public interest in obtaining the information that would be obtained by the selection of the BEI material for examination outweighs the public interest in the confidentiality of confidential journalistic material or sources of journalistic information, and(b) there are no less intrusive means by which the information may reasonably be obtained.(4) Subsection (5) applies where—(a) material obtained under a bulk equipment interference warrant (“the relevant material”) is retained, following its examination, for purposes other than the destruction of the relevant material, and(b) the person to whom the warrant is addressed considers that the relevant material contains confidential journalistic material or material that would identify or confirm a source of journalistic information.(5) The person to whom the warrant is addressed must inform the Investigatory Powers Commissioner of the retention of the relevant material as soon as reasonably practicable.(6) Unless the Investigatory Powers Commissioner considers that subsection (8) applies to the relevant material, the Commissioner must direct that the relevant material is destroyed.(7) If the Investigatory Powers Commissioner considers that subsection (8) applies to the relevant material, the Commissioner may impose such conditions as to the use or retention of the relevant material as the Commissioner considers necessary for the purpose of protecting the public interest in the confidentiality of confidential journalistic material or sources of journalistic information.(8) This subsection applies to material containing—(a) confidential journalistic material, or(b) material identifying or confirming a source of journalistic information,if the public interest in retaining the material outweighs the public interest in the confidentiality of confidential journalistic material or sources of journalistic information.(9) The Investigatory Powers Commissioner—(a) may require an affected party to make representations about how the Commissioner should exercise any function under subsections (6) and (7), and(b) must have regard to any such representations made by an affected party (whether or not as a result of a requirement imposed under paragraph (a)). (10) “Affected party” has the meaning given by section 194(14).(For provision about the grounds for retaining material obtained under a warrant, see section 191.)195A Section 195: procedure where use of criteria approved by senior official(1) This section applies where material obtained under a bulk equipment interference warrant is selected for examination using criteria the use of which was approved by a senior official under section 195(2).(2) The Secretary of State must, as soon as reasonably practicable, inform the Investigatory Powers Commissioner that the approval has been given.(3) The Investigatory Powers Commissioner must, as soon as reasonably practicable—(a) consider whether the relevant condition is met as regards the use of the criteria for the selection of the material for examination, and(b) notify the Secretary of State of their decision.(4) For this purpose, “the relevant condition” is that—(a) the public interest in obtaining the information that would be obtained by the selection of the material for examination outweighs the public interest in the confidentiality of confidential journalistic material or sources of journalistic information, and(b) there are no less intrusive means by which the information may reasonably be obtained.(5) On the giving of a notification of a decision that the relevant condition is not met, the senior official’s approval ceases to have effect.(6) Nothing in subsection (5) affects the lawfulness of—(a) anything done by virtue of the approval before it ceases to have effect, or(b) if anything is in the process of being done by virtue of the approval when it ceases to have effect—(i) anything done before that thing could be stopped, or(ii) anything done which it is not reasonably practicable to stop.”(3) In section 229 (main oversight functions), in subsection (8), before paragraph (g) insert—“(fb) deciding whether—(i) to approve the use of criteria under section 195(2)(a),(ii) subsection 195(8) applies for the purposes of subsection 195(6) and (7),(iii) the relevant condition is met for the purposes of subsection 195A(3)(a).””Member's explanatory statement
This amendment replaces section 195 of the Investigatory Powers Act 2016 with new sections 195 and 195A which include additional protections in relation to confidential journalistic material and sources of journalistic material.