Investigatory Powers (Amendment) Bill [Lords]

(Limited Text - Ministerial Extracts only)

2nd reading
Monday 19th February 2024 Commons Chamber

[The Secretary of State for the Home Department (James Cleverly)]

I beg to move, That the Bill be now read a Second time.

The first duty of Government is to keep our citizens safe. The United Kingdom faces an enduring threat from terrorists, hostile actors and organised criminal groups, and that threat is evolving and becoming more sophisticated. It is not enough for us to keep pace with those who would do us harm; we must endeavour to get and then stay ahead of them. The investigatory powers are the legal powers available to law enforcement, the intelligence services, MI5, the Secret Intelligence Service, GCHQ and other public authorities where appropriate to obtain communications and data about communications.

The Investigatory Powers Act 2016 provides a clear legal framework for the use of those powers, combining world-leading safeguards and oversight with giving agencies the tools they need to protect us. There is a double lock for the most sensitive IPA powers, meaning that an independent judicial commissioner must approve a decision by the Secretary of State to issue a warrant under the IPA. The use of any of these powers must be assessed as necessary and proportionate, with strong independent oversight by the Investigatory Powers Commissioner. The Investigatory Powers Tribunal provides a robust mechanism for providing redress in respect of any unlawful use of those powers.

[Mr Alistair Carmichael (Orkney and Shetland) (LD)]

The Home Secretary will be as aware as I am that very occasionally those in charge of our intelligence and security services do not act in the best traditions of this country in their offices, and I am thinking of cases such as Belhaj and Boudchar. Where people have been the victim of mistreatment—as a consequence of UK complicity with foreign powers, for example—should there not be a right for those people to have access to the information about that?

[James Cleverly]

I listened carefully to the right hon. Gentleman’s point. I am not sure it is directly relevant to this matter, but I take on board the points that he makes. He will forgive me if I do not address them directly at this point; I want to consider them properly.

The IPA is sound legislation, but the nature of these threats has evolved since 2016, and we are confronted by greater global instability and technological advances, and they demand that we act. Terrorists, child abusers, organised criminals and malign actors from hostile states have exploited technological advances. Our job is to ensure that the UK’s investigatory powers framework remains fit for purpose. The changes that this Bill proposes were informed by the independent review of the IPA published by Lord Anderson of Ipswich in June 2023. The Bill received cross-party and Cross-Bench support as it passed through the other place. Every Government amendment was accepted, and I thank the members of the Intelligence and Security Committee of Parliament for the productive way they engaged with and helped to shape the Bill.

In particular, we have agreed to tighten the drafting of clauses 22 and 23 in line with amendments proposed by the Intelligence and Security Committee. Those changes put beyond doubt that the Prime Minister may delegate warrants for the purposes of obtaining communications of parliamentarians in two, and only two, exceptional circumstances: the personal incapacity of the Prime Minister and a lack of access to secure communications. There is also a limit of five Secretaries of State to whom this responsibility could be delegated in those circumstances. Further to that, in respect of new part 7A, parliamentary scrutiny will be enhanced through a statutory requirement for the Secretary of State annually to inform the Intelligence and Security Committee about the new regime for bulk personal datasets.

[Sir John Hayes (South Holland and The Deepings) (Con)]

My right hon. Friend mentioned the ISC’s scrutiny of these matters. He will understand the concern about widening the number of people who can play the role previously played exclusively by the Prime Minister. I understand the reasons for that, but has he considered limiting that to those Secretaries of State who have warranting powers?

[James Cleverly]

We looked at that. There is a balance to be struck, and actually the bulk of those Secretaries of State to whom the function could be delegated in those two exceptional circumstances do have warranting powers—I think the Secretary of State for Defence is the only one who does not. My right hon. Friend’s point is a fair one, but the scope of the Bill is not much greater than that.

[Mr Kevan Jones (North Durham) (Lab)]

As a member of the ISC, I welcome the Government’s acceptance of our recommendation. However, I would like to understand why they are not accepting our other, simple proposal: that when a delegation takes place, the Prime Minister would be informed about that afterwards.

[James Cleverly]

I think it is inconceivable that the Prime Minister of the day would not be informed of the use of a delegated authority.

[Mr Jones]

It is not about the Prime Minister not being informed about the delegation; it is about the Prime Minister looking at the case afterwards—they would not be second-guessing it, obviously, because it would already have been agreed. We suggested that, as a matter of course, the Prime Minister should be informed afterwards of the contents of that warrant. For some reason, the Government are resisting that. I cannot understand why.

[James Cleverly]

I understood the point that the right hon. Gentleman was making—perhaps my answer was not clear—but I suggest that it is inconceivable that the Prime Minister would not routinely be informed of the exercise of this power. Ultimately, that is a level of granularity that would add complexity to the Bill without utility. But, as I have said, through the passage of the Bill thus far, we have listened carefully to the Committee’s suggestions, and although we may not always agree, I can reassure him, other members of the Committee and Members of the House that we will continue to act in listening mode in relation to the Committee’s suggestions.

[Joanna Cherry (Edinburgh South West) (SNP)]

On that point, will the Home Secretary give way?

[James Cleverly]

I will, but I do want to make some progress.

[Joanna Cherry]

I thank the Home Secretary for giving way. He mentioned listening to scrutiny by the ISC. The Joint Committee on Human Rights has issued a call for written evidence on the Bill, and as he will know from the human rights memorandum, the Bill raises important human rights issues relating to the rights to privacy and to freedom of expression, and possibly the right to an effective remedy. Will he therefore undertake to look closely at any correspondence that the Joint Committee might send him when we have completed our scrutiny of the Bill?

[James Cleverly]

I reassure the hon. and learned Lady that we will do exactly that.

I turn to the measures in the Bill. We are creating a new regime for bulk personal datasets that have low or no expectation of privacy: for example, certain datasets that are widely publicly or commercially available. Bulk personal datasets are an essential tool to support our intelligence services in identifying fragments of intelligence within a large quantum of data, in order to disrupt threats such as terrorism and hostile state actors. The Bill seeks to create a new statutory oversight regime for how the intelligence services access and examine bulk personal datasets held by third parties. It will place that oversight on a statutory footing, increasing the transparency of the regime. The regime will be subject to strong safeguards, including the double lock.

We are also making changes to the notices regime that will help the UK anticipate and address the risk to public safety of companies rolling out technology that precludes lawful access to data. We want to work with those companies to achieve common goals, but we must have the tools available when collaboration falls short.

[Suella Braverman (Fareham) (Con)]

I know that the Home Secretary wants to make progress, but I am grateful for the opportunity to comment.

These reforms to the IPA are necessary to upgrade our world-class regime and ensure that our frameworks are kept up to date with evolving threats and, importantly, technology. We know that the terrorists, the serious organised criminals, the fraudsters and the online paedophiles all take advantage of the dark web and encrypted spaces: to plan their terror, to carry out their fraudulent activity and to cause devastating harm to innocent people such as children, in the field of online paedophilia. Does he share my concern and indeed frustration with companies such as Meta and Apple? The former has chosen to roll out end-to-end encryption without safeguards and the latter has rolled out advanced data protection, which will allow these bad actors to go dark, which will severely disable agencies and law enforcement from identifying them and taking action, and will enable—indeed it will facilitate—some of the worst atrocities that our brave men and women in law-enforcement agencies deal with every day.

[James Cleverly]

My right hon. and learned Friend—and immediate predecessor—makes incredibly important points. Digital technology and online technology have been a liberator in so many ways, but, sadly, as has been the case with technology throughout time, it has also been used by those who would do people harm. Indeed, she mentioned in particular the harm done to children. We take that incredibly seriously. We value the important role of investigatory powers and will continue to work with technology companies—both those well established at the moment and those of the future—to maintain the balance between privacy and security, as we have always done, and ensure that these technology platforms do not provide a hiding place for terrorists, for serious criminals and those people taking part in child sexual exploitation.

The three types of notices under the existing IPA are data retention notices, technical capability notices and national security notices. Those notices must be both necessary and proportionate, and they are of course subject to the double lock. The Bill does not introduce any new powers for the acquisition of data. The changes are about ensuring that the system is up to date and remains robust. The Bill will create a notification notice allowing the Secretary of State to place specific companies under an obligation to inform him or her of proposed changes to their telecommunications services or systems that could have an impact on lawful access. This is not a blanket obligation, and it will be used only where necessary and proportionate, and then only on a case-by-case basis.

The notice does not give the Secretary of State any powers to veto or intervene in the roll-out of a product or services. It is intended to ensure that there is sufficient time for appropriate consideration of the operational impact of the proposed changes, and potentially for discussions with the company in question about them. The public, rightly, would want their representatives to know in advance if companies were proposing to do something that would put public safety at risk, and responsible companies will work with Governments to avoid endangering people, who are of course also their customers.

The Bill will also amend the IPA to require the company to ensure that existing lawful access is maintained. That means the company cannot legally take any action that would negatively affect the level of lawful access for our operational partners during the review period. In the other place, the Government tabled an amendment to allow a timeline for review of a notice to be specified in regulations. We also gave the judicial commissioner further powers for managing the review process. Taken together, they ensure that companies are clear on the length of time that a review can take, which reduces uncertainty for their business as well as providing greater clarity for the review process. In the other place, my noble colleague Lord Sharpe of Epsom also committed to a full public consultation before amending the existing regulations on the review of notices, and laying new regulations relating to the notification notices.

The Bill also clarifies the definition of a telecommun-ications operator, to make it clear that companies with complex corporate structures that provide or control telecommunications services and systems in the UK fall within the remit of the IPA. These changes do not directly relate to any particular technology, including end-to-end encryption, but are designed to ensure that companies are not able to unilaterally make design changes that compromise exceptional lawful access.

The Bill makes changes to the powers of public authorities to acquire communications data. Section 11 of the IPA made it an offence for a relevant person in a relevant public authority to knowingly or recklessly obtain communications data from a telecoms operator or a postal operator without lawful authority. The Bill will set out examples of the acquisition routes that amount to lawful authority outside the IPA, giving greater clarity to public authorities that they are not inadvertently committing an offence. Further targeted amendments will ensure that public sector organisations are not unintentionally prevented or discouraged from sharing data. Further changes will allow bodies with regulatory functions to acquire communications data.

The Bill also creates a new condition for the use of internet connection records—ICRs—by the intelligence services and the National Crime Agency. The IPA currently requires certain thresholds to be met on the known element of an investigation, such as exactly when a website has been accessed. That limits the ability of operational partners to use the ICRs to detect previously unknown criminals, terrorists or state threat actors who are acting online. The proposed measure will allow greater detection of high-impact offenders by removing the requirement to unequivocally know a specific time or times of access and service in use, and instead will allow these factors to be specified within the application.

[Mr Jones]

I understand the use of the measure for the security services, but the Bill broadens the scope of how many people could be dragged into it. There is no judicial oversight of the Security Service or whoever is using it. The Bill states that the measure is for national security and economic wellbeing—that is a catch-all for quite a lot of things. Although the intent is right, there need to be some safeguards to prevent innocent people being dragged into that potentially broad measure.

[James Cleverly]

I understand the right hon. Gentleman’s point. Innocent people’s data is often acquired in dataset capture, and it is always deleted. Economic wellbeing merely reflects the language that is used in other parts, for consistency across our various strands of work.

[Mr Jones]

I thought we were here today to scrutinise the Bill. It should not be a chore for the Home Secretary to be asked questions. The definition of wellbeing could be quite broad. I understand the meaning of national security, as I think he does, and the House, but wellbeing could have quite a broad definition and I am not convinced that I have seen what it is. I am not sure that consistency with other legislation is a great argument for including it in this Bill.

[James Cleverly]

The simple truth of the matter is that I disagree. In legislation of this nature, maintaining consistency of language with previous relevant legislation, including the Intelligence Services Act 1994, is incredibly important to clarity of intent. I recognise that the right hon. Gentleman has given thought to this, and we do not disregard his point, but we have thought through the importance of consistency of language, which is why we have maintained it.

[Dame Angela Eagle (Wallasey) (Lab)]

A general listener to our proceedings might worry that the new powers could be used for fishing expeditions, rather than the very specific powers that they replace. Could the Home Secretary give some words of reassurance from the Dispatch Box that the broadening of bulk data collection without specific dates will not be used for fishing expeditions, which might affect the privacy of ordinary citizens who have done nothing wrong?

[James Cleverly]

The hon. Lady makes an important point, but the powers could be applied to any bulk dataset collection, of which she knows there are many across Government. Provisions are in place to ensure that innocent people’s data is not held but deleted, and that our security services and other organisations that will utilise these powers always do so carefully and cautiously. There are relevant safeguards in place, as I have made reference to—the Investigatory Powers Commissioner and the tribunal—if there is wrongdoing. The proposals are put forward for a very specific reason. The Government have given thought to mission creep and broader expansion, and we feel that this is a modest extension that will give significantly greater protection to the British people.

[Mr Jones]

As my hon. Friend the Member for Wallasey (Dame Angela Eagle) just said, we need to give confidence to the public that what we are rightly doing to protect ourselves has that level of security in it. There is no judicial oversight of internet connection records. If we are to give these powers to the Security Service—which I approve of—we should be able to say to the public that they are proportionate and that there is an independent process to ensure that they cannot be abused. Surely, judicial oversight throughout should be important.

[James Cleverly]

The right hon. Gentleman specifically spoke about judicial oversight, but there is oversight—

[Mr Jones]

There isn’t.

[James Cleverly]

There is oversight by the Secretary of State through the warrant process, and oversight of the whole process by the Investigatory Powers Commissioner. Through the Committee on which the right hon. Gentleman sits, there is oversight of the Secretary of State’s function.

[Mr Jones]

I agree, and I support that oversight, even though this Government have not made our job on the ISC easy. Unless I am missing something, there is no judicial oversight of internet connection records in the Bill. If we want to give people confidence, that backstop of judicial oversight should be important.

[James Cleverly]

As I said, I noticed that the right hon. Gentleman specifically said that there is no judicial oversight—

[Mr Jones]

There isn’t.

[James Cleverly]

I am not disagreeing, but there is oversight. The Committee on which the right hon. Gentleman sits is part of that oversight process.

[Holly Lynch (Halifax) (Lab)]

The Home Secretary has just touched on the importance of the oversight role of the ISC, particularly in relation to these additional provisions. I wonder whether he remembers the passing of the National Security Act 2023. During the final stages of that important piece of legislation, the Government tabled an amendment in lieu promising that they would progress a review of the memorandum of understanding within six months of the Act coming into force to ensure there was an updated and robust relationship between the ISC and the Government, and the Prime Minister in particular, the ISC having been unable to secure a meeting with the Prime Minister since 2014, remarkably. Given the nature of the ISC’s important role in these provisions, I wonder whether the Home Secretary could update us on that review.

[James Cleverly]

That is not an element of this Bill. On a commitment for the Prime Minister to meet with the Committee, I will look at the details.

[Yvette Cooper (Normanton, Pontefract and Castleford) (Lab)]

Will the Home Secretary give way?

[James Cleverly]

I want to make progress to ensure that everyone who wishes to speak in this debate is able to do so, but I will give way to the right hon. Lady.

[Yvette Cooper]

On that point, will the Home Secretary encourage the Prime Minister to go before the Intelligence and Security Committee at the soonest opportunity? My understanding is that that has not happened for 10 years.

[James Cleverly]

I cannot make a commitment on the Prime Minister’s behalf. Members of the Committee will know that I appeared before the Committee in my previous role, and I think it is important that Government do make themselves available for this scrutiny. As I say, it would be inappropriate for me to demand of the Prime Minister attendance anywhere, but I will pass on the right hon. Lady’s point.

[Sir Julian Lewis (New Forest East) (Con)]

I will assist the Home Secretary with a little context. When I was a ranking member of the Intelligence and Security Committee between 2010 and 2015, it was a matter of routine that the Committee went to see the Prime Minister once a year, usually in the Cabinet Room. That stopped in 2014. Successive Prime Ministers have failed to reinstate it, although it must be said that the shortest-lived of them did offer to meet with the Committee, but sadly ceased to be Prime Minister before that became possible.

[James Cleverly]

The lengths that some people will go to to avoid Committee scrutiny. I am trying to remember where I was; it has been such a long time since I looked down the page of this speech. All such applications must be necessary and proportionate and subject to independent authorisation or inspection.

The Bill will also strengthen safeguards for journalistic material within the Investigatory Powers Act’s bulk equipment interference regime, aligning it with changes to the bulk interception regime that are under way to ensure compliance with obligations under the Human Rights Act 1998. Prior judicial authorisation will be needed before material obtained through bulk equipment interference can be selected for examination using criteria where the purpose is to identify, or is highly likely to identify, confidential journalistic material or confirm a source of journalistic material. Prior judicial approval is also necessary before such material may be retained for purposes other than its destruction. The other measures in part 5 of the Bill will ensure that the resilience and protections of the regime are maintained and enhanced.

The Bill will also make improvements to support the Investigatory Powers Commissioner in effectively carrying out their role, ensuring that the world-leading oversight regime remains resilient, including powers to enable the IPC to appoint deputies, delegate some of their functions to judicial commissioners and the newly created deputies, and put certain functions on a statutory basis. The Bill will ensure there is a clearer statutory basis for reporting errors to the IPC.

[Joanna Cherry]

I sense that the Home Secretary is coming to the end of his speech. We have mentioned parliamentarians and journalists, but I want to talk about another important group: trade unions. Some people fear that the Bill will open the door even further than its parent Bill on the surveillance of trade unions. Does the Home Secretary agree that there should be no place for the surveillance of trade unions in a democracy? If so, will he consider amendments to the Bill to ensure that that does not happen, including a redraft of clause 5?

[James Cleverly]

I take the point that the hon. and learned Lady puts forward. There are a number of organisations not explicitly mentioned in the Bill where that argument could be made, and I am not sure it would necessarily be useful or right to list them all, but I will take on board the point she makes in good faith—genuinely.

The Bill will bring the Investigatory Powers Act up to date with the modern age, provide greater clarity, make the system more resilient and retain the world-leading safeguards of civil liberties and commercial integrity. Above all, the Bill will mean that the men and women who work so incredibly hard to keep us safe, often without recognition, have the tools they need to do so in the modern era. I therefore commend the Bill to the House.

[Mr Deputy Speaker (Sir Roger Gale)]

I call the Opposition Front-Bench spokesperson.

--- Later in debate ---

[Stuart C. McDonald]

My hon. and learned Friend will not be surprised to hear that I completely agree with her.

In fact, that brings me to the next point I want to raise in relation to clause 2. As well as putting in place what I struggle to see as being a reasonably operated assessment, the clause raises concerns in relation to consistency with data protection legislation and with human rights obligations. The factors to be taken into account when undertaking that really difficult assessment do not even expressly include the sensitivity of the data in question, which surely should be central to any question of processing. That is an inconsistency with existing data protection principles and laws, and I agree that the compatibility of such provisions with our human rights obligations is also surely highly dubious. Just because someone has shared personal data does not mean that they automatically lose their right to further protection around how that data is shared and processed, especially when it is sensitive personal data, as my hon. and learned Friend has just said.

The role of judicial commissioners in this area is even further diluted, reduced to reviewing by judicial review standards whether datasets do indeed relate to data where there can be low or no expectation of privacy. Frankly, that is not a safeguard at all. At the very least, their role needs to be strengthened when the Bill is considered in Committee. We also need to seek assurances around how the Bill will impact on the reporting of the retention and use of bulk personal datasets. If large numbers are retained under category authorisations, we may not know how many datasets are actually being gathered.

Let me turn to various aspects of part 4, on notices. Again there are some controversial provisions, particularly in clause 21 and the requirement on selected telecommunications operators to inform the Secretary of State if they propose to make changes to their products or services that would negatively affect existing lawful access capabilities. That seems like an extraordinarily broad power, without anything remotely appropriate in terms of oversight and limitations. These powers are going to make the UK a real outlier. Essentially, the Secretary of State will be empowered to say to tech companies, “You are not allowed to improve your products without consulting us, so that we can still break in to access the data that we need and when we want it”. Despite what the Secretary of State says, taken together with other changes to review processes, such powers could easily be used to significantly delay, or de facto veto, updates to security, rendering everybody’s data more vulnerable to hacking by third-party actors.

[The Minister for Security (Tom Tugendhat)]

That is simply incorrect, and I know that the hon. Gentleman would not wish to continue down a road that he knows to be incorrect. Let me just be very clear: this is a continuation of a power that was granted in 2016. The notice does not extend that power; it merely enables a conversation to begin with companies before any action is taken, to maintain an existing standard and not in fact to change it.

[Stuart C. McDonald]

I am grateful for that clarification from the Minister, and we will of course engage further in this debate in Committee.

These concerns have been raised not just by me but by significant tech companies; this is not something that has come to me simply through perusing the Bill. The key question remains: why is there to be no proper oversight of these notices and notice powers by independent advance authorisation? Why is there not even the double lock that applies to other notices that can be served on communications providers under that Act? Surely that scrutiny should be carried out in advance. There are also lots of question marks around the expanded claims of international jurisdiction. How will potential conflicts of law be resolved, especially if a company subject to one of these notices that is contrary to its domestic laws cannot even say anything about it because it is bound to secrecy by this legislation? What are the prospects of other Governments copying what our Government are doing and seeking to replicate such provisions, and what would the impact of that be on UK companies?

Turning to internet connection records, the starting point is that we should remember that no other European Union or Five Eyes country permits the requiring of ICR generation or retention in relation to its own residents, so this was a hugely controversial development in the 2016 Act. As we have heard, ICRs can reveal huge amounts of deeply sensitive information about a person. For now, secret services can seek ICRs only when certain facts that are already known, such as the identity of a person connecting or the time and use of the connection, so that the retention is at least targeted in some way.

The risk in this Bill is that reasonable suspicion will no longer precede targeted surveillance. Instead, the Bill would seek to use ICRs for the discovery of new targets, which is a really significant jump and development. I can genuinely understand some of the reasons being offered for this change, and I am not unsympathetic to the case being made, but if these powers are not carefully circumscribed, they risk creating a big step towards mass surveillance and fishing exercises. We need to ask whether there are less invasive alternatives and whether these powers are therefore really necessary. Alternatively, we need to look again at the oversight mechanisms for the use of these powers.

We also have concerns about the Bill’s proposals in relation to the offence created by the 2016 Act, where relevant persons in a relevant public body knowingly or recklessly obtain communications data from a telecoms or postal operator without lawful authority. This Bill seeks to set out examples of what would amount to lawful authority, which is a laudable aim. However, there are real questions about whether some of the examples in clause 12 are not in fact redefining the concept of lawful authority. In particular, the assertion that there would be lawful authority simply because

“the communications data had been published before the relevant person obtained it”

is controversial. That is particularly so when

“‘published’ means make available to the public or a section of the public (whether or not on a commercial basis).”

As I said in relation to bulk personal datasets, limited publication is not authority for intrusive surveillance. Could a simple private message not amount to publication of comms data? The implications of this definition of lawful authority need very careful scrutiny indeed.

Finally, on the interception and hacking of parliamentarians, making provision for circumstances where the Prime Minister is unavailable to play his part in a triple lock seems sensible, but the fact that the issue of snooping on MPs and others is being revisited should trigger us all to rethink the whole scheme. Our role of representing our constituents, interrogating legislation and holding the Government to account should not be interfered with lightly. We should take the chance to consider post-surveillance notification of MPs who have been spied upon, by judicial commissioners, once investigations are completed. As matters stand at the moment, redress is almost impossible to obtain. We should also require that the investigatory power commissioners be informed every time these powers are used, so that there is transparency about how often this is happening. All other options should be on the table as well.

I started by thanking intelligence and law enforcement authorities and I am happy to do so again in closing, but our respect for them does not mean we should ever consider writing blank cheques or handing them whatever powers they ask for. They are not perfect. From time to time they exceed their powers and certain individuals abuse their lawful capabilities. The powers that they seek through this Bill are extremely invasive and broad in scope. There is a real danger that key provisions of the Bill will go beyond what is necessary and get the balance with privacy and human rights wrong. These provisions will need serious scrutiny and revision in Committee, and that is what we in the SNP will seek to secure.

--- Later in debate ---

[Mr Kevan Jones (North Durham) (Lab)]

Let me start by thanking our security services. I think I am now the longest-serving member of the ISC, and it is a privilege to work with them and scrutinise their work, as our Committee does. They do not get a great deal of publicity—for the right reasons—but when they do, it is sometimes not factual by any stretch of the imagination. They do an invaluable job, and in protecting our democracy, the threat that they face—that we all face—is changing, so the Investigatory Powers Act 2016 needs revising.

As my hon. Friend the Member for Wallasey (Dame Angela Eagle) said, the important point is that any new powers that we give the security services to act on our behalf should come with an equally balanced level of scrutiny and oversight. I see the scrutiny of our security as like a three-legged stool, with the Investigatory Powers Commissioner, the Investigatory Powers Tribunal, and the ISC. Well, actually, I would say that it is more like a two-and-a-half-legged stool, because the Home Secretary has done what most Ministers do; they say how wonderful the ISC is, how much they value our work, and that they want us fully involved—in passing this legislation, for example—but since 2017, when I first sat on the ISC, there has been a marked increase in lip service paid to it, as I think we see again in the Bill. As my right hon. Friend the Member for Normanton, Pontefract and Castleford (Yvette Cooper) said, we have not met the Prime Minister for 10 years—any of them; I think we had one who offered to come in the dying days of her Administration. We have taken evidence from the security services on the Bill, and I have to say that they are not the problem: it is the Government who are the problem all the time. That was the case with the National Security and Investment Act 2021. Frankly, it is an uphill struggle to get things changed in this Bill—changes that would not only improve the Bill, but make sense. One has just been highlighted by the Chairman of the ISC, the right hon. Member for New Forest East (Sir Julian Lewis).

On occasions, it is a bit like going round in circles. I will give an example. We have actually made one little advance in the other place, in terms of acceptance of the changes to do with the triple lock. Now, though, the sensible thing we are asking for—that it should be in the Bill that the Prime Minister should actually see those warrants—is being resisted as though it would somehow stop the world. I am sorry, but I do not think it would. I think the Government believe that they have to be seen to be resisting any changes. I like the Minister, but the passage of the National Security and Investment Act was a pretty dark day for the Government’s relationship with the ISC, because we had to fight tooth and nail to try to get anything changed in that Bill.

[Tom Tugendhat]

I was not in the Government then.

[Mr Jones]

I think the Minister was, actually. I think he picked up the tail end of that Bill.

The ISC has looked at this issue in detail. We have taken evidence from the heads of the security services, and we want to be supportive of change, but we also want that important role of scrutiny and ensuring the public are protected from the occasions when things might go wrong. The other thing that struck me today is that, although the Home Secretary can read a good speech, I am not sure he had a great grasp of some of the detail of the Bill. All I ask of the Minister is to please take on board some of the things we are saying, so that we can make progress in Committee. They are not radical things that are going to upturn the Bill; they are things that will improve it. I suspect that in certain parts of the Government there is a hatred of the ISC, and the belief that we have to be resisted at all costs. That will lead to a poorer Bill, because the amendments we will be tabling would actually improve the Bill. Lord West also did a great job in the other place.

I now turn to clause 2 of the Bill, which introduces the bulk personal data regime. There is a worrying gap: oversight of what are deemed low or no privacy datasets added to category authorisations. At the moment, the system does not work, because things like the electoral register have to get special permission. That is silly, frankly, but we need to ensure that these provisions are scrutinised.

New part 7A of the Investigatory Powers Act 2016, introduced by clause 2, provides for a light-touch regime for the retention and examination of bulk personal datasets by the intelligence services where the subject of that data is deemed to have low or no reasonable expectation of privacy. As the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) said, people are increasingly giving their personal data with little thought to how it is going to be used—not just by the intelligence services, but for commercial purposes. That needs looking at.

Approval of such a dataset will be sought either under a category authorisation, which encompasses a number of individual datasets that have a similar content and may be used for a similar purpose, or by individual authorisation, which covers a single dataset that does not fall neatly into a category authorisation or is subject to a complicating factor. For a category authorisation, a judicial commissioner will approve the overall description of the category authorisation before it can be used. A judicial commissioner will approve renewal of the authorisation after 12 months, and the relevant Secretary of State will receive retrospective annual reports on the use of category and individual authorisations.

However, as the Bill is currently drafted, this oversight is all retrospective. The problem is that what is missing is real-time or even near real-time oversight of changes. Under the present regime, once a category authorisation has been approved, the intelligence services have the ability to add individual datasets to that authorisation through internal processes alone. They examine the dataset without being subject to any political or judicial oversight, and they would be able to use those datasets for potentially a year without anybody being any the wiser.

We do not question why the security services need these powers, but there is potential for mission creep without any oversight of what is being authorised. We are not saying that these powers are not required; they are required. What we are really being asked to do is rely on the good faith of the intelligence services to use the powers in a certain way. I do not think that is strong enough, and no legislation should be solely dependent on good will. We also have to guard against—there are such occasions—situations when mistakes happen or people use powers for purposes that are not in the public interest.

It is important that we fill this 12-month gap, and the ISC thinks that the easiest and simplest way to change this process would be for the Investigatory Powers Commissioner to be notified when an individual bulk personal dataset is added by an agency to an existing authorisation. I understand that Lord Anderson of Ipswich, in his review of 2023, recommended a similar proposal. The argument from the Government—it is similar to what they have used throughout this Bill, as the Committee Chairman has remarked—is that that will be onerous in adding to the work of the intelligence services. Well, it would not, because it would simply mean sending a one-line email to the Investigatory Powers Commissioner containing the name and description of the bulk personal dataset as soon as reasonably practicable.

The decision would be approved internally and then sent to the Investigatory Powers Commissioner, so it is not actually asking for approval. It is just making sure that the Investigatory Powers Commissioner is aware of what is being added, and that the individuals taking such a decision realise that they must inform the Investigatory Powers Commissioner. That would obviously allow the Investigatory Powers Commissioner to look at trends in what is happening. Clearly, after the 12 months, they could look back, but they could also intervene if they thought something was not in touch.

An argument the Government use quite often about this Bill is that it is to have a light-touch approach, and I think this suggestion is for a light-touch approach. I do not know what is onerous about the security services sending an email to the Investigatory Powers Commissioner. I think it would ensure the oversight that is needed. Real-time oversight is what we are suggesting, and I do not think it would add to the administration of the security services, but it would lead to the Investigatory Powers Commissioner at least having some visibility on another layer at which decisions are taken.

The proposal would be a very simple thing to do, and I do not understand why the Government are resisting it. I suggest they are resisting it for the many reasons they have resisted some of the other sensible things we have put forward: just because they want to do that. I do not know how we go forward with the relationship between this present Government and the ISC. Dragging information out of them screaming and kicking is taking a long time, even though we have a legal duty to get information, and the critical point now is the starvation of resources from the Committee which is creating real problems in the way that it can operate.

I hope that things change and that when we table amendments we will not get the usual response that amendments to this type of legislation should only be done in the Lords. Are we here to cause trouble for the security services? No, we are not; we want to ensure we do our job, which is set out in statute, to supervise the security services and improve the powers, but to ensure that the public have the recognised safeguards we should expect in a democracy such as ours.

--- Later in debate ---

[The Minister for Security (Tom Tugendhat)]

I thank hon. and right hon. Members from across the House for their contributions not just today, but throughout the many different stages of the Bill. I pay huge tribute to the Members of the other place who have contributed enormously, in particular Lord Anderson, who has been an exceptional asset to the passage of the Bill and the condition it is in, and Lord West who, as a member of the Intelligence and Security Committee, not only shepherded some extremely important amendments into the Bill, but was kind enough to say that it was the first time in 14 years that he had ever had an amendment accepted by the Government. I am delighted to say that it was to this Bill. It was because we are so committed to working with all parts of both Houses and with the ISC that we got so much through in the other place. [Interruption.] That said, many comments will no doubt be raised in this House. I can assure hon. Members, especially the right hon. Member for North Durham (Mr Jones), that I will approach all suggestions in the way that I have done to date. Where we may not agree—it may not be that he is right, or that I am right—it will be for good reason and I will set out my reasons in the appropriate way.

The Bill is about one fundamental thing: the security of the British people. We rightly heard from my hon. Friend the Member for Broxbourne (Sir Charles Walker) about the nature of freedom, but the truth is that freedom without security is impossible. It is a chimera. The Bill is about ensuring that the British people have the security to enable that freedom. That is an absolutely vital responsibility not just of this Government, but of this House and the other place. I am grateful for the work that the hon. Member for Barnsley Central (Dan Jarvis) and the shadow Home Secretary, the right hon. Member for Normanton, Pontefract and Castleford (Yvette Cooper) have put in to ensure the co-operative, bipartisan and open approach to the Bill, as is merited by the work of our fantastic intelligence services to provide security for our whole country.

As the British public would expect, we keep our approach to national security under constant review. Where we identify the need for change or improvement, we will not hesitate to act. That is why we have brought forward the Bill, which acts on the findings of the Home Secretary’s report and Lord Anderson’s independent review into the Investigatory Powers Act 2016. Hon. and right hon. Members will not need me to rehearse the arguments, but we have seen an extraordinary, rapid evolution in the nature of the threats since the 2016 Act: Russia’s threat to the whole of Europe and not just to Ukraine; the violence that Iran is trying to bring not just in the middle east but even on to our own shores; and the way technology has enabled hostile states not only to steal our technology but to introduce intelligence-gathering platforms into our country through the guise of car sales.

We have seen a change in the way technology works and a change in the nature of the threats, and we must keep up to date with those changes. That is why this work is so important. It is essential that the United Kingdom’s investigatory powers framework remains fit for purpose to help our intelligence agencies detect and stop some of the most serious threats posed to the UK and its citizens, including threats from terrorism, state threats, and child sexual abuse and exploitation.

Because these are exceptional powers, Members have rightly pointed out that they require appropriate, robust and, in this case, world-leading safeguards, and that is what we have sought to set out. The changes in the Bill are relatively narrow in scope, but unless we make them now, the ability of our agencies to tackle evolving threats will be increasingly constrained in the face of global instability, technological advances and state hostility, so now is the time to act.

Let me now deal with some of the points that have been raised. The hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) raised a rather interesting point about the changes to “lawful authority” in clause 12 in respect of published data. The purpose of new subsection (3A) is for material that has already been published not to require additional authority for its disclosure by a telecommunications operator to a relevant public authority. The definition of “publish” and reference to “a section of the public” would not include private messages unless they had been made public in some other way—just as our sitting room could not be considered a public place unless we opened it up to the public. It would be our choice, and nothing to do with the nature of the building.

The hon. and learned Member for Edinburgh South West (Joanna Cherry), who has made important contributions through her chairmanship of the Joint Committee on Human Rights, raised questions about the transparency safeguards in the 2016 Act. Those extremely robust safeguards are centred on considerations relating to intrusion into privacy, and that will remain the case in the Bill. They include a requirement for investigatory powers to be used in a “necessary and proportionate” way, with independent oversight by the Investigatory Powers Commissioner and redress through the Investigatory Powers Tribunal.

My right hon. Friend the Member for South Holland and The Deepings (Sir John Hayes) contributed in his usual robust fashion to the debate—and, I should add, to the session that I was fortunate enough to have with the Intelligence and Security Committee, in which he was enormously helpful in assisting me with some changes to the Bill. He spoke about the five individuals who could be designated by the Prime Minister, and asked why we had not referred specifically to “those with warranting powers”. It is possible that a Minister with warranting powers who had that experience would then be moved to another Department, or indeed that the machinery of government change would alter the nature of the oversight. While we felt that it was right to limit the number to as few as possible, we also felt that it was right to have a relevant selection, which is why we left the number at five—after some very good consultation with the ISC, for which I am extremely grateful to my right hon. Friend the Member for New Forest East (Sir Julian Lewis) .

[Sir John Hayes]

My right hon. Friend has been immensely generous both in giving way and in his earlier comments about my role. Will he briefly deal with the issue of the other bodies with the regulatory function who can compel the release of communications data? As he will remember, the point I made was that the existing law obliges them to take further procedural steps before they do so. Why is that no longer deemed appropriate?

[Tom Tugendhat]

As my right hon. Friend will know, several powers in the earlier Bill—the one that he took through the House—were indeed overseen in various different ways. The Bill does not seek to undermine any of that oversight; what it seeks to do is clarify, in certain areas, where it is necessary. My right hon. Friend has highlighted individual agencies or bodies, and I should be happy to write to him to ensure he is aware of exactly where that is being covered.

The right hon. Member for North Durham spoke about prior judicial authorisation for ICRs. The purpose of the Bill is to try to streamline operations for the intelligence services in areas where the risk is of, as we are calling it, low or no expectation of privacy. He will have seen in the Bill what the expectation means, including areas where information has already been readily made public. I accept his commentary and I would be happy to enter into further conversations with him, but the reason we are not currently going down that route is simply that the existing law, the IPA 2016, allows the collection of bulk data with prior authorisation. This is intended to speed the process up. If we put in the measures he is referring to, we would effectively remain in the same place that we are now. That would make it harder for the volume of data that is now coming to be considered by the intelligence agencies. That is why we have made the provision for a subsequent approval rather than a prior approval. He is right to say that it involves a maximum of a year, although I think it unlikely that it would go to that maximum. That will be in cases where this is low or no expectation of privacy—after it has already been agreed by a judge to be in the correct category. I think the right hon. Gentleman might be looking at this through the other end of the telescope.

[Mr Kevan Jones]

What the Minister has to realise is that the big concern from the public—although let’s be honest, the public are not looking at the detail of this—is that somehow the security services will be getting access to huge amounts of bulk data and just having a free run at it. All that I and the Committee are suggesting is that an email should be sent when there are changes to the Investigatory Powers Commissioner. That would be a simple thing. It would not be onerous, and it would reinforce the point that there was at least some potential oversight of the process.

[Tom Tugendhat]

I think we may be conflating different aspects of the Bill. I do believe that this already has oversight.

Let me answer the point raised by my hon. Friend the Member for Broxbourne, which touches on a similar area. Where people have the right to and expectation of privacy and freedom, this provision does not remove that right. What it does is allow the intelligence agencies to use bulk data to target an individual at a particular point, and the excess collected information will not be able to be used for targeting an individual without the warrant process that would be expected for any initial search. In that sense, this is not undermining anybody’s privacy; it is allowing for the fact that information is now largely in bulk format. The hon. Member for Barnsley Central was talking about steaming open envelopes. It is impossible to steam open a single envelope today; one has to steam open thousands because that is how data comes. Without an amendment such as that set out in the Bill, we would simply be interrupting the work of the intelligence services to the degree that it would hold them back and make the process harder, but I would be happy to take this up with my hon. Friend the Member for Broxbourne later if he wishes.

I thank the hon. Member for Halifax (Holly Lynch), who was here earlier and made an interesting point about the various ways in which the memorandum of understanding should be looked at through the National Security Act 2023. Friends of mine will know my thoughts on that and know that I gave the Conservative party the chance to allow me to change that 10-year absence, but the Conservative party chose somebody else to make that decision so I have sadly lost the ability to have that influence.

My right hon. and learned Friend the Member for Kenilworth and Southam (Sir Jeremy Wright) made a typically insightful speech and typically sensible comments on the ways in which we must consider how the authorisation must not be used to mount general surveillance. Condition D will be used only when an applicant makes a clear and compelling case, based on tangible, reliable intelligence leads, information and analysis, that the resulting data will identify parties involved in a relevant serious crime or national security-related specified operation or investigation. The applicant must explain any anticipated collateral intrusion, and how this will be managed to ensure that the application is necessary and proportionate to the outcomes of the investigation.

[Sir Jeremy Wright]

I accept what my right hon. Friend says but, in the context I described, the case is being made to someone else within the intelligence agency. There are, of course, two types of authorisation—D1 and D2—and we are worried about D2, under which the application is made from inside the intelligence agency to inside the intelligence agency. That does not present the sort of external scrutiny that we suggest is necessary.

--- Later in debate ---

[Tom Tugendhat]

My right hon. and learned Friend is right, but he also knows that IPCO has retrospective oversight of these areas. Where it comes under a category allocation through “low or no”, there is an automatic review period within a year. Although he is correct that the application is made within the service, it is within the service subject to a pre-agreed condition and with follow-up oversight, so as to enable that speedy response.

[Sir Julian Lewis]

On a different but not unrelated point, the Minister will recall that I referred to the annual report given to the Secretary of State detailing the individual bulk personal datasets that had been retained and examined. There is no extra work involved in letting the ISC and IPCO see that report. The only possible justifiable exclusion would be something that, at the time of the report, was still current. Is there any reason at all why IPCO and the ISC should not be sent that report, rather than a severely watered-down version?

[Tom Tugendhat]

My right hon. Friend answers his own question. The reason for the difference is the currency element.

[Sir Julian Lewis]

In that case, we can reach agreement if the Minister would like to give us an assurance that the only difference between the two reports will be the exclusion of matters that are current at the time of drawing up the report, but I suspect that there will be many other differences between the two reports.

[Tom Tugendhat]

I will be very happy to talk to my right hon. Friend about that to make sure that he is satisfied. It is important that we make sure that the reports that go to the House—through the ISC, because of the nature of the reports—are relevant and allow appropriate scrutiny. I think we can all agree with that.

I have covered the points raised by my hon. Friend the Member for Broxbourne, so I will turn to the hon. Member for Strangford (Jim Shannon), who made an extremely important point: that his constituents, like any other citizens of the United Kingdom, should expect the right to privacy. He also made a compelling point about the need for security, and I think the Bill strikes that balance extremely carefully. He is right to say that people will be concerned, and he is not alone. I am also concerned that we maintain the right to privacy within our legislative framework, which is why we checked very carefully that the Bill is fully compliant with the ECHR right to a private life. It is also why we looked at the various exceptions.

The hon. Member for Barnsley Central mentioned the notices regime, and he is right that we will keep it under review. We maintain a regular conversation with companies that have an interest in this area, and he is right to say that there is an overseas element. I merely point out that it is the role of this House to legislate for the security of the British people and, in particular, for the safety of our children and families. Such security is not something we can outsource to tech firms on the west coast. We sometimes have a responsibility to pass extraterritorial laws—as he knows very well, we have done that in the past—so although this measure adds to that ability, it is not detrimental because it asks people to maintain their current position before making any changes and to talk to us during that period. There is no requirement to break any policies, change products or introduce new products; it is merely to maintain the status quo, so that we have the same ability to keep the British people safe until we have had a conversation about how that status quo should change.

Finally, the hon. Member for Barnsley Central raised a question about trades unions. He is right that there are many different professions where protected characteristics could come into play, including lawyers, doctors and psychiatrists, and where any such intrusive power should be used with exceptional caution. I would just say that, due to the nature of this place and Parliaments around the United Kingdom, the position of parliamentarian is particular, which is why it is set out specifically and separately in the Bill. That does not mean that any attitude against any other individual should be used cavalierly. It is not a question of the role or the post the person holds, but their rights as a British citizen. Those rights should be absolutely guarded from intrusion or aggression by the state without exceptionally good reason. This amendment, which the hon. Gentleman is kindly supporting, sets out that balance between British citizens’ right to privacy and their right to security. With that, I commend the Bill to the House.

Question put and agreed to.

Bill accordingly read a Second time.

Investigatory Powers (Amendment) Bill [Lords] (Programme)

Motion made, and Question put forthwith (Standing Order No. 83A(7)),That the following provisions shall apply to the Investigatory Powers (Amendment) Bill [Lords]:

Committal

(1) The Bill shall be committed to a Public Bill Committee. Proceedings in Public Bill Committee

(2) Proceedings in the Public Bill Committee shall (so far as not previously concluded) be brought to a conclusion on Tuesday 12 March 2024.

(3) The Public Bill Committee shall have leave to sit twice on the first day on which it meets.

Consideration and Third Reading

(4) Proceedings on Consideration shall (so far as not previously concluded) be brought to a conclusion one hour before the moment of interruption on the day on which those proceedings are commenced.

(5) Proceedings on Third Reading shall (so far as not previously concluded) be brought to a conclusion at the moment of interruption on that day.

(6) Standing Order No. 83B (Programming committees) shall not apply to proceedings on Consideration and Third Reading.

Other proceedings

(7)Any other proceedings on the Bill may be programmed.—(Mark Fletcher.)

Question agreed to.

Investigatory Powers (Amendment) Bill [Lords] (Money)

King’s recommendation signified.

Motion made, and Question put forthwith (Standing Order No. 52(1)(a)),

That, for the purposes of any Act resulting from the Investigatory Powers (Amendment) Bill [Lords], it is expedient to authorise the payment out of money provided by Parliament of:

(a) any expenditure incurred under or by virtue of the Act by the Secretary of State or a government department, and

(b) any increase attributable to the Act in the sums payable under or by virtue of any other Act out of money so provided.—(Mark Fletcher.)

Question agreed to.