Criminal Justice Bill (Eighth sitting)

Alex Norris Excerpts

Committee stage
Tuesday 16th January 2024 Public Bill Committees

[The Chair]

I remind the Committee that with this we are considering schedule 3.

[Alex Norris (Nottingham North) (Lab/Co-op)]

It is a pleasure to resume proceedings with you in the Chair, Ms Bardell. I shall resist the temptation to start again for your benefit; I am sure you can look in the Official Report should you want to see the first part of my contribution.

I was talking about the inclusion of non-disclosure requirements in suspension orders, and I want to understand what the Minister thinks their function is. Is it to stop individuals who have had their domain name, IP address or website suspended or taken off them using it as a marketing tool or tool of notoriety? That would be a restriction on liberty and free speech, so I would be interested in the Government’s evidence base for that. Presumably, that must not apply to them talking to, say, their legal counsel, so what are the factors? There is no test in the Bill that a judge must apply.

Moving on to co-operation, since the internet by its nature is a global venture, we are glad that this is a four-nations provision, but there is some irregularity across the four nations, and I want to probe that with the Minister. Under paragraph 12 of schedule 3, in England and Wales, the “appropriate officers” who can make an application for an order are

“a constable…a National Crime Agency officer…an officer of Revenue and Customs…a member of staff of the Financial Conduct Authority, or…a person designated or appointed as an enforcement officer by the Gambling Commission under section 303 of the Gambling Act 2005”.

That seems quite a comprehensive list.

For Northern Ireland, the list is the same, except that it does not include the designated person from the Gambling Commission. Given the scourge of black-market gambling and the challenge it presents, is there not concern that it might be displaced to Northern Ireland? I wonder if the Minister might explain where he is up to with that. For Scotland, the list is just “a procurator fiscal”. That is a different approach. Presumably, it is the one favoured by the Scottish Government, but I hope the Minister might detail some of his discussions in this regard.

We know that many, if not most, of the sort of sites we have been discussing will be based outside the UK. The clause and the schedule give us a handy tool for UK-based ventures, but what more can the Minister tell us—he mentioned this a little in his opening speech—about his attempts to have some degree of harmony of regimes with our partners abroad, and what conversations does he think UK agencies should be having with their overseas counterparts to make sure that the powers that they have can be used to protect the British people?

[The Minister for Crime, Policing and Fire (Chris Philp)]

It is a great pleasure to serve under your chairmanship once again, Ms Bardell, and I hope that we get to do so many more times during the Committee’s remaining sittings. I thank the shadow Minister for his considered contribution on clause 20 and schedule 3. I will turn first to his questions regarding the conditions set out in schedule 3, in particular at paragraph 4.

Condition 1 sets the threshold for this power to be available to investigative agencies such as the National Crime Agency and the police, meaning that those agencies cannot apply for an order unless the IP address or domain name is being used in serious crime. Condition 2, which operates separately and additively, requires a connection to the UK jurisdiction, and any one of the four limbs listed at paragraph 4(3) can apply; as the hon. Gentleman correctly identified, the word “or” is used at the end of paragraph 4(3)(c), making it clear that only one of the limbs (a) to (d) in condition 2 have to be met. If one is met, that is sufficient for condition 2 as a whole to be met. Those four limbs specify different ways in which the domain name or IP address might link to serious crime in the UK’s jurisdiction. I hope that that makes it clear how those conditions operate.

The hon. Gentleman also asked why the non-disclosure power was needed. Its purpose is simply to prevent the criminal behind the IP address or domain name from being tipped off, inadvertently or otherwise, that a law enforcement agency is looking into them. We would not want the criminals to know they were being looked at. That is why the provision is constructed in that way.

The hon. Gentleman asked about territorial applicability. The Gambling Commission is principally an England and Wales body, and has only very limited functions in Northern Ireland. However, typically, if a gambling service is made available on the internet, it will be available in Northern Ireland as much as in England and Wales. If we go after a service provider in relation to a breach in England and Wales, shutting down the domain or IP address will also have the effect of preventing it from being accessed elsewhere.

For Scotland, the definition of “appropriate officer” is limited to a procurator fiscal. That reflects the different arrangements in Scotland and our discussions so far with the Scottish Government. Generally speaking, we respect the view of the Scottish Government when it comes to the application of the law in Scotland—I am sure Ms Bardell would impartially endorse that from the Chair. Where the Bill touches on devolved matters in relation to the Scottish jurisdiction, we correspond with the Scottish Government and proceed in general—I would not say always—by mutual consent.

For the reasons that we have already discussed, we can all welcome the purpose of clause 20 and the accompanying schedule 3. I therefore commend them to the Committee.

Question put and agreed to.

Clause 20 accordingly ordered to stand part of the Bill.

Schedule 3 agreed to.

Clause 21

Access to driver licence records

--- Later in debate ---

[Chris Philp]

Clause 21 will facilitate the ability of police and other law enforcement officers to access driver information from the Driver and Vehicle Licensing Agency automatically at the point of need for all policing and law enforcement purposes. The clause contains provisions for regulations and a code of practice to enable changes to be made for the purposes of access to driver data.

Police and other law enforcement officers frequently need to deal with unpredictable circumstances while operating under time pressure, and the police have provided compelling operational examples in which they could deal better with threats and harms faced by the public if they had direct and automatic access to DVLA driving licence data. That is why the Bill contains this clause.

Currently, automatic access to the DVLA driving licence data is limited to matters concerned with enforcing road traffic offences and Road Traffic Act 1988 purposes, which means that the police do not have automatic access to driving licence data for other purposes, such as investigating wider types of crime. They do have manual access to the data, but that is quite laborious and takes a long time. The clause builds on an existing regulation-making power and requires the Secretary of State to make regulations specifying the purposes for which, and the circumstances in which, the police can automatically access the driving licence database, so that all policing and law enforcement purposes are included.

The clause essentially expands an existing manual process and makes it automatic. At the moment, the automatic access applies only to road traffic matters. Given that we hold this data, I am sure that members of the Committee would expect the police to be able to access it in pursuit of criminals. Through the clause, we are delivering on our commitment to support the police by providing them with the tools they need. Members will recall that in the oral evidence sessions back in December, we heard support for the provisions from the National Crime Agency, the College of Policing and His Majesty’s chief inspector of constabulary and fire and rescue services, Andy Cooke.

We are also taking the opportunity to make the legislation simpler and more transparent. Under the current system, some law enforcement staff have access to the DVLA driving licence database and others do not. The clause allows all police and law enforcement organisations listed in proposed new section 71(4) of the Criminal Justice and Court Services Act 2000 to access DVLA driver information. It also changes the current legislative quirk whereby police staff are defined by law as police constables solely for the purpose of DVLA driver data, which is rather anomalous. It will define those permitted to access DVLA driver data as “authorised persons”, and regulations will set out the process for those individuals to become authorised.

We are conscious that police access to such personal data needs to be reasonable and proportionate, as set out in existing data protection legislation. That is why the clause will bolster the governance arrangements in this area by making them more transparent and straightforward, in preparation for the regulations that will broaden the access regime. In particular, the clause makes it clear which bodies can access DVLA driver data, which is necessary as the current legislation could be improved upon. There is a mechanism to amend the list of organisations that have access, while requiring the chief officer to be responsible for ensuring that appropriate training and oversight is provided by their organisation. That obviously includes the delivery of their data governance obligations.

Government amendment 33 ensures that if regulations amend the list of law enforcement bodies in subsection (4) of proposed new section 71 of the 2000 Act, such regulations may make consequential amendments to section 71—for example, to the definition of “chief officer”. Amendments 34 and 35 clarify the meaning of the term “chief officer” for each of the listed law enforcement agencies.

With your permission, Ms Bardell, I will speak to amendment 60 once I have heard the shadow Minister’s comments so I can respond to them. I hope I have set out why it is important that we put on a sounder and clearer footing the organisations and individuals who can access this data, and lay the groundwork to make automatic access possible for law enforcement purposes. I am sure we can all get behind that.

[Alex Norris]

I want to speak to amendment 60 in my name. I do not know whether the Official Report can capture this, but my feeling is, “Hmm!” There are things I hoped the Minister would say, not least because it would have reduced my contribution by half, but he did not, so I will have to see whether I can get him to say them.

This is a very important clause. It is a long-standing, accepted principle that under certain circumstances police officers can use driver information held by the Driver and Vehicle Licensing Agency. At the moment, it is for purposes related to the enforcement of road traffic offences. It is a well-established and uncontroversial principle that officers can talk to the DVLA and get information. We have no quibble with the clause seeking to make that a smoother process, and we have no problem with subsection (4) of proposed new section 71 of the 2000 Act, which broadens and clarifies who can ask for that information, but the clause potentially contains a very broad extension of powers.

Paragraph 370 of the explanatory notes says:

“This clause replaces existing section 71 of the Criminal Justice and Court Services Act 2000 with a new section 71, and inserts a new section 71A into that Act. It provides for police and law enforcement bodies to have access to driving licence data held by the Driver and Vehicle Licensing Agency (“DVLA”) and provides powers for the Secretary of State to make regulations concerning the purposes for which such data may be used and any conditions which need to be met by any person accessing the data.”

That is a really significant change. The police had access to DVLA information in relation to a very narrow set of offences, but the clause is essentially saying that the information is fair play for enforcement agencies, subject to whatever regulations a Secretary of State may set in the future. That is an egregious use of Henry VIII powers. If the Government have a regime in mind, they should say what it is. Instead, we are possibly giving over the entire DVLA database to the Secretary of State, and it is currently not clear what it will be used for.

[Chris Philp]

First, for clarity, I should say that the purpose for which the information might be made automatically accessible is circumscribed by the words at the very end of the newly created section 71(2), which says the that Secretary of State

“may prescribe only such purposes and circumstances as are related to policing or law enforcement.”

It is not for any purpose; it has to be related to policing and law enforcement.

Secondly, I pointed out that the police already have the ability to access the data manually for police and law enforcement purposes. The clause simply paves the way for them to do what they currently do manually and instead do it automatically, provided that it is for a police or law enforcement purpose.

I hope those two points give some reassurance that the clause is not some gigantic land grab. It simply makes automatic what is currently manual and it is circumscribed in the way that I described.

[Alex Norris]

The second point and the tone of the Minister’s contribution certainly give me a degree of comfort. The first point does not give me any comfort at all. The line that he quoted, which provides that the Secretary of State

“may prescribe only such purposes and circumstances as are related to policing or law enforcement”,

is a landing zone as wide as could possibly be needed to give police access to the DVLA database for all sorts of things. I will get on to that shortly. I would be delighted if the scenarios I am about to talk about are not what the Government intend, or even silly ones. I do not think that is the case, but I will be the gladdest person in the room if it is.

At the moment, I think the public would think there are sensible uses of the data, such as to double-check the last known addresses of a wanted person. Taken in extremis, however, the clause could mean that all the photos on the DVLA database become fair game for law enforcement. There are 41.2 million vehicles registered with the DVLA. We are talking about the data of tens of millions of people and, crucially, their photographs. The landing zone that I described under subsection (2) of proposed new section 71 means that someone’s photo could be used for a huge range of things.

Starting from where we think the public would be on this, the public expect and know that retrospective facial recognition is already used routinely. If a person commits a crime, they know that their custody photo will be held on file and that, if they are convicted, it could be held for six to 10 years, depending on the nature of the offence. It is a tale as old as the technology that the photo might subsequently be checked against footage relating to another crime and used for its detection. Similarly, if someone commits an act that means that their DNA is kept on file, that might be used in relation to unsolved crimes that happened in the past or to tackle offending in the future. All that is sensible.

On both fronts, we start in a sensible place, with the use of the DVLA database for cross-references to help detect crime, and the use of photos of offenders that lie on file to detect crime. The risk comes when we mix those two sensible principles.

[Peter Dowd (Bootle) (Lab)]

I have listened carefully to my hon. Friend. Does he agree that there is a danger that we will get mission creep and, more importantly, that the public will see it as such? As time moves on, we will get another bit, another bit and another bit.

[Alex Norris]

I absolutely agree, and that is exactly the point I am about to make. It is a legitimate anxiety. If that is wrong and I am somehow being conspiratorial, albeit it is not my nature, the Minister can tell me and that would give me a degree of comfort, but I think, and it has been expressed to me by interest groups, that there is a legitimate anxiety that the clause could mean that the police will access tens of millions of driver photos to solve crimes.

There is a problem with that on two fronts. First, we have the question whether that is a fair balance between individual liberty and collective safety. If that is what the Government want, we need to have that debate much more clearly before we get to these specifics. Secondly, certainly for the photos that are on file today, probably each one of us in the room, Members and beyond, is on that database, but none of us will have given our photograph with informed consent, knowing they were going to be used for the proposed purpose. That is a huge problem, not least because it is a kind of coercion. I would still give my photo on that basis, because the ability to drive is fundamental to my needs—certainly for work, never mind family life. But, again, it is a form of state coercion, rather than something that would necessarily be the right thing to do. Many people—many of my constituents, I know—would not consent on that basis. We live in an age of high-profile conspiracy theories and those who make an industry of them, and we should not give grist to the mill of yet another one.

[Chris Philp]

rose—

[Alex Norris]

I give way to the Minister; nothing would please me more than to be contradicted.

[Chris Philp]

Existing DVLA data, including photographs —I have a driving licence; I am sure that the hon. Member has one and everybody on the Committee probably does as well—can already be searched by the police; or rather they can request information on a manual basis. That can happen already, to each and every one of those 40-odd million records, for law enforcement purposes. That has a statutory basis, via schedule 2 to the Data Protection Act 2018, which allows access to that kind of data for police and law enforcement purposes. The principle of police access to that data for law enforcement purposes is already there.

I pose a brief example: if somebody was wanted for an offence such as rape, and the police could not track them down and they were not on the custody image database—let us say that they had never been into custody—would the Committee want the database to be searched to see whether a recognition match could be obtained to find that person? That can happen at the moment, and I think that is right. I would like to check whether the shadow Minister agrees.

[Alex Norris]

There is a significant difference between what the Minister talks about, which is using, on an individual basis, information that is available to cross-reference—perhaps to deal with known aliases or known addresses—and where this could go. I mean a broad-scale use of surveillance, seemingly without any guardrails, that would essentially allow tens of millions—I think it is in the 40-something millions—of photos to be put on essentially the same footing as photos from the custody suite.

[Peter Dowd]

I heard the Minister’s intervention, but I am increasingly concerned about the point I made about mission creep and proportionality. That is what we must bear in mind. Would my hon. Friend agree? This partly goes back to amendments 61, 58 and 59: let us be as precise and specific as we can—in fact, let us have some control rather than this mission creep, and always have human rights and the question of proportionality in the back of our minds.

[Alex Norris]

“Proportionality” is the exact word here. It is about finding balance, as I say, between individual liberty and our collective safety. If we are saying that, in all instances where the police have a photo of a possible offender, we have complete comfort about their searching the entire DVLA database to try and identify that person—well, that is a very significant change. I would argue strongly that that is different from saying, “Well, we think we might know who it is; let’s apply for the driving licence of an individual.” I think that the public would see a big difference.

The issue becomes even more important given the pace of technological change; we have been talking about retrospective facial recognition technologies here, but live facial recognition technologies are developing at breakneck speed: cameras can scan huge crowds of people, check who they are and flag persons of concern. The Minister, I think, has a degree of enthusiasm for that technology; it is a plank of his plans around violence against retail workers, and shop theft more widely.

I recently visited South Wales police because I wanted to understand the use of this technology. With your indulgence, Ms Bardell, I will take this opportunity to put on the record my thanks to the police and crime commissioner for South Wales, Alun Michael, for his work. He is stepping down from public office at May’s elections after more than half a century in different posts. He has sat in the chair that I occupy; he has sat in the chair that the Minister occupies; he has sat in Cabinet, and he is one of the few PCCs to have served the entire 12 years of that post’s existence. His is a life of extraordinary public service to the UK and Wales, and to Cardiff, and we have been very lucky to have him.

As I was saying, South Wales police is very much in the vanguard of facial recognition technology. In a recent oral questions, the Minister graciously made reference to the work of South Wales police in this area, particularly the oversight that it is doing through the PCC’s office, which may well be a good model—in fact, it very much is. However, it is not without controversy, partly because it is in the vanguard and that sort of disruption is generating significant public interest.

There was quite a bit of public debate around one of the events in question: a Beyoncé concert at the Principality Stadium. That was a huge event. It had incredible hype; people really did everything to try to get tickets. Live facial recognition technology was used at that concert. The police advertised it, defined a public watch list, and said, “We are looking for anyone who is a known terrorist, in light of the Manchester bombing, and for paedophiles, in view of the likely attendees of the concert.” That probably finds the right balance: the public are informed and there is a defined watch list. There is a degree of common sense there.

As I said, what South Wales police have put in place, and what I think we are going to see across the country, is a model where we have civilian balance to the operational independence of the police and where the public’s representative, as we have in England and Wales in the form of police and crime commissioners, is able to know what is happening and to have public oversight. However, there is a real risk around how that sort of technology could be combined with the powers in this clause. The use of live facial recognition technologies could be combined with the entire DVLA photo database for the purposes of live blanket surveillance. I do not think that is what the Government want, but I do think that we have to hear that they do not. Relying on Henry VIII powers makes it even worse.

It is welcome that, according to proposed new section 71A of the Criminal Justice and Court Services Act 2000, a code of practice will be issued. That is really important, and speaks to my amendment 60, which is a pretty basic attempt to put some degree of parliamentary guardrail on to this new technology and its use in law enforcement. It states that once the Bill has received Royal Assent, a report on its usage must be published by the Secretary of State on an annual basis. I will be honest: I am not precious about the form that that should take, but I am precious about technology that has moved at great pace and with which there has been very little parliamentary engagement at all.

Stronger guardrails should be set. We have to be really cautious about other changes we might make, such as those in clause 21, that would mean that a significant database could be used for proactive surveillance of people who have never done anything other than apply for a provisional licence. That point could be held, but we would have to argue with the public and build public confidence around it. We would have to be shown the evidence for the effectiveness and the operational cases. I do not think the Government have done that.

My hope is that I am taking the issue far beyond what the Government intend. I will be very glad if that is the case. Part of the problem is that we are relying on regulations when we have no idea what their form will be. I stop at this point. I hope the Minister will be able to give the Committee some comfort.

[Vicky Ford (Chelmsford) (Con)]

I have listened extremely carefully to the shadow Minister and the Minister. I take issues of data protection and privacy very seriously, but I also believe that members of the public expect us to try to keep them safe, and expect the police to be able to use technology to try to keep them safe.

I listened to what the hon. Member for Nottingham North said about the facial recognition technology used in south Wales. Those same south Wales cameras were used last half-term in my constituency of Chelmsford and in Southend in Essex. As a result, a number of individuals were arrested, including somebody who had come into Chelmsford from outside and was wanted for a very high-profile sexual offence. What the Minister has been saying about being able to use this technology to arrest rapists is not hypothetical; it has happened, and it happened in my constituency in Chelmsford.

[Alex Norris]

I am sorry to ask the right hon. Member to give way, because I have said so much—but I guess the point I was making about the Beyoncé concert was about having a defined watch list of people known and suspected of having done significant crimes. Such measures feel like a proportionate tactic to apprehend them, but is that enough for us to say that therefore everybody’s faces ought to be in play, even though the vast majority have never done anything wrong?

--- Later in debate ---

[Chris Philp]

That is a really good question and I do not know the answer to it. However, I can certainly find out and come back to the Committee. I know that this technology can be used to find missing persons. If someone has gone missing, the police can do a search and see if they pop up somewhere.

As for finding witnesses, of course the witness has not committed a crime, so one would have to be a little bit careful about infringing on their rights. However, I will take that question away and get an answer, and I will write to the hon. Lady and the shadow Minister, and indeed the rest of the Committee, because it is a very good question. I am afraid that, as I stand here today, I do not know the answer, but that could help to find witnesses.

[Alex Norris]

The Minister is being very generous with his time. There is a degree of comfort with the point about regulation. If concerns continue to grow about the use of DVLA data in retrospective facial recognition, Parliament will have its day. And on that basis, I will not divide the Committee.

However, I want to press the Minister on something else. He is right to say that this clause is an enabling clause, but he must have an idea of what he wants it to enable. Why is it in the Bill? The Government must have something in mind for it; otherwise, there is no point in it standing part of the Bill.

[Chris Philp]

I think that I have just spent the last five minutes or so—

[Alex Norris]

So it is for that, then.

[Chris Philp]

It could be; that is certainly a possibility that I have in mind. If those regulations were brought forward, and maybe there would be some further clarifying codes of practice and so on that will be needed as well, it would in theory be possible to bring forward regulations such that, if the person or the suspect—it might be the murderer in that Coventry nightclub, or the sex offender on that bus. Imagine if their image was not on the custody database; imagine that they had never been arrested, or convicted, or anything. The police did not have their picture; they would not have found them. It would obviously be useful, particularly for more serious offences, to be able automatically to search other facial image databases besides the custody one, in order to catch the rapist, the serious sex offender and so on.

The hon. Member for Birmingham, Yardley asked a question about her son. There is a question of proportionality here. For example, regarding this database, in these regulations one could—this is not for the Committee today, but I am just saying it—specify a threshold, and say that this would only be used for crimes over a certain level of seriousness. Obviously, rape and murder would meet that. GBH, drug supply, firearms, knives and so on, might also be specified, but a parking ticket would probably not be. In these regulations—this is one of the reasons why the wording is flexible—one could specify that threshold, and we would obviously then debate where that balance should lie. One does have to be cognisant of proportionality and privacy considerations, as indeed data protection law in any case requires us to do.

I hope I have given the Committee a bit of a flavour of how these regulation powers—