Investigatory Powers (Amendment) Bill [Lords]

Joanna Cherry Excerpts

2nd reading
Monday 19th February 2024 Commons Chamber

[Joanna Cherry (Edinburgh South West) (SNP)]

On that point, will the Home Secretary give way?

[James Cleverly]

I will, but I do want to make some progress.

[Joanna Cherry]

I thank the Home Secretary for giving way. He mentioned listening to scrutiny by the ISC. The Joint Committee on Human Rights has issued a call for written evidence on the Bill, and as he will know from the human rights memorandum, the Bill raises important human rights issues relating to the rights to privacy and to freedom of expression, and possibly the right to an effective remedy. Will he therefore undertake to look closely at any correspondence that the Joint Committee might send him when we have completed our scrutiny of the Bill?

[James Cleverly]

I reassure the hon. and learned Lady that we will do exactly that.

I turn to the measures in the Bill. We are creating a new regime for bulk personal datasets that have low or no expectation of privacy: for example, certain datasets that are widely publicly or commercially available. Bulk personal datasets are an essential tool to support our intelligence services in identifying fragments of intelligence within a large quantum of data, in order to disrupt threats such as terrorism and hostile state actors. The Bill seeks to create a new statutory oversight regime for how the intelligence services access and examine bulk personal datasets held by third parties. It will place that oversight on a statutory footing, increasing the transparency of the regime. The regime will be subject to strong safeguards, including the double lock.

We are also making changes to the notices regime that will help the UK anticipate and address the risk to public safety of companies rolling out technology that precludes lawful access to data. We want to work with those companies to achieve common goals, but we must have the tools available when collaboration falls short.

--- Later in debate ---

[James Cleverly]

The lengths that some people will go to to avoid Committee scrutiny. I am trying to remember where I was; it has been such a long time since I looked down the page of this speech. All such applications must be necessary and proportionate and subject to independent authorisation or inspection.

The Bill will also strengthen safeguards for journalistic material within the Investigatory Powers Act’s bulk equipment interference regime, aligning it with changes to the bulk interception regime that are under way to ensure compliance with obligations under the Human Rights Act 1998. Prior judicial authorisation will be needed before material obtained through bulk equipment interference can be selected for examination using criteria where the purpose is to identify, or is highly likely to identify, confidential journalistic material or confirm a source of journalistic material. Prior judicial approval is also necessary before such material may be retained for purposes other than its destruction. The other measures in part 5 of the Bill will ensure that the resilience and protections of the regime are maintained and enhanced.

The Bill will also make improvements to support the Investigatory Powers Commissioner in effectively carrying out their role, ensuring that the world-leading oversight regime remains resilient, including powers to enable the IPC to appoint deputies, delegate some of their functions to judicial commissioners and the newly created deputies, and put certain functions on a statutory basis. The Bill will ensure there is a clearer statutory basis for reporting errors to the IPC.

[Joanna Cherry]

I sense that the Home Secretary is coming to the end of his speech. We have mentioned parliamentarians and journalists, but I want to talk about another important group: trade unions. Some people fear that the Bill will open the door even further than its parent Bill on the surveillance of trade unions. Does the Home Secretary agree that there should be no place for the surveillance of trade unions in a democracy? If so, will he consider amendments to the Bill to ensure that that does not happen, including a redraft of clause 5?

[James Cleverly]

I take the point that the hon. and learned Lady puts forward. There are a number of organisations not explicitly mentioned in the Bill where that argument could be made, and I am not sure it would necessarily be useful or right to list them all, but I will take on board the point she makes in good faith—genuinely.

The Bill will bring the Investigatory Powers Act up to date with the modern age, provide greater clarity, make the system more resilient and retain the world-leading safeguards of civil liberties and commercial integrity. Above all, the Bill will mean that the men and women who work so incredibly hard to keep us safe, often without recognition, have the tools they need to do so in the modern era. I therefore commend the Bill to the House.

--- Later in debate ---

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

Let me start with two thank yous. First, let me put on record my party’s gratitude to the intelligence services and law enforcement organisations that work so incredibly hard to keep all our citizens safe in the face of constantly changing and developing threats. Secondly, I thank all those who took part in the reviews of the 2016 Act that have informed the Bill. However, as Lord Anderson said in his own review, they should be a starting point for parliamentary scrutiny and debate rather than a finishing point.

Although any opportunity to revisit and improve the 2016 Act would generally be welcome, my party has serious concerns about certain provisions in this amendment Bill. In short, while it is constantly presented as “updating”, and as protecting and making efficient pre-existing powers, we fear that the reality is a very significant expansion of what are, we must remember, already extraordinarily wide powers by international standards. There are significant privacy and human rights risks, and the danger of increasingly widespread suspicionless surveillance. We fear that we may be handing invasive powers to intelligence and law enforcement agencies not because the powers are necessary or essential to their work but because they are convenient, and that is not striking the right balance.

All this is consistent with the very detailed and principled privacy and human rights concerns that my party raised in relation to the 2016 Act itself—particularly in the speeches made by my hon. and learned Friend the Member for Edinburgh South West (Joanna Cherry), who is here to take part in the debate again today. As will be the case today, we did not oppose the Second Reading of that Bill, but in the absence of important amendments, or concessions and reassurances—again, as with the 2016 legislation—we keep open the option to oppose the current Bill at a later stage.

Today I will focus on concerns relating to bulk personal datasets, and on notices relating to changes in telecommunication services. I will also briefly flag up our concerns about internet connection records and changes to the offence of unlawfully obtaining communications data. My party also believes that this Bill provides an opportunity to revisit the whole issue of snooping on parliamentarians, if we are bold enough to take it.

I shall turn first to bulk personal datasets and part 7 of the 2016 Act. In short, we struggle to see that the proposed changes have been shown to be necessary. We fear that they will instead create even larger gaps in the oversight regime in relation to these capabilities. A whole host of concerns arises in relation to the provisions of clause 2 and the concept of data in relation to which there can be

“low or no reasonable expectation of privacy”.

Bluntly, I struggle to see how a decision maker is supposed to assess people’s reasonable expectations of privacy, and when we say “people” we can be talking about hundreds or thousands of people or potentially several million people. Within that group of individuals there will be many varying attitudes to further privacy, and the data related to individuals could vary hugely from the mundane to the deeply personal. It may be that there is supposed to be some type of “reasonable person” test applied, but is that reasonable person black, gay, Jewish or indeed a trade unionist? How are potentially very different subjective attitudes to be accounted for? These might seem like odd questions, but the experience in the United States of America, where a similar test is involved, proves that these questions are very real indeed. Is it a general question of privacy in relation to the data or a more specific question of expectations of the use of that data by intelligence services? What precisely is low expectation? This seems to be an impossible assessment to undertake in any realistic or meaningful sense.

[Joanna Cherry]

I thank my hon. Friend for his kind comments earlier. As usual, he is making a very forensic speech. On this issue of a reasonable expectation of privacy, does he agree that clause 2 and clause 11(3) seem to be based on a legal misunderstanding that people lose their right to privacy when they happen to share certain information with someone else? He will be as aware as I am that that runs contrary to the jurisprudence of the European Court of Human Rights and that, by contrast, the Court has actually said that privacy includes

“the right to establish and develop relationships with other human beings”.

Does he agree that it is important to ensure that this Bill is commensurate with our obligations under the European convention on human rights?

--- Later in debate ---

[Sir John Hayes (South Holland and The Deepings) (Con)]

Hegel said, “What is reasonable is real, and what is real is reasonable.” In facing the very real threats that pervade, it is certainly reasonable that we equip those missioned to keep us safe with the powers they need to do so. That is partly about putting in place a legislative framework that allows them to counter those threats, for we know what will happen otherwise. We sit in this Chamber graced by the coats of arms of our former colleagues Jo Cox and David Amess. We in this place know what it means when those missioned to keep us safe are unable to do so.

On that basis, I was proud and pleased to take the original Investigatory Powers Bill through this House—some veterans of its passage are in the Chamber tonight—and, in doing so, we were conscious of the need to strike a balance between, on the one hand, providing the powers and equipping the police and the security services with the necessary mechanisms to do their job and, on the other hand, retaining both the privacy of individuals and putting in place the necessary safeguards mentioned by the shadow Home Secretary, the right hon. Member for Normanton, Pontefract and Castleford (Yvette Cooper).

That balance was at the heart of our considerations then. I am conscious that I said in that debate:

“It is important to understand that privacy is at the very core of the Bill… The protection of private interests and the protection of the public are at the heart of all we seek to do”.––[Official Report, Investigatory Powers Public Bill Committee, 12 April 2016; c. 90.]

That remains so, but it is also important to recognise that we always anticipated that the legislative arena was bound to require a dynamic approach, of the kind we are discussing this evening, and that we would need to update the legislation to deal with the changing character of the threats I described. It comes as no surprise that the Government have introduced legislation to do just that, to add to what is already on the statute book and to make it more appropriate.

[Joanna Cherry]

The right hon. Gentleman and I often crossed swords during the passage of the 2016 Act, but we have since reached a point of rapprochement on discovering our mutual passion for the importance of freedom of expression. From what he is saying this evening, I think we can also agree on the importance of privacy. Of course, that comes from the right to a private and family life under article 8 of the European convention on human rights. Does he agree that it is unfortunate, given this Bill’s huge implications for our constituents’ privacy, that the Government have decided not to conduct a privacy impact assessment? Surely such an assessment is vital, and it is perhaps something upon which he and I can again, rather unusually, agree.

[Sir John Hayes]

Our agreements are becoming rather less unusual. I do not know whether that gives the hon. and learned Lady any pleasure, or whether it causes her pain. None the less, she is right that, when we consider such legislation, it is important that it is scrutinised to an even greater degree than we would normally expect in this place.

The 2016 Act was considered by three Committees of this House. It was subject to pre-legislative scrutiny by a Joint Committee of both Houses of Parliament and, indeed, the bulk powers, which have been mentioned, were subject to an independent review by David Anderson, who has since been elevated to become Lord Anderson.

The hon. and learned Lady is right that the need for scrutiny is profound, particularly when we equip organisations with extensive authority to invade private space. Of course, we will not know much of what they do. Many of the individuals involved in the security services and the police, and the work they do, are rightly unknown to all but a few, so it is all the more important that, in giving them such authority, we behave in the way that the hon. and learned Lady describes—I am now adding to the small, two-person coalition formed between us.

It is right that the legislation is updated to make it fit for purpose. The ISC, of which I am also proud to be a member, has been told of the need for urgent, targeted and necessary changes. When we consider this Bill, we should test whether its provisions are indeed urgent, targeted and necessary. I am not absolutely convinced that all we see before us passes that test, and I will say a little more about that when I come to clause 14 and its associated schedule.

There is more expertise in the Chamber tonight than I could possibly imagine but, by way of background for the wider audience, I will say a word about what the 2016 Act does and why this Bill therefore matters. The Act provides the law-enforcement and security services with the vital powers they need to keep us safe, and it does so in a way that is clear and transparent.

When we passed the Act into law, we ensured that the safeguard mechanisms were radically overhauled. The innovative double lock that we put in place was, at the time, unprecedented. As the shadow Home Secretary said, it does two things: it provides the necessary protection that she describes, but it also gives the security services confidence that what they are doing is not only authorised but thoroughly checked. It is also good for Ministers to know that the process has judicial oversight as well as political oversight.

There have been a number of changes since the Act was passed, both in the job done by the security and intelligence services and the police and in the reason they have to do that job, for the people who seek to do us harm are dynamic, too; they change what they do, and technology has also changed. All of that explains why this Bill is, in broad terms, welcome and necessary.

But the powers I describe are not given solely to the people I mentioned. They are also given to a number of other public bodies. This was debated at great length when the 2016 Act was considered in this place. These public bodies—ranging from local authorities to the Environment Agency, the Health and Safety Executive and all kinds of others—have proper legal functions. I am not debating that, but they are not quite of a kind with the security services and the police. To grant these bodies such intrusive powers was always controversial and, to put it mildly, was bound to give rise to some scepticism.

When Parliament considered the Act, we deliberated on that provision in great detail and took a very considered and cautious decision to restrict the use of the power, which we considered to be intrusive. As a result, the public bodies that I have described, including the Environment Agency, the Health and Safety Executive and local authorities, are required to take further procedural steps in order to compel the disclosure of communications data from telecommunications operators. They must obtain either an authorisation under the current IPA, a court order or other judicial authorisation, or regulatory powers in relation to telecommunications or postal operators, or they must obtain the communications data as secondary data as part of a valid interception or equipment interference warrant. So their ability to take advantage of the powers within the existing Act is both limited, particular and subject to those safeguards. The Bill before us seeks to remove that requirement for those further procedural steps in relation to a wide range of public regulatory authorities.

Worse still—I hope the Minister will correct this in his summation—we have yet to learn which those bodies are, as we have not seen a list of the authorities. I hope we will get that list, if not tonight—as it is a big ask for the Minister to read them all out in his 10-minute summation, I hope he will write to the House, and put a copy of the letter in the Library, explaining which bodies will enjoy those powers.

The Government’s argument for removing the restrictions I have set out is that a broader array of communications now fall into the category of communications data—the definition of communications data has broadened—and that a wider number of organisations now constitute telecommunications operators. As a result, it is said that the current restrictions prevent some regulatory authorities from acquiring the information necessary to carry out their statutory responsibilities. The problem with that argument is that unless we know what those regulatory functions are and unless we understand which bodies are involved in the supervisory functions, it is hard to know whether the changes before the House can be legitimised. I have no doubt that will be explored in Committee— I would be amazed if it is not—but it would be helpful if the Minister could be ahead of that further consideration and clarify which specific bodies will fall into this category.

As I said, the issue was highly scrutinised when we last debated these matters. At that time, the powers were tied to national security and serious crime circumstances only, to avoid impinging on the very privacy mentioned by the hon. and learned Member for Edinburgh South West (Joanna Cherry). For that reason too, Parliament granted the powers to a limited range of organisations. We should not brush that aside lightly. Colleagues will be aware of various reports of the intrusive use of investigatory powers by local authorities and other public bodies. The House would not be content to introduce sweeping powers for an unknown and potentially unlimited number of public bodies, when a previous Parliament decided that was too intrusive. I would like the Minister to satisfy the House about the necessity of the change, to specify to whom the change will apply, and to reassure us that there is no weakening of the core connection between the privacy of the individual and the necessary powers available to do what is legally right.

As I said earlier, in broad terms the Bill is welcome. It is important to understand that we need to update the legal framework in which those missioned to keep us safe operate, but the Bill can be improved during its scrutiny. I simply point out that when we debated the Act in its original form, we recognised that through scrutiny that Bill could be improved. As we continue consideration of this important measure, I hope that this Minister—one of my successors as Security Minister—will recognise the same.