Investigatory Powers Bill (Sixteenth sitting)

Joanna Cherry Excerpts

Committee Debate: 16th sitting: House of Commons
Tuesday 3rd May 2016 Public Bill Committees

[Joanna Cherry (Edinburgh South West) (SNP)]

I beg to move amendment 869, in clause 223, page 172, line 41, leave out sub-paragraph (i) and insert—

‘(i) is about an entity to which a telecommunications service is provided by that telecommunications operator and relates to the provision of that service,”

This amendment clarifies the definition of communications data, limiting requirements on organisations to be providing data about the services that they supply.

It is a pleasure to welcome you back to the Chair, Mr Owen. This is an amendment to the interpretation clause dealing with telecommunications definitions, in particular subsection (5), which deals with the definition of communications data. The amendment would replace subsection (5)(a)(i) with the purpose of clarifying that the definition of communications data applies to the providers of the relevant telecommunications services, rather than allowing an organisation to be required to provide data about services it does not provide. Without the amendment, the definition of communications data is flawed because it does not tie the data to the provider of the telecommunications service and therefore seems set to encompass third-party data, which I know the Home Office denies is the intent.

The amendment would make two small changes. First, it specifies that the telecommunications service has to be provided by that telecommunications operator—in other words, it avoids pulling in third-party data. Secondly, it specifies that the data relate to the particular service provided and not to a different one. I will be interested to hear what the Solicitor General has to say about this amendment, which seeks to clarify and tighten up the clause.

[The Solicitor General (Robert Buckland)]

It is good to see you back in your place, Mr Owen. I look forward to a fruitful session.

I welcome the hon. and learned Lady’s remarks. We considered these issues in the context of part 4, in particular third-party data. I do not want to rehearse the arguments about why we consider the code of practice to be the appropriate place to enforce the commitment made by my right hon. Friend the Home Secretary on the Floor of the House on Second Reading. However, the Government note the strength of feeling on this issue, as evidenced by the outcome of the vote on an earlier amendment. We have heard that message loud and clear, so we are considering whether we could do more to make the commitment clear. I hope that that gives the hon. and learned Lady some reassurance that we are taking these matters seriously, and I am grateful to her for raising them.

The aim of the amendment appears to be to prevent a public authority from obtaining third-party data and to prevent a communications service provider from being required to retain those data. I am not sure that the amendment achieves that desired outcome. It would remove third-party data from one element but not from all elements of the definition of communications data. I do not think there is any debate about the need to get the definition of communications data right, but it must correctly and logically classify the data held by CSPs or what can be reasonably obtained by them. The principle of communications data is clear; changing the definition so that the classification of data changes depending on which provider holds it would cause a degree of confusion that I am sure the hon. and learned Lady does not intend.

My first argument is that the clause is not the right place to prevent public authorities from obtaining third-party data or to prevent a CSP from being required to retain them. Clause 53(5)(c) makes it clear that a communications data authorisation can provide for the obtaining of third-party data where that is reasonably practicable for the communications service provider. That maintains the existing provision under the Regulation of Investigatory Powers Act 2000. Where a CSP holds communications data, whether in relation to its services or those provided by a third party for its business purposes, or where it is able to obtain them, they should be available to the public authorities for the statutory purposes in the Bill. We should not put them out of the reach of law enforcement agencies, based solely upon which company holds the information.

I suspect that the hon. and learned Lady’s intent may be to stop a service provider being forced to comply with an unreasonable requirement relating to third-party data—[Interruption.] I am grateful to her for indicating her assent. I assure her and the Committee that, in my view, the Bill already does that. A provider is required to comply with a request for comms data, including third-party data, only where reasonably practicable for them to do so. There is no need to impose a further restriction on that basis.

I recognise the sensitivities of third-party data, but I am afraid that a blanket restriction on its acquisition is not the way forward. We consider that the Bill and the code of practice strike the right balance. On the basis of my earlier assurances to the hon. and learned Lady about getting the language clear, I invite her to withdraw the amendment.

[Joanna Cherry]

I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 223 ordered to stand part of the Bill.

Clause 224 ordered to stand part of the Bill.

Clause 225

General definitions

[Joanna Cherry]

I beg to move amendment 870, in clause 225, page 177, line 11, at end insert—

‘(a) an advocate,

(b) a barrister,

(c) a solicitor.’

This amendment provides a definition of a “professional legal adviser” relating to use of the term in clauses 25, 100, 135 and 171.

I am grateful to the Law Society of Scotland for drawing my attention to the necessity of this amendment. When we debated the clauses on legal professional privilege—we have done so on a number of occasions during this Committee’s proceedings—I drew attention at an early stage to the Law Society of Scotland’s evidence to the Joint Committee. It gave evidence alongside the Law Society of England and Wales and expressed its shared and serious concerns about the requirement to provide for the protection of legal professional privilege on the face of the Bill. It is pleased that the Government have taken steps to do that, although it is not happy with the extent of the protection provided. That is perhaps a debate for another day.

The purpose of the amendment is to deal with the definition of items subject to legal privilege at line 29, on page 175. The amendment deals with the definition in relation to Scotland and would define a “professional legal adviser” as a person who is an advocate—that is, of course, the correct professional designation for counsel in Scotland or a Scottish barrister—a barrister or a solicitor. The aim is to avoid leaving the definition of a “professional legal adviser” open to too wide or ambiguous an interpretation. It will limit the definition of those who are qualified to provide professional legal services to advocates, solicitors and, in certain circumstances, barristers. I will be interested to hear what the Solicitor General has to say about the proposed definition of a “professional legal adviser”.

[The Solicitor General]

When I saw the amendment, I was reminded of points I made earlier regarding the dangers of over-defining either legal professional privilege itself or those who are subject to it. Let us remind ourselves that legal professional privilege exists not to create a special category of person—in this case, a lawyer—who is exempt from requirements by which the rest of us have to abide, but to protect the client and the integrity of the advice that a lawyer may give to their client. My concern about the proposed definition is that it limits the definition of what items would be subject to legal privilege. For example, legal executives might well be in the position where they are giving advice and are covered by legal professional privilege. Even paralegals could be, should be and would be covered by legal professional privilege.

I absolutely accept the intention behind the amendment, but however well intentioned it might be, trying to define “professional legal adviser” in the Bill would actually damage and undermine the importance of legal professional privilege. We have had many debates about it, but I think the Bill serves to protect that privilege. We are continuing to discuss the precise extent to which that is reflected in all parts of the Bill, but there is no doubt about the Government’s clear intention. I am proud to be a Minister supporting this approach because I always felt that RIPA was deficient in that respect—I held those views long before I became a member of the Government. I am pleased that we are making such progress.

--- Later in debate ---

[Joanna Cherry]

I am interested in the Solicitor General’s point about legal executives or paralegals. Does he agree that, in so far as communications with such individuals would require protection, they would be protected by subsection (1)(b)(ii), which specifies

“communications made in connection with, or in contemplation of, legal proceedings and for the purposes of those proceedings”?

[The Solicitor General]

That is a good point, but there is a danger that we overcomplicate the situation and end up restricting what is commonly understood as the important legal professional privilege that exists between lawyer and client. Instead of overcomplicating it, it would be far better to keep maters straight and reflect the position provided for in the Police and Criminal Evidence Act 1984, which applies here in England and Wales, the Police and Criminal Evidence (Northern Ireland) Order 1989 and the definitions relating to Scotland. The other statutes for England, Wales and Northern Ireland do not define “professional legal adviser” and I do not see a compelling need to do so here. As I have explained, the Bill goes a long way towards protecting that important legal privilege and serving the interests that that privilege is all about. It is not about the lawyers but the client. Fundamentally, it is that communication that merits special protection.

[Joanna Cherry]

I wholly accept that it is not about lawyers but about the client, but is there not a need to define what is meant by “professional legal adviser”? That is all this is about really.

[The Solicitor General]

The hon. and learned Lady puts her case with her customary spirit and brio, if I may say so, but despite her attempts to persuade me, I am concerned that if we seek to narrow the definition in the way the amendment would, the sort of unintended consequences that I know the hon. and learned Lady would be very reluctant to see happen might flow. We should not, in the context of primary legislation, start to define what is better explained in other ways. For that reason, I urge her to withdraw the amendment.

[Joanna Cherry]

I hear what the Solicitor General has to say, and in the circumstances I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 225 ordered to stand part of the Bill.

Clauses 226 to 231 ordered to stand part of the Bill.

Schedule 9 agreed to.

Clause 232 ordered to stand part of the Bill.

Schedule 10

Minor and consequential provision

[The Minister for Security (Mr John Hayes)]

I beg to move amendment 634, in schedule 10, page 235, line 33, leave out paragraph 46.

This amendment omits the amendments of paragraph 19ZD of Schedule 3 to the Police Reform Act 2002. Paragraph 19ZD is to be repealed by the Policing and Crime Bill.

--- Later in debate ---

[The Chair]

With this it will be convenient to consider:

New clause 24—Duration of this Act—

“(1) This Act expires at the end of one year beginning with the day on which it is passed (but this is subject to subsection (2)).

(2) Her Majesty may by Order in Council provide that, instead of expiring at the time it would otherwise expire, this Act shall expire at the end of a period of not more than one year from that time.

(3) Such an Order may not provide for the continuation of this Act beyond the end of the year 2022.

(4) No recommendation may be made to Her Majesty in Council to make an Order under subsection (2) unless a draft of the Order has been laid before, and approved by a resolution of, each House of Parliament.”

[Joanna Cherry]

New clause 24 is a true sunset clause, modelled on clause 1 of the Armed Forces Bill currently before Parliament. We had a spirited debate before the break about potential replacements for clause 222, which is a clause of review. The new clause is another alternative—a sunset clause in the true meaning of the term, which would provide for the Act to expire at the end of a certain period, subject to certain provisos. I do not intend to push the new clause further at this point, given the position we took in relation to new clause 23.

[Mr Hayes]

Clearly, the sunset clause that the new clause proposes is being debated—briefly, I hope—as we approach the sunset of our consideration of this important Bill. A sunset provision is often a feature of emergency legislation and has indeed been appeared in legislation of the kind that we are now debating. It is usually because the legislation has been introduced to meet some particular short-term challenge and Parliament is given limited time in which to consider the legislation responding to that challenge. That is not the case in respect of this Bill, which has had extensive prelegislative scrutiny, both before its draft incarnation and since. It has now had considerable scrutiny by the Committee, and will no doubt continue to be scrutinised as it progresses through its further stages. I am therefore not sure a sunset clause is appropriate.

The hon. and learned Lady is well aware of the three independent reviews that preceded the publication of the Bill, and of the three Committees of this House that have considered the Bill in considerable detail since then. One of those—the Joint Committee—considered at length a sunset clause and a review of the legislation. We debated that a few minutes ago under an earlier group of amendments. As I said at that time, rather than proposing a sunset clause, the Joint Committee suggested a review of the legislation. I understand that suggestion, given the dynamism of the circumstances that the Bill is designed to address—the need to deal with changing technology and so on and so forth. Indeed, the Government, taking full account of the sagacity of the Joint Committee, have built that into the Bill in clause 222, which we have debated at some length.

The complexities of this legislation are acknowledged and understood. I can see why the hon. and learned Lady makes a case for this sort of consideration. In David Anderson’s report on these matters, which I will not quote at immense length unless the members of the Committee wish me to do so, he makes clear that although it is important to consider the effects of the Bill, it is not necessary to accelerate that process in the way that the new clause would. He also makes clear, as others have, that it is vital that the legislation stands the test of time and is fit for the future. I am therefore uncomfortable with introducing specific deadlines of the kind proposed in the new clause.

The hon. and learned Lady has repeatedly and rightly argued that many of the provisions of the Bill require considerable investment. The obligations such as those in respect to data retention require a lot of thought, a good deal of planning and an investment of time and effort from communications service providers and others. Putting that infrastructure into place is a testing business; it is the right thing to do, but it is testing none the less—a point made by the hon. Member for City of Chester and others during the course of the Committee’s consideration. Then to say that we are going to look at all of that again in 12 months’ time sends out a very unhelpful signal to those we are missioning to do that work. We have gone about this business thoroughly. We have discussed this at length with communications services providers throughout the process and time and again they have said that they want certainty; they want a reasonable degree of surety about what is expected of them. I think they would be reticent about investing in the way that they need to if they felt that this all might change in 12 months’ time.

The Home Secretary put the case as well as it can be put when she told the Joint Committee that “advances in technology” are not

“going to move according to sunset clauses established by Parliament.”

Although it is important that these matters are reviewed—as I said on clause 222, we have set into motion the means by which they will be reviewed—I do not think a sunset clause of the type proposed is the right way forward. On that basis, given the assurances that I have offered, I hope the hon. and learned Member for Edinburgh South West will see fit not to press the new clause.

[Joanna Cherry]

Yes, I confirm I will not press the new clause.

Question put and agreed to.

Clause 233 accordingly ordered to stand part of the Bill.

New Clause 12

Warrants: notification by Judicial Commissioner

“(1) Upon completion of conduct authorised by a warrant under this Part, or the cancellation of a warrant issued under this Part, a Judicial Commissioner must notify the affected party, in writing, of—

(a) the conduct that has taken place, and

(b) the provisions under which the conduct has taken place.

(2) The notification under subsection (1) must be sent within thirty days of the completion of the conduct or cancellation of the warrant.

(3) A Judicial Commissioner may postpone the notification under subsection (1) beyond the time limit under subsection (2) if the Judicial Commissioner assesses that notification may defeat the purposes of an ongoing serious crime or national security investigation relating to the affected party.

(4) A Judicial Commissioner must consult with the person to whom the warrant is addressed in order to fulfil an assessment under subsection (3).”.—(Joanna Cherry.)

This amendment would introduce a requirement that all equipment interference produces a verifiable audit trail. This will be particularly vital to the success and legitimacy of prosecutions. It is recommended that further provision for the independent verification of audit trails is included in Part 8 (Oversight Arrangements).

Brought up, and read the First time.

[Joanna Cherry]

I beg to move, That the clause be read a Second time.

[The Chair]

With this it will be convenient to discuss the following:

New clause 13—Audit trail of equipment interference—

“Any conduct authorised under a warrant issued under this Part must be conducted in a verifiable manner, so as to produce a chronological record of documentary evidence detailing the sequence of activities (referred to hereafter as ‘the audit trail’).”.

New clause 18—Notification by Intelligence and Surveillance Commissioner—

“(1) The Intelligence and Surveillance Commissioner is to notify the subject or subjects of investigative or surveillance conduct relating to the statutory functions identified in section 196, subsections (1), (2) and (3), including—

(a) the interception or examination of communications,

(b) the retention, accessing or examination of communications data or secondary data,

(c) equipment interference,

(d) access or examination of data retrieved from a bulk personal dataset,

(e) covert human intelligence sources,

(f) entry or interference with property.

(2) The Intelligence and Surveillance Commissioner must only notify subjects of surveillance under subsection (1) upon completion of the relevant conduct or the cancellation of the authorisation or warrant.

(3) The notification under subsection (1) must be sent by writing within 30 days of the completion of the relevant conduct or cancellation of the authorisation or warrant.

(4) The Intelligence and Surveillance Commissioner must issue the notification under subsection (1) in writing, including details of—

(a) the conduct that has taken place, and

(b) the provisions under which the conduct has taken place, and

(c) any known errors that took place within the course of the conduct.

(5) The Intelligence and Surveillance Commissioner may postpone the notification under subsection (1) beyond the time limit under subsection (3) if the Commissioner assesses that notification may defeat the purposes of an on-going serious crime or national security investigation relating to the subject of surveillance.

(6) The Intelligence and Surveillance Commissioner must consult with the person to whom the warrant is addressed in order to fulfil an assessment under subsection (5).”.

[Joanna Cherry]

The new clause relates to part 5 of the Bill, which deals with equipment interference—more colloquially known as “hacking”. The effect of the new clause would be to require that the targets of hacking, or the targets of equipment interference, are notified after the fact, as long as that does not compromise any ongoing investigation. The effect of the new clause would mean that the judicial commissioners were under a mandatory statutory duty to notify those subject to surveillance once a particular operation or investigation had ended. At present, unlawful surveillance only comes to light as the result of a chance leak, whistleblowing or public interest litigation of the sort brought by Liberty and other non-governmental organisations and concerned citizens. That is deeply unsatisfactory and is also potentially contrary to our obligations under the European convention on human rights. If a person’s article 8 and other Human Rights Act-protected rights have been infringed, in order to have access to an effective remedy, as required under human rights law, the person must first be made aware of a possible breach. This was stated by the Court in Strasbourg in Klass v. Federal Republic of Germany back in 1978 and reiterated more recently in Weber and Saravia v. Germany in 2006. In both cases, the European Court of Human Rights reiterated

“that the question of subsequent notification of surveillance measures is inextricably linked to the effectiveness of remedies before the courts and hence to the existence of effective safeguards against the abuse of monitoring powers, since there is in principle little scope for recourse to the courts by the individual concerned unless the latter is advised of the measures taken without his or her knowledge and thus able to challenge their legality retrospectively.”

More recently, in the case of Zakharov v. Russia in December 2015, the Grand Chamber of the European Court of Human Rights found that judicial remedies for those subjected to interception in Russia were generally ineffective, particularly in light of the total absence of any notification requirement with regard to the interception subject, which meant that there was no meaningful ability to mount retrospective challenges to surveillance measures, and therefore such provision as there was in Russia was ineffective. Do we want to be passing legislation that is as ineffective in the protection of our constituents’ rights as that in Russia?

The Bill, as it stands, provides a new power for the Investigatory Powers Commissioner to inform someone subjected to a surveillance error by a public authority, but not by a communications service provider, if the commissioner is made aware of it and considers it sufficiently serious, in the public interest, not prejudicial to national security, and so on. We debated that at some length last week. For an error to be serious, it must have caused significant prejudice or harm to the person concerned.

As we also discussed last week, the Bill states that a breach of the Human Rights Act is not, in itself, sufficient for an error to be considered serious, which is a serious shortcoming of the Bill. When notifying someone of an error, before making a decision the Investigatory Powers Commissioner must ask the public authority responsible for the error to make submissions to the commissioner about the matter concerned. That is a narrow, arbitrary and highly discretionary power that will relate only to the most serious errors that judicial commissioners discover during their very limited audit of the use of surveillance powers, which highlights the conflicted position in which judicial commissioners may find themselves, and it does not discharge the Government’s human rights obligations to provide post-notification by default unless they can justify continued secrecy. That is very significant because the security repercussions of hacking into a device or network create an even greater imperative for post-notification, as we discussed at length when we debated amendments and clauses under part 5.

When we debated part 5, it was noted by me and others that a hack, once it has been carried out, may compromise the security of the hacked device, leaving it open to further exploitation by criminals or even other Governments. It is the equivalent of the state breaking into a house, conducting a search and then leaving without locking the doors and without the resident realising that all that has happened. It is one thing for the state to hack into a device where it is strictly necessary and proportionate, but it is quite another for the state to leave the scene, leaving individuals vulnerable to criminal attacks with no way of protecting themselves. If the Government wish their security and law enforcement agencies to have this significant power, they must accept the concomitant responsibility. The purpose of new clause 12, put briefly, is to put the judicial commissioners under a mandatory statutory duty to notify persons after the fact, once an operation or investigation has ended, unless there are very good reasons not to do so.

--- Later in debate ---

[The Solicitor General]

I have listened with great care to the arguments of the hon. and learned Lady. I absolutely agree that, where a serious error has occurred in the use of investigatory powers, the commissioner should be able to inform those affected. We have clause 198(1) to deal with that. However, I do not agree with the principle that as a matter of course, everyone or anyone subject to the use of a lawful investigatory power should be notified of the use of those powers, even with the caveat “unless it would damage an ongoing serious crime or national security investigation”. Such a principle would mean that we could not exclude the possibility of having to notify suspected criminals and terrorists that powers had been used against them, just because a specific ongoing investigation had stalled or indeed ended with evidence of wrongdoing, but without sufficient evidence to meet the prosecution test.

As hon. Members will know, suspected criminals and terrorists will often appear on the radar of the police and security services at different times and in different contexts. Clearly, it would not be at all appropriate to inform them that investigatory powers had been used in one case, as that could prompt them to change how they behave or communicate and hamper subsequent investigation.

National security is particularly important in relation to this matter, because the amendment would require the commissioner to make the subject of interest aware of the conduct that had taken place. That would not only run contrary to the long-standing policy of successive Governments of neither confirming nor denying any specific activity by the security and intelligence agencies; it would essentially require the techniques that they use in specific cases to be made public. That cannot be in the public interest. It would assist terrorists and criminals in their operations, which I am sure cannot be the intention behind the amendment.

Furthermore, the commissioner can delay notification only on the basis of serious crime rather than of crime generally, meaning that the amendment would require the commissioner to inform suspects in active criminal investigations that their communications data had been acquired. One example is an investigation into stalking. It may well not meet the serious crime threshold, but as we have discussed in another context, communications data could be essential, because they could show contact between two parties. My worry about the amendment is that it would require the stalker to be informed that his communications data had been requested, which surely cannot be the intent.

[Joanna Cherry]

Does the Solicitor General agree that new clause 12(3) deals with the very problem that he has just identified? It says:

“A Judicial Commissioner may postpone the notification under subsection (1) beyond the time limit under subsection (2) if the Judicial Commissioner assesses that notification may defeat the purposes of an ongoing serious crime or national security investigation relating to the affected party.”

[The Solicitor General]

I am afraid that it does not, because it uses the words “serious crime”. I have given an example that might not be seen as a serious crime, although as we all know, stalking is absolutely no joke to the victims and can lead to extremely serious consequences for them. I know that the hon. and learned Lady agrees with me about all that.

Beyond the principled objections to the amendment, there are numerous practical problems. It would not be practical, for example, for the commissioner to make everyone whose data were subject to a data retention notice aware of that fact. The commissioner would have to require the relevant telecommunications operator to provide them with a list of all relevant customers, and that operator would have to inform the commissioner every time a new customer joined the service. I worry that it would be pretty easy for criminals to use that process to identify services that they could use to avoid detection, and that unreasonable burdens would be put on all the public authorities covered by the Bill.

[Joanna Cherry]

By way of probing, if we were to delete the word “serious”, so that the subsection read, “notification may defeat the purposes of an ongoing criminal investigation or a national security investigation,” would that deal with the Solicitor General’s concerns?

[The Solicitor General]

I am grateful to the hon. and learned Lady for the way in which she is seeking a reasonable compromise, but I worry that her proposed approach is, on that basis, unnecessary. We already have checks and balances in the framework of the Bill that allow for serious error to be properly identified and dealt with, and for those affected to be notified. As I was saying, I worry that we would end up placing unreasonable burdens on public authorities by requiring them constantly to make a case to the commissioner about whether what they were doing would hamper national security or crime investigations if suspects were told that investigatory powers were being used against them. It would be far better for the police to spend their time and money on getting on with the work of investigating criminals than on determining whether individuals should be informed about what we should not forget is perfectly lawful investigative activity, with the caveat I mentioned about serious error.

Furthermore, in the context of bulk warrants under parts 6 and 7 of the Bill, the public authority or commissioner would need to examine all the data collected under the warrant to identify those individuals whose data had been collected. That would be impracticable and would actually lead to greater intrusions into privacy, because, as we know, bulk data are not examined to that degree unless there is a specific purpose and a properly framed approach. I am sure that cannot be the intention of the amendment. These proposed new clauses are at best unnecessary and at worst frankly unhelpful, and risk undermining the work of our law enforcement and security and intelligence agencies.

On new clause 13 and the audit trail point, the draft code of practice, at paragraph 8.5, requires that

“When information obtained from equipment interference is used evidentially, the equipment interference agency should be able to demonstrate how the evidence has been recovered, showing each process through which the evidence was obtained.”

There will, however, be circumstances when equipment interference is used on an intelligence-only basis—that is, a non-evidential basis. Given those points, and given that it is in the interests of law enforcement and the intelligence agencies to ensure that where equipment interference is used to support a criminal investigation, that is done accordance with evidential standards, new clause 13 is, with respect, not necessary.

If that new clause is in fact about the enhancement of oversight, we have made it clear that while the powers of the new commissioner are being significantly increased, their resources will be greatly increased, which means that they will be able to audit, inspect and review equipment interference agencies as they see fit. In addition, the draft code of practice for equipment interference will require the relevant agencies to keep extensive records to support and enable oversight. There has been no suggestion from the current oversight commissioners in respect of property interference warrantry that a statutory requirement for an audit trail is necessary.

The hon. and learned Lady properly made reference to recent ECHR authorities, most notably Zakharov, a case that I have looked at in the context of these debates. We have to be careful about Zakharov, because it deals with the targeted interception regime—a particular aspect of the debate, as she knows—rather than the bulk regime, in relation to which it is sometimes prayed in aid. I give that caveat in the spirit of fairness, because of course the Zakharov case contained reference to Kennedy v. United Kingdom, a 2010 case in which the UK was found to be in compliance with article 8. In particular, the role of the Investigatory Powers Tribunal was seen as an important part of the checks-and-balances mechanism that allowed the Court to come to the conclusion that the article 8 requirements were satisfied.

We know that the Zakharov case was in the context of a Russian domestic law scenario, which I think we all agree is somewhat different from the scenario in which we work. I do not seek to palm it off glibly on the basis that it relates to Russia and not to the UK, but looking at the ambit of Zakharov and the domestic context in which that case was brought, it is somewhat more difficult than appears at first sight to draw direct comparisons and conclusions from that authority that undermine the carefully calibrated approach the Government are taking to investigatory powers. For all those reasons, I respectfully ask the hon. and learned Lady not to press her new clause.

[Joanna Cherry]

I would like to put my new clauses to the vote.

Question put, That the clause be read a Second time.

--- Later in debate ---

Brought up, and read the First time.

[Joanna Cherry]

I beg to move, That the clause be read a Second time.

The new clause relates to part 4 of the Bill, in particular clause 78, and to the retention of communications data. It would exclude the providers of rural or community access communication services and small service providers from the obligation to collect and retain data, which I believe would be in accordance with policy statements made by the Home Office. I am indebted to William Waites, Duncan Campbell and Adrian Kennard for drawing our attention to the need for this new clause and for assisting in its drafting. I can do no better than remind hon. Members of the statement submitted by Mr Waites on behalf of his organisation, HUBS CIC—document 53 in the written evidence submitted to the Committee—in which he explains:

“I am a founder and director of HUBS CIC, a Scottish Community Interest Company whose purpose is to facilitate broadband provision in rural and remote parts of the country outwith the reach of the large, well-known carriers.”

Hon. Members will be aware of this issue, which has been debated elsewhere in the House in this Session. The statement continues:

“HUBS’ members are small Internet Service Providers typically with tens to hundreds of individual end-user subscribers each. Together they provide the only available Internet service in large swathes of the West Highlands and the South of Scotland…HUBS does not provide service to end-users but instead makes bulk Internet services available to its members that would not otherwise be obtainable due to their small size.”

The members’ concern about clause 78

“is about how the data retention requirements…in particular, and the new obligations and duties on Telecommunications providers in general relate to service providers operating in the environment of HUBS’ membership…A typical member’s entire network infrastructure will cost on the order of tens or hundreds of thousands of pounds. It is optimised for lightweight, energy efficient operation. There are no data centres or indeed cabinets that have adequate physical security for safely storing the most intimate records of individuals’ on-line activities…Indeed it is recognised in general that keeping sensitive data secure is so important, that the best way to meet this obligation is simply to not record it.”

Therefore,

“Constructing facilities in each of these service providers to extract, record, securely store and make available any ‘Internet Connection Records’…would cost at least as much as their entire infrastructure…HUBS, though it is designed to enable the micro ISPs to benefit from economies of scale, cannot help here because it does not know the individual end users…Due regard should also be given to the social dynamics. If an ISP has a couple of dozen subscribers, two or three of which are actively involved in operating the network, data retention has a very different flavour.”

That is very often the position in rural and far-flung communities. It is like asking neighbour to spy on neighbour. I am sure that is not what the Government intend, but the new clause would spell that out. It would give providers of rural or community-access communication services and small service providers the reassurance they require in the Bill.

To put it shortly, the provisions in clause 78 are clearly designed for a very different environment from that which I have described, so those who operate within that environment are keen to have the Government’s assurance that they will be excepted from the requirements of the clause.

[Mr Hayes]

I think I can deal with this very briefly, because there are only two points to make. First, the amendment is flawed. The Department for Culture, Media and Sport tells us that the suggested designation is no longer used, if ever it was. That is a fundamental problem, but that is not a good enough argument alone. A better argument—my second point—is that restricting a retention notice to only large operators could result in large geographic gaps in capabilities or indicate to criminals that they should use only small providers. It is understandable that the hon. and learned Lady wants to defend the interests of small providers, but the provision could have unintended consequences of the sort I do not think she means.

Finally, the Joint Committee said:

“We believe that the definition of telecommunications service providers cannot explicitly rule out smaller providers without significantly compromising the data retention proposals as a whole.”

I appreciate the hon. and learned Lady’s intent, but I am not sure the form of the amendment is adequate or the arguments sufficient to be persuasive.

[Joanna Cherry]

I am not sure what the Minister is saying. Is he saying he could look at the amendment and make it better, or that the principle underlying it is not acceptable?

[Mr Hayes]

I am saying that it is not wise to designate providers based on their size. There will be niche market providers who may provide a particular function exclusively and there may be others providing in a particular area. Taking them out of the system would contradict the purpose of the legislation. Let me see if I can compromise. We have said throughout, and when we were debating an earlier group of amendments, that we understand that some smaller providers will face a significant challenge. I have also said that it is important to recognise that while large providers will have mechanisms to implement readily the changes we expect of them—

[The Chair]

Order. The Minister is intervening on Ms Cherry.

[Joanna Cherry]

Sorry, Mr Owen, I have lost my train of thought. The concern behind the amendment is that although certain assurances have been given, I have tried to explain that, without a guarantee that requirements will be placed on such providers, they may simply grind to a halt. Is there any way round that? That is the purpose of the amendment.

[Mr Hayes]

Let me try to make a more pithy intervention. Of course we understand that we need to support providers in meeting their obligations and we will take the steps necessary to do that. What I do not want to do is to exclude them in the Bill from the requirement because that would have consequences that the hon. and learned Lady does not intend.

[Joanna Cherry]

I am sure the last thing the denizens of the west or the south of Scotland want is some mass influx of terrorists to start using their small internet service providers. On the other hand, they do not want their hard-won and hard-fought-for internet access to be completely compromised by unreasonable requirements being put on it. They are concerned that, although assurances have been given, there is nothing in clause 17 to prevent the Government from putting what would be practically and financially crippling requirements on them. That is the purpose of the amendment.

[The Chair]

Ms Cherry, are you moving the new clause or withdrawing it?

[Joanna Cherry]

The arithmetic is inevitable, Mr Owen. I would like to think carefully about what the Minister has said, and go back to the organisations concerned and discuss it with them so I will withdraw the new clause for now.

Clause, by leave, withdrawn.

New Clause 25

Discharge of the powers, duties and functions: obligations

“The discharge of the powers, duties and functions under this Act is subject to an obligation to have due regard to the following—

(a) the public interest in protecting national security,

(b) the public interest in the prevention and detection of serious crime,

(c) the public interest in the protection of the privacy and the integrity of personal data,

(d) the public interest in the security and integrity of communications systems and networks,

(e) the principle of necessity,

(f) the principle of proportionality; and that no interference with privacy should be considered proportionate if the information which is sought could reasonably be obtained by other less intrusive means,

(g) the principle of due process, accountability and respect for the human rights of those affected by the exercise of powers under this Act, and

(h) the principle of notification and redress.”—(Keir Starmer.)

Brought up, and read the First time.

--- Later in debate ---

[Christian Matheson (City of Chester) (Lab)]

I can assure you, Mr Owen, that I will not detain you, the Minister or the Committee for long, save to endorse what my hon. and learned Friend the Member for Holborn and St Pancras has said.

If this is to be our final debate in Committee, I pay tribute to the forensic diligence exercised by my hon. and learned Friend throughout our proceedings and as exemplified by new clause 25 that he has tabled. The crux of so much of what we have discussed in Committee has been balance—where the right balance is between the protection of individual privacy and the ability of our security, intelligence and law enforcement agencies to protect us as a nation. We all have different beliefs about where the balance lies and it is the job of the Committee and the House to establish that balance.

As my hon. and learned Friend has made clear, adding this overarching new clause would give the public a level of comfort—a level of trust, indeed—that we have the balance correct. The new clause would remind us, right at the start of the Bill, of the principles that we think underpin the legislation. That would provide the public with the comfort that they require and also imbue a sense of trust in the final Act that we hand over to the judiciary, the Home Secretary and the agencies that are charged with protecting us. Given the structure of the Bill and the repeated application of certain measures to different areas of activity, an overarching clause would provide a solid foundation to the rest of the Bill’s structure.

I commend my hon. and learned Friend for his work, and in particular for the new clause, because it helps to achieve the balance between protection of privacy and the protection and defence of the realm. I hope that it goes a long way towards winning the support of more sceptical members of the public who might be looking for reasons why they should not support the Bill; now, we can give them a reason why they should.

[Joanna Cherry]

I add my support and that of the Scottish National party to the new clause. I will tell hon. Members about an example of such a clause in Scottish legislation, which they might wish to look at. In doing so, I pay generous tribute to honourable Labour and Liberal Democratic parties which passed it. In coalition in the first Session of the Scottish Parliament, they passed a wonderful piece of legislation, the Mental Health (Care and Treatment) (Scotland) Act 2003. It was based on a report produced by a committee chaired by the late right hon. Bruce Millan, a former Secretary of State for Scotland and a very distinguished gentleman.

The 2003 Act sought thoroughly to modernise and codify the law of Scotland on mental health and, in particular, to take into account the human rights of those who have mental health problems. To do that, it set out in section 1 of the Act general principles that everyone discharging functions under the legislation must stand by. It is a piece of legislation that has very much stood the test of time and it has greatly enhanced the protection of the human rights of those in Scotland with mental health problems. It has also balanced that against the protection of the public in certain situations. The new clause does not take a legislative approach that is without precedent. If Members want to see how it might be done, they can find a similar example to new clause 25 in section 1 of the Mental Health (Care and Treatment) (Scotland) Act 2003.

--- Later in debate ---

[Keir Starmer]

I will. I hope that the hon. and learned Lady will mention the non-governmental organisations that have helped us. Thank you.

[Joanna Cherry]

I add my thanks to all those who have been mentioned so far. It has been a true pleasure to work so closely with the hon. and learned Member for Holborn and St Pancras. I pay tribute to the people behind the scenes who have greatly assisted Opposition Members in our preparation for this Committee.

A number of non-governmental organisations have been mentioned. I will not mention any one in particular; they know who they are, and they have been of great assistance to us. I also want to thank my hon. Friend the Member for Paisley and Renfrewshire North. This is my first time on a Bill Committee, and without his assistance, I would have been in even more of a guddle than I was on some occasions. I am very grateful to him for keeping me right.

[The Chair]

I add my thanks to all members of the Committee, the Clerks in particular, officials, the Official Report, the Doorkeepers and so on.

Question put and agreed to.

Bill, as amended, accordingly to be reported.