Investigatory Powers Bill (Seventh sitting)

John Hayes Excerpts

Committee Debate: 7th sitting: House of Commons
Tuesday 19th April 2016 Public Bill Committees

[The Minister for Security (Mr John Hayes)]

On a point of order, Madam Chairman. I will be writing to you today to summarise all of the areas on which the Solicitor General and I have offered to provide more information during the course of our sittings. I will do that each week, with a view to informing the debate and ensuring that all members of the Committee have the information.

[The Chair]

Thank you very much, Minister.

Clause 61

Relevant public authorities and designated senior officers

--- Later in debate ---

Relevant public authorities and designated senior officers

[Mr Hayes]

I beg to move amendment 105, in schedule 4, page 206, line 40, at end insert—

[The Chair]

With this it will be convenient to discuss Government amendments 106 to 108.

[Mr Hayes]

Welcome to the Chair, Ms Dorries.

The amendments make minor changes to schedule 4. As has already been said, schedule 4 lists the public authorities that are able to acquire communications data, the types of communications that they are able to acquire and the statutory purposes for which they can do so. Amendment 105 adds a new entry for ambulance trusts in England, amendment 106 removes the existing entry and amendment 108 introduces the definition of an ambulance trust. The changes make the definition of ambulance trusts consistent with the definition in the Policing and Crime Bill.

The amendments also remove purpose (b) in clause 53(7) from the purposes for which ambulance trusts can acquire communications data, because ambulance trusts obviously do not need to acquire communications data for the purpose of the prevention or detection of crime. In the same vein, amendment 107 restricts the purposes that the Northern Ireland Fire and Rescue Service Board can use to acquire communications data, consistent with the purposes for English fire and rescue authorities. These are uncontentious amendments designed to make the Bill consistent and coherent.

Amendment 105 agreed to.

Amendments made: 106, in schedule 4, page 207, leave out lines 24 to 35.

See the explanatory statement for amendment 105.

Amendment 107, in schedule 4, page 207, line 39, leave out—

--- Later in debate ---

[Mr Hayes]

I know the hon. and learned Gentleman is probing. He is right that the clause sets out how the Secretary of State may, by regulation, add or remove public bodies listed in schedule 4 and make modifications accordingly, but it also sets out that the Secretary of State does so by means of regulations. He will have noted that in practice that means a statutory instrument, which is subject to the affirmative procedure, as is made clear in clause 63(3).

I understand the hon. and learned Gentleman’s point, which is reasonable, but there are limits on what the Secretary of State can do in the sense that the affirmative procedure must be followed, which will give an opportunity for further consideration. I am happy to confirm that the intention in the Bill and the spirit in which it was constructed are very much along the lines he described.

[Joanna Cherry]

I wish to oppose this clause.

Question put, That the clause stand part of the Bill.

--- Later in debate ---

[Mr Hayes]

They were.

[Keir Starmer]

That is welcome and we support them for that reason. In tightening controls, there has been a failure, perhaps deliberate, not to align this with the test in other cases. The judicial authority would be able to say, “I would not in fact authorise, but there were reasonable grounds on which somebody else could have done so.” I am making a probing point; no amendment was tabled. I support the further protection in relation to local authorities. I just wondered whether there was a deliberate intention not to align this provision with the other safeguard provisions in the Bill.

[Mr Hayes]

There are two things to say. First, the measure replicates the current position under the Regulation of Investigatory Powers Act 2000, so it is established practice. Secondly, as the hon. and learned Gentleman conceded, it is an attempt to add an additional safeguard, for the reasons he gave. It seemed important that this was not used permissively. The only other thing I would add, given that he is probing, is that all of this would have to pass the tests of proportionality and necessity; that is a given. I am happy to look at whether we need to reinforce that, in the code or perhaps elsewhere, because proportionality and necessity underpin all of this; that is not specified in this part, but it is a prevailing and underpinning assumption about authorisation. I understand that he is probing and also appreciate that he understands what we are trying to do.

[Keir Starmer]

I am grateful to the Minister for the spirit in which he is approaching this issue. I accept that necessity and proportionality are the key tests for the application in the first place. The question for the magistrate is then whether there are reasonable grounds for considering it to be necessary and proportionate. That leaves room for the magistrate to say, “I personally do not think it is necessary and proportionate but I accept that somebody else might think there are reasonable grounds.” I do not want to take this too far because it is a relatively minor provision in the Bill and I accept that it is in the scheme of tightening the safeguards; however, I just wonder whether some thought can be given. When the other tests have been so carefully construed—and we will have further discussion on what those tests are—this is an outlier in the way that it is expressed. I accept that it reflects current practice, but I do not think that is necessarily a good reason for simply replicating that unless, on reflection, current practice is thought to be the right way forward from here.

[Mr Hayes]

I will test that. The hon. and learned Gentleman makes a reasonable point, so I will test our experience of current practice regarding this issue and I will also test and consider whether we need to provide further guidance. I would not want to go too far because, as he says, it is a minor matter, but he is right to say that it is important that it is consistent. I am more than happy to take a look at that, and on that basis I think we should move on.

Question put, That the clause stand part of the Bill.

--- Later in debate ---

[Joanna Cherry]

The amendments are jointly supported by Labour and the Scottish National party.

Throughout this part of the Bill, public authorities and other decision makers are placed under a duty to consider a range of factors connected to the decision to access retained communications data. Those factors include cost and other resource implications and

“any issues as to the lawfulness of the proposed authorisation.”

These amendments include a specific duty to consider the public interest and the protection of individual privacy—that is, the protection of the privacy of our constituents; and the security of communications systems and computer networks—that is, the security of our constituents’ private data. Both David Anderson, in his independent review, and the Intelligence and Security Committee, in its report on the draft Bill, emphasise the importance of privacy principles and the need to make clear the legality of the use of surveillance powers in this new legislation.

Although we are focusing on a specific amendment to increase safeguards for individual privacy and security of data, we are concerned that throughout the Bill there appear to be statutory duties on public agencies, officials and agents and on judicial commissioners, to consider factors relevant to national security and the prevention and detection of crime, and the effectiveness of powers and resources expended, but there is no specific treatment of privacy standards and the public interest.

While the clauses that these amendments are attached to refer to

“any issues as to the lawfulness”

of the powers, the vagueness of this instruction is, in my submission, very contradictory. Surely it must be the first consideration of any individual considering the exercise of powers under the Bill that they should be legal. Legality should be a first consideration; treating it as just one at the end of a list of other factors to be considered seems entirely inappropriate. In this regard, it would be of huge assistance if the Minister could give us a fuller explanation of why statutory duties in the Bill have been approached in this way, with legality as a final duty; of the objectives of including the factors as provided in the manner in which they are drafted; and of why the protection of privacy and the public interest in the integrity of communications systems and computer networks will not be mentioned unless this amendment is made.

[Mr Hayes]

The hon. and learned Member for Holborn and St Pancras is right about the purpose of the clause, and I understand the reason for the amendments. The single point of contact may advise the applicant and designated senior officer of the cost and resource implications for the public authority, and the communications service provider of any unintended consequences of the proposed authorisation and any issues surrounding the lawfulness of the proposed authorisation—one of the points that the hon. and learned Member for Edinburgh South West raised.

The points about cost and lawfulness that the hon. and learned Lady raised are certainly part of the advice that the applicant should receive, as well as the appropriate methods to obtain the data they are seeking, while the designated senior officer will be advised on the practicality of obtaining the data sought. Bear in mind that the single point of contact can already advise on the lawfulness of proposed authorisations. For authorisation to be lawful, it has to be both necessary for one of the statutory purposes in the Bill, and proportionate in all circumstances.

The point the hon. and learned Lady made about privacy is a reprise of the debate we had at the very beginning of our consideration, when I argued—I thought pretty convincingly, but clearly not—that privacy is woven through the Bill. For the sake of emphasis, I say again that the protection of privacy and personal data must be a key consideration in gauging proportionality.

[Joanna Cherry]

I hear what the Minister is saying. As I understand it, he is saying that the issues highlighted by the amendments will be taken into account, so why not say so? What is the detriment in saying so and making it crystal clear? This is for the comfort of the many constituents and members of the public who are concerned about the privacy and integrity of their data, so why not say so in the Bill? What possible detriment could there be in following that course of action?

[Mr Hayes]

Let me rehearse the argument that I used originally, because despite what I described as its persuasiveness, it clearly was not sufficiently well articulated to convert the hon. and learned Lady to the cause of virtue. Let me rearticulate it: if privacy is separated out in the way that some argue we should have done and might do now, and it is identified in the desiccated way that those people suggest, its significance is curiously—one might even go so far as to say paradoxically—weakened as a defining characteristic of the purposes of the legislation. However, it is worth emphasising the point I made a few moments ago about the need to tie personal interests and the protection of private data in to the test of proportionality in the draft codes of practice.

I draw attention to the codes of practice at paragraph 3.18—the heading is “Further guidance on necessity and proportionality”—which says:

“An examination of the proportionality of the application should particularly include a consideration of the rights (particularly to privacy and, in relevant cases, freedom of expression) of the individual and a balancing of these rights against the benefit to the investigation.”

That could not be plainer in doing precisely what I have described, which is to look at the right to privacy—I do not like to use the word “right”; I prefer to use “entitlement”—the entitlement to privacy with the functioning nature of an investigation into the effectiveness of the process.

[Joanna Cherry]

As I understand it, the Minister is saying that privacy is so important and so woven into the Bill that to single it out would weaken its importance. Surely lawfulness is equally important and that has been singled out by the draftsmen in subsection (6)(d).

[Mr Hayes]

I have already argued that lawfulness is, again, an underpinning requirement in these terms. Just to be absolutely categorical, the designated senior officer is the one who makes the final assessment of necessity and proportionality, as required by the code of practice. They must have a working knowledge of legislation, specifically that which relates to necessity and proportionality and the entitlements of individuals in those terms.

I just think that the combination of the Bill and the codes of practice render the amendment unnecessary. I emphasised previously that the codes of practice are drafts and the final code of practice will reflect some of this Committee’s considerations. If I may turn my attention momentarily from the hon. and learned Lady, if the hon. and learned Member for Holborn and St Pancras feels that the code should be strengthened in that regard—I re-emphasise that I think they are pretty clear—I would of course be prepared to hear his argument. [Interruption.] Before I move on to the amendment about system integrity, I can see that he is champing at the bit, or maybe I am misinterpreting him.

[Keir Starmer]

I was going to cover this in my reply, but the argument the Minister is now putting is unpersuasive, and I am afraid I found it unpersuasive a week ago. In practical reality, when a senior designated officer gets to lawfulness, they will be thinking necessity and proportionality, and they are likely to be advised about that. That is the test for restricting privacy. What we do not see is the statement of privacy, either in this subsection or an overarching clause—I have been trying to articulate what is nagging away as to why the overarching clause is needed. In the end, real people, in real time, will find that lawfulness will mean going back to check necessity and proportionality. That is welcome and right, but they are not the definition of privacy; they are the permitted restrictions of it.

[Mr Hayes]

That is a fair argument and that is why it is necessary to supplement what the hon. and learned Gentleman describes with the code of practice in the way that I have described. My invitation to him was that if he accepts that, he might want to focus attention on the code of practice to see whether it is as good as it might be. I drew attention to the provision on the necessity and proportionality. It might be that the draft could be further improved. After all, nothing, at least on earth, is perfect, and certainly no Government would want to claim perfection—

[Suella Fernandes]

rose—

[Mr Hayes]

I was about to say that perfection was an intellectual construct, but I am happy to give way on that note.

[Suella Fernandes]

Is it not impossible that privacy will not be considered as part of any application? Proportionality runs through the authorisation regime, and if a single point of contact has to apply a proportionality test, by definition and necessity, he will incorporate a wide-ranging consideration of the impact on privacy.

[Mr Hayes]

Yes, I agree. That is an elegant re-articulation of the point that I was imperfectly making about the intrinsic relationship between a consideration of personal interest and the test of proportionality. For the exercise of the power to be proportionate, it must take proper account of the balance that I described between personal interest and investigative effectiveness.

[Keir Starmer]

This is a relatively minor point, but it goes to the wider question of the overarching clause.

[Mr Hayes]

It does.

[Keir Starmer]

We have to look at this issue practically, through the eyes of the people who will operate such authorisations. I know how it will work: they will be directed to look at the necessity against clause 53(7) and they will go through a list. They will then be asked to look at the proportionality against the matters set out in clause 53. That does not point them to privacy. In the vast majority of cases—in good faith, I am sure—they will go through that clause, rather like a checklist. I do not mean to demean or undermine the exercise that they will go through, but I have seen the operation of such tests many times. Those people will ask themselves, “Is it in the interests of X, Y and Z? Is it proportionate to that?” I accept the point about the code of practice, but they will not necessarily ask themselves about privacy. That point is probably more about the overarching clause than about the specific amendment, but that is our nagging concern. One has to see this issue through the eyes of how in practice the process will work on the ground in real time.

[Mr Hayes]

The hon. and learned Gentleman describes the concerns and says that he knows them. Of course, he will also know that it is part of the requirements that those people undertake the right training and that they are expected to have competence, in particular an understanding of all the necessary legislation, including rights legislation. It is important to understand that those people will be making an assessment based on both evidence and comprehension. I re-emphasise that the code of practice is vital. I am trying to tip him off—perhaps I am being too subtle—that he may want to press me further on those very matters in terms of the draft code of practice, which is pretty good, but such drafts can always be improved.

Let me be even more generous. I am an Hegelian, as the hon. and learned Gentleman knows, and I believe that the truth lies in the whole, as Hegel said. The emphasis on privacy that underpins the whole Bill is fundamentally important, but in this regard I take his point that those missioned to do this job need to be very clear about that balance. To be still more generous, he is right in his strong implication that the training and guidance that those people receive about the interpretation of proportionality in this regard is important. That is the purpose of the code of practice, but we might want to go still further and I am happy to be tested further on that during the course of our consideration. I want to move on to the next group of amendments, because otherwise we will do this to death, but have I signalled clearly my direction of travel?

[Keir Starmer]

I am grateful to the Minister. I raised this issue of how we go through this exercise with the codes of practice, to which we cannot table amendments, a week ago today. I take his comments as an invitation to draft or suggest tightening amendments—not necessarily in Committee, but outside it—where we think they are appropriate. I take it that those will be taken into consideration in any possible re-drafting of the code. I am grateful for that and we will engage with that exercise.

[Mr Hayes]

Yes. I think we have settled that, then. I was trying to act as an old hand to a young blood, despite our appearances and demeanour. To that end, I think the hon. and learned Gentleman has got the point.

[Simon Hoare]

To my simple mind, I just wondered which was which.

[Mr Hayes]

I would like to think I was a young blood with an old head. That is how I would see it; let us leave it there and move on.

Let me turn to systems integrity. It is important to set out the process for obtaining communications data. A public authority must require a communications provider to disclose communication data or it may engage in activity to acquire the data directly from a telecommunications system. Where data are sought from a provider, they will mostly be data that the provider has for business purposes or data retained under a retention notice. To the extent that a provider has put in place any dedicated system to provide for the acquisition of communications data, that capability and the necessary security assurances will be provided for under a data retention notice or technical capability notice.

In relation to obtaining data directly from a telecommunications system, the communications data code of practice makes it clear that communications data authorisation cannot permit the undertaking of any technique that involves interference with those systems themselves. That is quite important because, as various Committee members will know, that is an important assurance for providers. Such techniques could be authorised only under an equipment interference warrant. We will discuss those matters in the next part of the Bill.

The processes of requiring a provider to disclose data or the obtaining of data directly from a network will not have any impact on the integrity of telecommunications systems or the computer networks concerned. Accordingly, this is not an area on which the applicant or designated person will require advice. In essence, with that absolute firm assurance, the amendment is unnecessary and I invite the hon. and learned Member for Holborn and St Pancras to withdraw it.

[Keir Starmer]

The more I have listened to the debate on the amendment, the more convinced I have become that there is a need for an overarching privacy clause, to which I will turn our attention at a later stage. It follows from that that I will focus my energies elsewhere, and therefore I beg to ask leave to withdraw the amendment.