Crime (Overseas Production Orders) Bill [HL]

Lord Kennedy of Southwark Excerpts

Committee: 2nd sitting (Hansard): House of Lords
Monday 10th September 2018 Grand Committee

[Baroness Hamwee]

I do not suppose that that will trouble us in Grand Committee.

Clause 10 deals with the retention of data and its use as evidence. Clause 10(1) provides that data,

“may be retained for so long as is necessary in all the circumstances. This includes retaining it so that it may be used as evidence in proceedings in respect of an offence”.

“Necessary in all the circumstances” is quite a wide term. It may be unkind of me but, when I reread it yesterday, it felt as though the writer had run out of steam. One example is given but I would have expected more information about protections and clarification; otherwise, how does one challenge this? Therefore, the amendment is intended to ask the Minister how the Home Office envisages that this clause will operate in practice.

Given the example included, I wonder whether the Home Office anticipates producing guidance regarding retention, and that is the subject of Amendment 31. Amendment 32 is intended to probe the term “an offence”. Does this mean any offence? In particular, if an offence other than the object of this exercise is disclosed, is a fresh application needed or can this be—I will use the extreme term—an unending fishing expedition? I beg to move.

[Lord Kennedy of Southwark (Lab Co-op)]

My Lords, the noble Baroness, Lady Hamwee, raises three important amendments here and I look forward to the Minister’s response. She is right that, as written, the provision appears to be very wide in scope, and it would be better to have more clarification. The terms “in all the circumstances” and “an offence” are very wide, and it would be good to hear what they are. As the noble Baroness said, it would appear that there could be a never-ending fishing expedition, which in itself would not serve justice. I look forward to hearing the response to the very valid points raised.

[Baroness Williams of Trafford]

I thank the noble Baroness and the noble Lord for their points. I turn to the first point that the noble Lord, Lord Rosser, made—I am sorry, he did not speak, so it must have been the noble Baroness, Lady Hamwee; they do not look anything like each other. Where material is provided in compliance with a PACE production order, police are in principle able to use that material where it is relevant and necessary for another policing purpose, including a separate criminal investigation. The intention behind the overseas production order is basically to replicate the powers available to law enforcement under current domestic production powers. Under the Bill, the same will apply to electronic data obtained under overseas production orders. This ensures that law enforcement officials can use their independent discretion to consider what is appropriate to help with the conduct of their duties.

The effect of Amendment 32 would be to restrict the retention of the evidence produced in respect of an overseas production order to the offence for which the order was made. The Bill’s provisions do not dictate when an officer should apply for a new production order in respect of data received that is to be used for a different purpose. Again, this is consistent with existing practice. The Bill simply makes the same provisions in relation to orders which can be served on an entity outside the UK, where a relevant agreement is in place, as in relation to orders which can be served on a company based here.

It will always be appropriate for law enforcement officers and prosecutors to consider what can be used in an investigation and for evidential purposes. They will assess the likelihood of challenge in court where evidence produced in relation to a production order is adduced for a separate criminal offence. That is already their bread and butter. In all likelihood in those situations an appropriate officer may well decide that it would be more appropriate for a new production order to be obtained for the material produced that points to a separate offence.

A question was asked about guidance. The Government will consider whether it is necessary to produce policy guidance to assist an appropriate officer in these circumstances but, given that the Bill reflects existing practice in relation to production, I do not see that it brings about a new challenge for our law enforcement or prosecution professionals and I do not think it is necessary to mandate it in the Bill. For these reasons, I ask the noble Baroness to withdraw the amendment.

[Lord Kennedy of Southwark]

That was a very long explanation of why the clause is as it is and I thank the Minister for it. She referred to how this in effect mirrors what we have in PACE. Is guidance provided on PACE?

[Baroness Williams of Trafford]

There is a code of practice for PACE. We will look at whether some guidance is necessary for this replicated process.

[Lord Kennedy of Southwark]

I thank the Minister for saying she will look at those points. If we are mirroring PACE then we can mirror the guidance as well.

[Baroness Hamwee]

My Lords, I think I am going to have to spend some time between now and Report familiarising myself with PACE or hand this over to my noble friend Lord Paddick, whose bread and butter it was at one time. I take the point made by the noble Lord, Lord Kennedy, but I remain faintly uneasy about how open this is. Nevertheless I thank the Minister and I beg leave to withdraw the amendment.

--- Later in debate ---

[Lord Paddick]

My Lords, Amendment 39 is in my name and that of my noble friend Lady Hamwee. I am grateful for the briefing from techUK, which raises concerns about how this legislation might affect a deal between the EU and the UK on adequacy should the UK leave the European Union. We are unsure how to address those concerns and this amendment is very unlikely to be the means by which to do so, but at this stage it is a means of raising them. It is a bit of a Second Reading amendment, if noble Lords get my drift.

Throughout our debates it has been emphasised that the sole purpose of this legislation is to enable UK law enforcement agencies to find a faster legal means to secure data held overseas that may contain vital evidence in serious criminal cases being prosecuted in the UK than the current mutual legal assistance treaty process. Data handled in the UK is subject to the protections of the Data Protection Act 2018 and the EU general data protection regulations. Indeed, the Data Protection Act ensures that the GDPR continues to have effect, even if the UK does leave the EU.

Throughout our debates on this legislation we have expressed our concerns that the designated international co-operation arrangements that enable overseas production orders to have effect in the target state will give as much right to overseas law enforcement agencies to demand data from UK service providers as the right this legislation will give UK law enforcement agencies to demand data from a service provider in a foreign state. Those foreign states, such as the United States of America, are not bound by the Data Protection Act or the GDPR.

For a third country to exchange data with the EU it must persuade the EU that it has adequate protections for personal data equivalent to or exceeding the standards that EU countries have to comply with under the GDPR. Indeed, EU states are not bound by EU regulation relating to data used for national security purposes, but third-party states are. For the first time, if we leave the EU, the EU will scrutinise the way we handle data in relation to national security because we will become a third-party country, involving more scrutiny than currently takes place. I think that is called “taking back control”. Whether in relation to national security or not—we have already debated the weaker safeguards proposed in relation to terrorism offences—such arrangements could result in personal data from an EU country and shared with a UK service provider being passed to a law enforcement agency in a state that falls short of the protections provided by the GDPR.

In summary, our concern is that, by entering into international co-operation agreements enabling overseas law enforcement agencies directly to access personal data held in the UK by UK service providers, sensitive personal data will be accessed by overseas law enforcement agencies whose standards fall below those set out in the Data Protection Act and the GDPR, thereby jeopardising the EU granting the UK an adequacy certificate. Could the Minister explain what discussions have taken place with the EU on this issue and how the UK’s adequacy status will be protected? I beg to move.

[Lord Kennedy of Southwark]

My Lords, I fully support the amendment moved by the noble Lord. I recall our debates in the Chamber on the GDPR and how important it is to get the adequacy certificate to make sure that we are compliant with all these regulations, and we cannot put that at risk in subsequent legislation. I am looking for the Minister to address that point. The noble Lord has raised a very valid point. We need to get this right before this legislation reaches the statute book.

[Baroness Williams of Trafford]

I thank the noble Lord, Lord Paddick, for the point that he has made, and the noble Lord, Lord Kennedy, for backing it up. I smiled when the noble Lord, Lord Paddick, asked about countries that fall short of our data protection laws. We are probably at the top of the EU league table in terms of the rigour of our data protection legislation—I can think of some countries that might fall into the category that the noble Lord talks about—but the Bill will put on an equal footing the means by which UK law enforcement officers or prosecutors can apply to the court for access to electronic evidence, irrespective of whether the data is held by an entity based in the UK or based elsewhere in the world. UK law enforcement will be bound by the very robust Data Protection Act 2018 when processing personal data obtained pursuant to an overseas production order or where access has been given to data pursuant to such an order.

The noble Lord asked what discussions have been taking place. Those discussions are above my pay grade. I have not been involved in them personally but I know that they will have been going on, certainly in the background. However, the noble Lord makes a very good point about the adequacy decision. He also asked how we will ensure that data is used for the correct purposes. That is all part and parcel of what our Data Protection Act provides for. I am absolutely convinced that we in the UK have the right data protection safeguards in place and, when it comes to data protection and other countries, we will ensure that the same rigour is in place in the country with which we have made an agreement.

Clause 6(4)(c) states that an overseas production order,

“has effect in spite of any restriction”.

The noble Lord asked whether that means that UK CSPs do not need to comply with data protection. Having effect “in spite of any restriction” relates only to the effect of an order served on a CSP outside the UK, so the restrictions can only be in UK law, as we obviously cannot seek to override laws in other countries.

It might be helpful to reiterate that, when making a production order, a judge must consider the requirements set out in Clause 4. In doing so, he or she will need to consider whether the evidence is of substantial value to the investigation or proceedings and whether it is in the public interest to produce the information, balancing these factors with the right to privacy. It stands to reason that the more sensitive the data, the harder it will be for the applicant to justify the public interest test. I hope that the noble Lord will be happy to withdraw his amendment.

[Lord Kennedy of Southwark]

The noble Lord’s amendment seeks to put it into the Bill that, in cases of dispute, the GDPR shall prevail. Is the noble Baroness saying that this is implied anyway, or not necessary? If we end up with this on the statute book as it is now, and the matter of which Act applies were to become a matter of dispute in the courts, that is not where we would want to be.

[Baroness Williams of Trafford]

I agree with the noble Lord, but I am saying there would be an underlying basis for data protection, which is the Data Protection Act. Therefore, while there are many things we could put on the faces of many Bills, it is not necessary in this case—we already have laws governing the protection of data.

[Lord Kennedy of Southwark]

With that comment, is the Minister saying that, actually, GDPR will prevail?

[Baroness Williams of Trafford]

Yes, I am.