Regulation of Investigatory Powers (Monetary Penalty Notices and Consents for Interceptions) Regulations 2011

Lord Shipley Excerpts

Tuesday 17th May 2011 Grand Committee

[Lord Rosser]

My Lords, first I thank the Minister for explaining in detail the regulations and their purpose. The main reason for this instrument, and for the stronger wording and stiffer penalties that it provides, appears to be the desire to meet the concerns of the European Commission that the United Kingdom has failed to incorporate properly into national law the European Union's privacy and electronic communications directive. It has been claimed that concerns were prompted by complaints received by the Commission from BT customers after it conducted unannounced, targeted advert trials through a software company that used its technology to intercept and monitor the web activity of BT customers to match adverts to the interests of users.

The Crown Prosecution Service recently decided not to proceed with action against BT and the software company as it did not consider that there was enough evidence to convict. However, last September the Commission referred the United Kingdom to the European Court of Justice, citing concerns that our laws did not adequately protect against intrusion into personal privacy. The concerns were that we had not created a sanction for all unlawful interception, only for intentional interception; that we had not created an independent authority responsible for the supervision of all interception activities; and that we had wrongly made it lawful to intercept a communication where the interceptor had a reasonable belief in the other party's consent to the interception.

On the basis of what the Minister said, the Government acknowledged the first and third points, but not the second on the independent authority. Perhaps the Minister will comment on that. Perhaps she could also say whether the Government regard the provisions in this regulation are likely to bring to an end any proceedings at the European Court of Justice.

The Government proposed amendments to the Regulation of Investigatory Powers Act last November, and the outcome of the consultation showed strong support among the 39 respondents for the adoption of what were described as “unambiguous measures”, making it clear that users have to grant consent before companies can intrude on their communications, and that it should no longer be sufficient to maintain that including relevant information within the general terms and conditions of privacy policies would allow for a sufficient expression of consent. We note that guidance will be provided by the office of the Interception of Communications Commissioner and we understand the reasons for this statutory instrument. I also take it from the words used by the Minister that the Government are perfectly happy to proceed with this revision of the Act. They do not regard it as an example of what they would describe as unnecessary bureaucracy and regulation, and they do not regard themselves as having to do this simply because the European Commission has told them they ought to do it. I had the impression from what the noble Baroness said that the Government themselves believe that this is the appropriate action to take. I would be grateful if she would confirm what I believe she said in her introductory comments.

I conclude by asking when the guidance will be provided by the office of the Interception of Communications Commissioner. Will she also confirm that the anticipated additional workload and costs on the public purse is effectively nil?

[Lord Shipley]

My Lords, I, too, thank my noble friend for proposing this statutory instrument. I do so because it strengthens the rights of the individual and is therefore most welcome. However, it is not clear why the privacy directive produced in 2003 was not put in place correctly at the time. It is now some eight years since that occurred. If the Minister is in a position to say a little more about why it has taken so long to put this right, that would be welcome.

Two of the three issues raised by the European Commission have now been addressed. Those are, first, the introduction of unintentional as well as intentional interception; and, secondly, the requirement for positive consent by an individual for interception. But a question remains around the role of the independent authority. I would like to be clear about this because the European Commission raised three concerns, the second of which was that:

“The UK had failed to create an independent authority responsible for the supervision of all interception activities as required by Article 28 of the Data Protection Directive”.

The Explanatory Notes to the regulations state simply that:

“The Government has not conceded the alleged defective transposition [from the directive] identified”.

It is not clear to me quite why the Government have not conceded that.

That takes me on to the issue of the Information Commissioner, as distinct from the Interception of Communications Commissioner. The office of the Information Commissioner submitted a lengthy response to the consultation to this RIPA regulation, from which I will quote from paragraph 1.5:

“If personal data is intercepted unlawfully under section 1(1) of RIPA this may also constitute a breach of the first data protection principle. It will be important therefore to draft the legislation in a way which allows the ICO to work with the IoCC once it has been established if an interception is unintentionally unlawful”.

The question is this: is the Office of the Information Commissioner satisfied with the result of the consultation and the statutory instrument?

I have two final points on which I would appreciate guidance from the Minister. First, are we clear on how consent will be given to the monitoring of communications? In other words, how the opt-in is taken by an individual is extremely important. Secondly, how soon might we review this statutory instrument? A year or two from now, will there be a further review to assess whether what we have proposed in meeting the European directive has been achieved?