Investigatory Powers (Amendment)Bill [Lords]

Stuart C McDonald Excerpts

Report stage
Monday 25th March 2024 Commons Chamber

It seems to me that, were we to have those restrictions, that would not inhibit the Government’s perfectly reasonable ability to stop people developing products that stop us applying the security controls that we all want to see to keep us safe, and would strike the balance better between the powers that the Government must have and the ability that we need commercial manufacturers and developers to have to develop new products that benefit consumers. I hope that the Minister will consider that point when he comes to think about the development of the legislation, but in view of what the right hon. Member for North Durham said, that is all I need to say.

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

It is a pleasure to follow the right hon. and learned Member for Kenilworth and Southam (Sir Jeremy Wright), and to take part in what has already been a very thoughtful debate. We also had a very constructive Committee stage, so the amendments in my name and that of my hon. Friend the Member for Midlothian (Owen Thompson) are designed first to pose some further questions to the Minister, particularly in relation to the offence of unlawfully obtaining communications data, which we discussed in Committee. Secondly, and perhaps more significantly, we again seek to remedy some of the serious concerns that we continue to have about the Bill extending powers beyond what we regard as necessary and proportionate, and the absence of sufficient judicial oversight where such judicial oversight is really required.

First, and briefly, our amendment 13 builds on the discussion in Committee about the offence created by the 2016 Act that will be amended by clause 12. We argued in Committee that the so-called example of “lawful authority” for obtaining communications data in proposed new subsection (3A)(e) of the 2016 Act was an extension of the power rather than a restatement of it. The Minister countered that he was actually seeking only to put existing codes of practice into statute. There is obviously a line of argument that codes of practice do not always necessarily comply with the law, but having gone away to look at the codes of practice it seems that there is a difference between what is currently in the codes of practice and what is currently in the Bill. The wording of amendment 13 reflects the code; the wording of proposed new paragraph (e) seems potentially broader than that. The question for the Minister is why the wording is so different, and whether he can assure us that it is not meant to be interpreted any more broadly than the existing exception in the codes of practice.

The remaining amendments set out our more fundamental concerns with the Bill. In particular, there are three areas where we question the strength of the oversight regime: in relation to bulk personal datasets, internet connection records, and Government notices to companies under clause 21. We regard advanced judicial oversight as important and reassuring not just for members of the public but for those who are exercising the powers. Clause 2 on bulk personal datasets is the first example of where we believe that oversight is being unnecessarily watered down. We are told that the system of advanced judicial authorisation is causing delays and stifling operational flexibility, but to us the answer is to fix those logjams in the oversight system, not to water that system of oversight down. The case for a lighter-touch system of category authorisations has not been made to our satisfaction. That is why we tabled amendment 7, which would take out clause 2.

At the very minimum, why not strengthen the ex post facto oversight beyond annual reviews and reports? Amendment 11 highlights one way to do that, so that the judicial commissioners are reviewing whether what is being done under category authorisations is lawful, cancelling authorisations where that is not found to be the case, and ensuring therefore that we have a clear picture of how the new powers are being used. I noted with interest what the Minister said about the role of IPCO, which we absolutely regard as helpful. However, it would be insufficient, and certainly less robust than our proposal in amendment 11.

[Sir Jeremy Wright]

As the hon. Gentleman set out, amendment 11 would strengthen the hand of the judicial commissioner, and I have some sympathy with that. My concern is that his proposed new subsection (4) says:

“The Judicial Commissioner, on reviewing any notifications received under subsection (2), must cancel the category authorisation if the Commissioner considers that section 226A no longer applies to any dataset that falls within the category of datasets”.

I wonder why he thinks that the wrongful inclusion of one individual dataset in the category would invalidate the category as a whole, because that seems to me to be the effect of what that part of his amendment would do.

[Stuart C. McDonald]

I am grateful to the right hon. and learned Member for that intervention. He possibly makes a fair point. If I recall correctly, the wording of that proposed new subsection was borrowed from another part of the Bill. I might be wrong about that; I need to go away and have a look. I suppose the argument would simply be that if a category authorisation is to any extent being abused, it is right that the category authorisation is cancelled, and if somebody wants to come back with something similar, they can do so. However, I am not without sympathy to his point. I take it in the spirit in which it was intended, and will reflect upon it.

Let me move on from the question of oversight in relation to bulk personal datasets to the issue of “no” or “low” expectations of privacy in relation to such datasets, and how that test will operate in practice. Throughout the passage of the Bill, we have been repeatedly given some very easy examples of so-called “low/no” bulk personal datasets. For example, we have spoken about phone books, academic papers, public and official records, and other data that many people would have access to routinely. It was helpful that, in relation to what is now our amendment 9, the Minister said in Committee that Facebook posts and CCTV pictures would be considered sensitive and would not be caught by these provisions. It is very helpful to have that on the record.

None the less, it would to be useful to have greater precision in the Bill. Amendment 8 would take out reference to “low” expectations of privacy altogether, so that only “no” expectations would be covered by the new provisions. To us, “low” is such a difficult question to adjudicate—low expectations in particular. That is especially the case when we are dealing with datasets of potentially huge numbers of very different people with very different reasons for having very different expectations of privacy, particularly in how that would relate to different organisations. We cannot think of a single dataset example provided during the passage of the Bill that would not be adequately covered by “no reasonable expectation of privacy”. If that is the case, if that is really all the Bill will be used for, why not just accept the amendment? It would be useful to have an understanding of what “low” expectation of privacy is designed to cover.

Amendment 15 brings us to internet connection records. In 2016, the Government emphasised the very targeted nature of the ICR powers, but here we are being asked to incrementally expand those powers so that they are slightly less targeted. To us, that means that the independent assessment of proportionality and necessity is pivotal, so we think that it should be subject to advance judicial oversight. Even the explanatory notes accept that there are difficulties in formulating sufficiently targeted queries, noting that

“such queries are highly susceptible to imprecise construction”

and that “additional safeguards” are required.

For us, the required additional safeguard is judicial oversight. We were led to believe that the powers would be used only exceptionally, so it is hard to see how a judicial authorisation requirement would cause any significant problem. The Government argue that there may be times when warrants are needed on an emergency basis, but that could be dealt with by having emergency processes or very limited exceptions—it is not an argument against a general rule of advance judicial oversight.

I turn to the impact on technology companies of the Bill’s various provisions relating to notices—although the right hon. and learned Member for Kenilworth and Southam probably made more sensible and eloquent points than those I am about to make. The written evidence that the Bill Committee received shows that tech companies, academics and human rights and privacy campaigners are still a million miles away from the Government in their understanding of how the provisions will work and of the impact that they will have on products and services. Apple wrote to the Committee that these provisions

“would dramatically disrupt the global market for security technologies, putting users in the UK and around the world at greater risk.”

It is frustrating and disappointing that we did not have the opportunity to explore those differences in detail through witness testimony. The Minister did his best to reassure us, and he made some important arguments about extraterritoriality and conflicts of laws, but given the serious concerns that have been raised, it is worth again asking the Minister to explain why those witnesses are wrong and he is correct. In particular, the Government’s explanation that the new pre-notification requirement in clause 21 is

“not intended as an approval mechanism”

has not dampened concerns. Apple argued in evidence to the Committee that

“Once a company is compelled to provide notice of a new security technology to the SoS, the SoS can immediately seek a Technical Capability Notice to block the technology.”

Other provisions in the Bill around maintaining the status quo during notice review periods work in tandem with these provisions to deliver what Apple and others see as a de facto block on adoption of new technology—that is the risk that they are highlighting, and it is what the Minister must address in his speech. It is why we have tabled amendments to take out some of those provisions. It is also why we have tabled amendment 19: an alternative that would introduce advance judicial oversight and, hopefully, a degree of reassurance that the new notification notice regime under clause 21 will not deliver the unintended effects that many fear.

Finally, I put on the record our support for the amendments tabled by members of the Intelligence and Security Committee, whose work on the Bill has been as helpful as ever—I congratulate them on their one-and-a-half victories so far. As is often the case when it comes to Bills of this type, we also put on record our support for several of the amendments tabled by the right hon. Member for Haltemprice and Howden (Sir David Davis), some of which are similar to amendments that we tabled in Committee, while others are similar to amendments that we supported during the passage of other Bills, including the National Security Act 2023. In particular, new clause 3, which is designed to place an absolute prohibition on the UK sharing intelligence with foreign Governments where there is a real risk of torture or cruel, inhuman or degrading treatment, is long overdue and would close a serious gap in the law. For us, that is self-evidently the right thing to do.

[Sir John Hayes]

As you will know, Madam Deputy Speaker, and as other Members have made reference to, I was the Minister who took the original Bill, which this Bill amends, through the House—indeed, it became the Investigatory Powers Act 2016.

The purpose of that legislation was both to draw together a number of the capabilities of the agencies necessary for them to keep us safe, and to put in place a series of mechanisms to ensure that there was proper scrutiny and accountability for those powers. We introduced the principle of a double lock, whereby both politicians and judicial commissioners were necessary to authorise some of those very powers. They matter because of the threats we face. Those threats are, as has been said by a number of contributors, metamorphosising. They were bound to do so, and we anticipated that when the original Act was considered in this place.

I accept the argument used by the shadow Minister, the hon. Member for Barnsley Central (Dan Jarvis), that that does not end here tonight. Those threats will continue to change, and it will be necessary to update the legislation to reflect those changes, for our security services and police need two things to do the job that we expect them to do on our behalf: capacity—namely, skills and resources—and capability, which includes legislative powers.

--- Later in debate ---

[Stuart C. McDonald]

I, too, thank all colleagues who have taken part in the proceedings today, in Committee stage and before, especially members of the ISC whose expertise really does benefit our scrutiny processes. I also thank all the various organisations that have provided written evidence and briefings, both in support of, and in opposition to, the Bill. Finally, may I also thank the Committee staff and the Clerks of the House for helping us through what has in some ways been quite a technical Bill?

The Investigatory Powers Act 2016 set out a detailed framework for use of investigatory powers. The existence of such a legislative framework was welcome, as were some aspects of the framework itself. We worked hard to try to improve that framework, but, ultimately, believed that it fell short of what was required and so we voted against that Bill on Third Reading. We are in much the same place today. We get the motivations for this Bill; they are understood and we are sympathetic with some of what the Bill seeks to achieve. However, we are not convinced that all the powers are shown to have been necessary and proportionate and that there are not other ways to get to where those seeking the new powers need to be.

At the same time, with more extensive powers and more extensive use of those powers, there should come greater oversight. In our view, the Bill heads us in the opposite direction, watering down or failing to put into place necessary advanced judicial oversight. Such oversight, we believe, is of benefit in providing reassurance not only to members of the public concerned with implications for their private lives, but to the very people who need to navigate these powers—members of our security and intelligence services and other public bodies. Instead, they are left to make difficult almost impossible judgments as to their lawful use, necessity and proportionality. Therefore, we do not take this step lightly, but for those reasons we will be voting against Third Reading tonight.