Police, Crime, Sentencing and Courts Bill — House of Lords, 2021-12-13
Topic: Mixed Topics
Susan Williams (Conservative, Centre-right): My Lords, I agree that this has been a very thoughtful debate. I hope that, at the end of this, the noble Baroness, Lady Chakrabarti, will not find me guilty of "Baroness-splaining". This is such an important issue. As the right reverend Prelate pointed out, for young people, their mobile phones are their life and contain things that certainly their parents should not see, nor others either. In Committee, I gave assurance that the Government were considering very carefully the Delegated Powers and Regulatory Reform Committee recommendation to the effect that provisions regarding the extraction of confidential information from electronic devices should be set out in the Bill rather than left to regulations, as Clause 42 currently provides. In our response to the DPRRC, which we sent to the committee last week, we confirmed that we accept the recommendation. Amendments 47, 49 and 52 to 55 make the necessary changes to Chapter 3 of Part 2 of the Bill to include provisions dealing with this issue These amendments are designed to ensure that additional safeguards will apply where an electronic device may contain confidential information, because authorised persons will be required to go through a separate assessment of the appropriateness of using the power where there is a risk that confidential information may be held on a device. To answer the question from the noble Baroness, Lady Hamwee, confidential information for these purposes includes legally privileged, journalistic and other types of protected materials, but I think that is what she suspected The noble Baroness, Lady Jones of Moulsecoomb, asked whether information extracted from a mobile phone would be disclosed to the defence. These provisions do not alter disclosure rules, which will continue to apply as now The amendments place an obligation on authorised persons to make a risk assessment, based on information that they have available, to decide how likely it is that they will come across confidential information on the device that they wish to examine. Having done so, they must turn their mind to the potential volume of confidential information held on the device and its potential relevance to the purposes set out in Clauses 36(2) and 40(2), for which the power can be used, in order to come to a view as to whether it is proportionate to use the power. This is intended to ensure particular consideration is given to the potential handling of inherently sensitive information. This will be reinforced by best practice guidance, to be set out in the code of practice under Clause 41. Authorised persons will be required to have regard to the code in exercising the powers under this chapter. We consider that this approach provides that balance between enabling extraction to go ahead in appropriate cases and safeguarding against improper access to confidential material Turning to the amendments in the name of the noble Baroness, Lady Chakrabarti, the House will recall that substantial changes were made to these provisions in Committee to further strengthen the safeguards for device users. These changes have been warmly welcomed by the Victims’ Commissioner. We believe, and I think noble Lords alluded to this, that any further issues can and should be addressed through the code of practice—more on that later—which will provide authorised people with detailed guidance on the lawful use of these powers Amendments 43 and 44 would afford a device user the option of observing the extraction taking place, unless that is impracticable or inappropriate. I can see the appeal of that, but different authorised people will have different tools available to them to carry out extraction, and these may be held in parts of a police station or law enforcement premises where only members of staff can be present. It could also be held in third-party laboratories which are not equipped to host members of the public. We think that these restrictions will make this obligation impractical in many cases, and we do not think that an obligation to allow a device user to observe this process is workable. Amendment 44 would also place a legal limit on the length of time that an authorised person can keep a device in their possession. Authorised persons already keep all devices for the minimum amount of time necessary, but the precise length of time is determined by a number of factors, and the officer to whom the individual gives their device gives an indication of how long this period will be. If for any reason this length of time changes, individuals are kept informed. I have highlighted in my notes that the rape review action plan makes clear our ambition to ensure that no victim is left without a phone for more than 24 hours Amendment 45 returns to a debate that we had in Committee about whether the necessity test in subsection (5)(c) of Clause 36 should use the language of "strict necessity", as in the Data Protection Act, in these clauses. As I have said previously, the powers in Clauses 36 and 40 must be read alongside existing obligations under the Data Protection Act or, indeed, the UK GDPR. Looking at the requirements in more detail, Part 3 of the DPA 2018 contains specific provisions relating to processing personal data for a law enforcement purpose. The "law enforcement purposes" are defined, in Section 31 of that Act, as "the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security." To process personal data lawfully under Part 3 of the Data Protection Act, it must either be with the consent of the data subject or strictly necessary for a law enforcement purpose. In the case of the latter, one of the conditions in Schedule 8 to the Act must also be met. For example, the processing must be necessary for the protection of someone’s vital interests or necessary for the safeguarding of children or individuals at risk. The draft code of practice makes clear that "strict necessity" is the standard that must be met when exercising these powers for a law enforcement purpose and that "consent" is not an appropriate lawful basis The UK GDPR provides the regime that must be complied with for all other data processing; that is to say, processing for a purpose other than a law enforcement purpose. The regime is likely to apply where the powers are being used for the purpose of locating a missing person, protecting a child or an at-risk adult from neglect or physical, mental or emotional harm, or the investigation of death where there is no suspicion of criminal activity. It is not therefore appropriate to set one standard of data processing in these clauses where these different regimes apply. As I have previously indicated, the obligations under the DPA and the UK GDPR continue to apply, and we think that the code of practice is the appropriate tool to communicate these responsibilities to authorised persons Amendment 46 would remove the provision that allows for authorised persons to use these powers where other means of obtaining the information exist but it is not reasonably practical to use them. It is necessary that this provision remains, as there may be instances where alternative means are available, but they require excessive resource—for example, either time or costs. The draft code of practice makes clear that the authorised person must assess whether other means available would be unreasonable in the circumstances and that delay alone is not sufficient justification not to pursue an alternative method unless there is a real and immediate risk of harm Amendment 48 would create a formal process for an individual to request a review from a senior officer of the necessity and proportionality of using the powers. We agree that all individuals must be given all relevant details about any requests for personal information and have included the obligation to share these details in writing. The data processing notice used by the police includes details of how to challenge a request, but, in all cases, individuals should be asked to volunteer their device and agree to the extraction of information from it only as a last resort, and requests must be necessary and proportionate As part of the rape review action plan, Thames Valley Police has begun a pilot to introduce the ability for victims in rape cases to request a review when the police make a request for personal information during the investigation stage. This is not confined to requests for digital evidence. We will continue to engage with interest with colleagues in the NPCC and Ministry of Justice who are working with Thames Valley Police. Following the pilot, if appropriate, we can address this issue further in revisions to the code of practice Amendment 50 in the name of the noble Lord, Lord Paddick, would ensure that the matters set out in subsection (3) of Clause 38 are explained to a device user orally as well as in writing. The clause requires notice to be given in writing to ensure that this information is formally recorded and can be referred to at a later stage of an investigation or inquiry if needed. We think that the code of practice is the best place to provide that additional guidance to authorised persons on how best to communicate this information to an individual before they agree to the extraction of information.