Source: https://hansard.parliament.uk/Lords/2018-10-30/debates/F2B04417-1038-4179-8EFC-BBEC51692D35/DataRetentionAndAcquisitionRegulations2018
Timestamp: 2019-04-25 00:38:28+00:00

Document:
That the draft Regulations laid before the House on 28 June be approved. Considered in Grand Committee on 24 October.
My Lords, the other place approved these draft regulations on 15 October and they were considered in great detail in Grand Committee on 24 October. That was followed by a letter on 25 October to all noble Lords who took part in the debate. Of course, a copy of that letter was also placed in the Library.
The regulations bring into force the draft communications data code of practice and amend the Investigatory Powers Act—IPA—to comply with a European Court of Justice ruling. The ruling requires that there must be independent authorisation for requests to access communications data and, in relation to crime, where the intrusion into private lives would be serious, the offence justifying that intrusion must also be serious. The High Court declared that the Act must be amended by 1 November, which is when these regulations are due to come into force. Therefore, it is important that they are approved today.
I will explain what these changes will mean in practice. To clarify, we are talking about communications data—information such as the name of someone subscribing to a mobile phone contract, the time a call was made or the number that was dialled—but not the content of any calls or messages. At the moment, a police officer investigating any crime can request any type of communications data to support their investigation if it is necessary and proportionate to do so. A request is sent to a designated senior officer who, having consulted a specialist in the use of communications data, decides whether or not to authorise the request.
The regulations introduce additional safeguards to the process. The police officer will no longer be able to request any type of communications data in the investigation of all crimes. Instead, the officer will be able to access only the more intrusive types of communications data—such as where the person was when making a call—in the investigation of serious crimes. Instead of the request being authorised internally, it will now be sent externally to an independent organisation overseen by a Court of Appeal judge. The staff of this independent organisation—the Office for Communications Data Authorisations, or OCDA—will assess the request and, weighing up all the factors relating to necessity, proportionality and seriousness, decide whether or not to authorise it. Only once this independent authorisation has taken place can the officer acquire the data.
There will be cases—such as a missing child, a terrorist attack or another threat to life—where communications data must be accessed more urgently than the new regime will allow. The regulations and code of practice, therefore, include provisions for such circumstances, allowing internal authorisation by a designated senior officer, but make it clear that such authorisations will expire after only three days— not 30 as with ordinary authorisations—and all urgent requests will be reviewed by the Investigatory Powers Commissioner’s office; that is, the OCDA. Your Lordships will see that these regulations are about strengthening safeguards, limiting the availability of communications data to public authorities and ensuring that when it is made available, that happens only after proper independent scrutiny.
When we debated the regulations in Grand Committee last week, the noble Lord, Lord Paddick, raised concerns that the definition of serious crime in the regulations does not abide by the ruling of the European Court of Justice that I have already mentioned. I strongly disagree. All offences that meet the serious crime definition, and pass the tests of necessity, proportionality and seriousness set out in the code of practice, will in fact be serious and warrant the use of communications data in their investigation.
A higher threshold would not allow public authorities to investigate such offences as harassment, stalking, sexual communication with a child, sending grossly offensive messages and contempt of court among others. The Government believe that these are serious and that communications data should be available in their investigation. They are certainly not viewed as trivial by the victims.
The European Court of Justice itself, in its recent ruling on a Spanish case, Ministerio Fiscal, made it clear that a higher level of intrusion into private lives in accessing different types of data must correlate with the seriousness of the offence being investigated. The more intrusive the data request, the more serious the offence must be. Legislation alone cannot give effect to this, and I ask noble Lords to see these measures as a package, with independent authorisation, a legislative threshold that sets clear limits, and the code of practice, which involves considerations of necessity, proportionality and seriousness. As a result, less intrusive data types will still be available when investigating all crime types, but the more intrusive communications data, such as location data, will be accessed only in the investigation of serious crime. Being able to intercept—bug—phones will continue to be available only for the investigation of offences meeting the higher seriousness threshold already in the Investigatory Powers Act.
We consider the regulations to be very much in the spirit of the European Court of Justice ruling. We already have strong safeguards and oversight in relation to our investigatory powers. If an individual believes that their communications data have been accessed unlawfully, they can make a complaint to the Investigatory Powers Tribunal, which is independent of government and consists of senior members of the legal profession. The regime as a whole is overseen by the Investigatory Powers Commissioner, a Court of Appeal judge independent of government. Moreover, the Act as a whole must be reviewed after five years, allowing us to consider whether any changes must be made.
The Government have carefully considered the European court’s decisions in this area and have proposed amendments in good faith, ensuring that this important investigative tool is available to the police for crimes whose impact on the victim is considerable. The regulations are about increasing, not reducing, safeguards. If they are not passed into law by 1 November—Thursday—the new additional safeguards I have talked about will not come into force. I beg to move.
My Lords, I first remind the House that I was a police officer for over 30 years and that— contrary to popular belief—my certificate of service says that my conduct was exemplary. I acknowledge the importance of communications data in the investigation of serious crime, as the Minister has set out. I also welcome the independent authorisation provisions contained in these regulations, as far as they go.
Secondly, may I give the House some background on the history of the passage of these regulations through this House? At a meeting with the Minister of State for Security and Economic Crime, the Minister of State for Countering Extremism and officials almost three weeks ago, I asked for an explanation of the definition of serious crime in these regulations, which is significantly different from the definition in the Act under which the regulations are made. The Minister for Security was unable to offer an explanation, but undertook to find out and get back to me.
Having heard nothing by the day before the regulations were to be debated in Grand Committee, I alerted the Government to the fact that, in the absence of any explanation, I would seek to oppose the regulations when they reached the Floor of the House. At 8 pm the night before Grand Committee, the Minister of State for Countering Extremism called me to find out what my objections were. I repeated my main concern, as clearly expressed in the meeting with Ministers and officials on 10 October, and she undertook to provide me with a copy of the relevant part of the Minister’s opening speech in Grand Committee. This was received at 10 am on the day of the Grand Committee debate.
Turning to the regulations, in the Investigatory Powers Act 2016—the Act of Parliament under which these regulations are made—serious crime is defined as offences for which a person over 18 with no previous convictions can reasonably be expected receive a custodial sentence of three years. In other legislation currently before the House, the Counter-Terrorism and Border Security Bill, the definition of serious crime is the same. An offence for which the expected custodial sentence is three years’ imprisonment without any previous convictions is not a maximum sentence of three years. Take shoplifting, for example. The maximum sentence for theft is 10 years in prison, but someone stealing a can of beans from Tesco could not be expected to be sent to prison for three years.
The regulations not only lower the bar to a minimum of 12 months’ imprisonment—down from three years—but, by defining serious crime as an offence for which someone is capable of being sentenced to 12 months, mean a maximum sentence of 12 months or more, a much lower threshold than the definition in the Act. Furthermore, it disregards any enactment prohibiting or restricting the imprisonment of individuals who have no previous convictions, as opposed to the Act, which has regard to such restrictions.
not the prohibition on using communications data to investigate trivial offences. The CJEU allows member states to define a serious offence as entailing three years’ imprisonment, or a maximum sentence of 12 months.
However, the regulations go even further. They include any offence committed by a body corporate and any offence that involves, as an integral part of the offence, the sending of a communication or a breach of privacy. “Any offence” clearly does not differentiate between a serious offence and an offence that is not serious.
“The court concluded that the offence must be serious to justify a serious level of intrusion involved in accessing communications data (i.e. where the data would allow precise conclusions to be drawn concerning the private lives of the persons concerned)”.
The details of every phone call made and received on someone’s mobile phone, the geographic location of that phone on any particular day or time and the websites that a person has accessed either on their phone or computer in the past 12 months are all communications data, and accessing them amounts to a serious level of intrusion.
“seeks to capture offences such as online stalking or harassment which law enforcement advise have the potential to escalate to more serious offences such as assault, and this has been shown by experience to often be the case. Such offences can be incredibly distressing and alarming to the victim”.
“can be incredibly distressing and alarming to the victim”.
As soon as such offences reach a level of involving fear of violence or serious alarm or distress, they amount to an offence under Section 4A of the Protection from Harassment Act 1997, which attracts a maximum prison sentence of 10 years. That is clearly within the proposed 12-month maximum sentence limit in these regulations, and arguably within the three-year anticipated custodial sentence in the existing definition of “serious offence” in the Investigatory Powers Act. The CJEU explicitly states that the use of communications data must be restricted to the investigation of serious offences, yet these regulations define any crime as serious if committed by a body corporate or if it involves the sending of a communication or a breach of privacy, when by any reasonable definition some of these offences will not be serious.
Two questions therefore remain: why have the Government tried to twist the definition of “serious offence” to include offences that are not serious, and how do they expect to get away with it, bearing in mind that these regulations are a response to a CJEU ruling?
I understand the difficulty of investigating some low-level offences if the police cannot access communications data, but the CJEU has ruled on where the line needs to be drawn between preventing unreasonable intrusion into citizens’ privacy and law enforcement, and it drew that line at serious crime. The Government cannot redefine “serious” as any offence involving the sending of a communication or a breach of privacy to get around the bar that the CJEU has set, just because the police say it is an important investigatory tool.
“with the objective of fighting serious crime”.
So how do the Government expect to get away with this clear flouting of the spirit of the CJEU judgment? Presumably they hope that by the time these regulations are challenged in the courts, we will have left the EU and the jurisdiction of the CJEU. This case shows the danger that our civil liberties are in if we leave the EU.
I will spare the House the issues around corporate offences; the way in which these regulations could jeopardise our data protection adequacy status; whether self-authorisation in urgent cases complies with the CJEU judgment requiring independent authorisation; whether there should be a requirement that any retained communications data should be kept within the EU; and whether the regulations should include a requirement to notify the person that their communications data has been accessed or used, as required by EU law—despite my having received no meaningful response from the Government on these issues. I look forward to the Minister’s response. I beg to move.
“‘When I use a word,’ Humpty Dumpty said, in rather a scornful tone, ‘it means just what I choose it to mean—neither more nor less.’ ‘The question is,’ said Alice, ‘whether you can make words mean so many different things’”.
We have had what we regard as a novel and inappropriate definition of “serious”. There is a current movement, which I welcome, towards language in legislation being as close as possible to normal-speak, giving words their natural meaning. Sometimes, of course, terms need definition, as I accept “serious” does in this context. However, an offence that could give rise to a 12-month sentence is not what most people would regard as serious in comparative terms—I put it that way because I will not be the only person in the Chamber tonight who thinks all crime is serious—and this is what the European court pulled us up on.
Maybe those are the ones that we have already heard about; I do not know. I appreciate that these behaviours often escalate but they are not the only behaviours or offences that can do so. If there is an issue of legislation regarding an offence and the sentence that it may attract, we should address it head-on. The Minister referred in the previous debate to the right of citizens to be protected from crime and terrorism. I have not read through all the terrorism legislation but she may be able to help me: are there any terrorism offences where the sentence is as low as a year?
She said that the regulations will prevent data being acquired in the investigation of trivial offences, and she mentioned that again today. I think this confuses categories of crime, which are what underlie possible sentences, and the particular infringement, which may be anywhere on a spectrum and the court will give its view in passing sentence as to where on that spectrum the test should be. I accept that there are tests of necessity and proportionality and that these are essential reference points for lawmakers and the commissioner, but it is harder for individuals who consider their privacy to have been invaded to look to these in an effective fashion.
My noble friend said that he would not mention corporate bodies and then rather effectively did so. I do not think the inclusion of these has been fully justified. There has been no attempt to distinguish between levels of seriousness in their case. I thought it was ironic that a crime that will be subject to—or qualifies for, if you like—the regulations may be an offence involving a breach of a person’s privacy.
I support my noble friend whose amendment to the Motion—although he opposes the regulations—is, in fact, to regret them, not to oppose them, and not to seek to delay them beyond 1 November.
“the sending of a communication or a breach of a person’s privacy”.
Since then the noble Lord, Lord Paddick, has put down the amendment to the Government’s approval Motion, which we are now considering.
The reason for the speed in considering the matter further so soon after last Wednesday’s debate is that the Government seek to have the draft regulations approved by this Thursday. If they are not, we will be in breach of a court order following a ruling of the European Court that the relevant parts of the Investigatory Powers Act 2016 are incompatible with European law. The draft regulations have already been discussed in the Commons, where we the Opposition said that we did not oppose the changes. That remains our position and for that reason we will not be supporting the noble Lord’s regret amendment to the Government’s approval Motion if he decides to test the opinion of the House.
Since last Wednesday the Minister, as promised, has written to noble Lords who participated in the debate, in the light of the concerns expressed, setting out the Government’s position on their proposed definition of serious crime in the context of retaining and acquiring communications data. They were valid concerns, which the noble Lord, Lord Paddick, has just reiterated in very clear and emphatic terms. In a nutshell, the Government’s argument, both tonight and in the letter of 25 October, is that the draft regulations remove a power from the police to use data to investigate non-serious crimes and provide additional safeguards and restrictions on the retention and acquisition of communications data in respect of the Government’s definition of serious crime. The changes provided for in the draft regulations were prompted by the court judgment on the incompati- bility with European law of the relevant parts of the Investigatory Powers Act 2016. The Government believe that what they have proposed in the draft regulations meets the terms of that court judgment.
The Government’s second argument is that if they used the definition of serious crime that exists in Section 263 of the Investigatory Powers Act in relation to interception powers in respect also of retaining and acquiring communications data which the Government regard as less intrusive, it would mean that the ability to investigate some crimes considered to be serious would be compromised. The Government also referred to the code of practice and the considerations that have to be taken into account when assessing seriousness, the independent authorisation of communications data requests by the Office for Communications Data Authorisations and the oversight of public authorities and the OCDA by the Investigatory Powers Commissioner.
In theory, these provisions ought to be enough to prevent the definition of serious crime from being abused through ending up with communications data authorisation in respect of crimes that could not be regarded as serious in their nature by any stretch of the imagination. However, there have been too many examples of powers which have been provided by statute in good faith to address genuine concerns in specific areas which have then been abused by being applied or used by those given the authority to deploy them in ways that were never intended or envisaged. Frankly, no one can give a cast-iron guarantee that this could not happen in relation to the use of the provisions in these draft regulations, which were designed to address a court judgement and which may or may not stand up to further judicial scrutiny.
“I recognise that some noble Lords may consider that our amendments do not go far enough to limit the retention and acquisition of communications data to serious crime. That question is subject to ongoing legal proceedings”.
“Should the courts not agree with our position we would of course move to rectify the regime”.
We understand the concerns being voiced by the noble Lord, Lord Paddick, but likewise—as I am sure the noble Lord does, too—we understand the reasons for these draft regulations and the desire to have provisions that will assist in bringing to justice those who have committed serious, unacceptable acts. The issue is whether the regulations meet the terms of the court judgment—a matter that will presumably be determined in the courts—and whether the authorisation and oversight arrangements and procedures, if they survive legal proceedings intact, will prove strong enough to prevent the powers, the purpose of which we understand, being misused. The Government maintain they will be strong enough, but only time and experience will show. The Government now have a responsibility to make sure that their assurances over how the regulations in reality will be applied and used are adhered to and delivered in full. I am sure that plenty of people will be watching to see whether that happens. As I said at the beginning, we did not oppose the changes provided for in these regulations in the Commons, and that remains our position.
My Lords, I am glad that we have been able to debate these regulations so thoroughly and consider carefully the proposed amendments to the Investigatory Powers Act. I thank the noble Lord, Lord Rosser, for his very balanced approach to this important issue, and the noble Lord, Lord Paddick, and the noble Baroness, Lady Hamwee, for their considered view on the issue of what constitutes serious crime. If I may refer them back to my letter, the position that I outlined there remains the Government’s position.
I will briefly say a few things, but I am conscious that almost everything that has been said tonight was said in Grand Committee—I can see the noble Lord, Lord Paddick, nodding—and I have followed it up in writing to all noble Lords who took part in that debate. I again apologise for any confusion that took place regarding the earlier part of the issue that the noble Lord, Lord Paddick, raised, in relation to the meetings with the Ministers of State. I was not party to those discussions, so I apologise that I am not in a position to comment, but I hope that my letter went some way to addressing the issues that were raised with me in Grand Committee.
I will say a few things again for clarity. These regulations bring in additional safeguards. They ensure that the more intrusive requests for communications data will be accessed only in the investigation of serious crime and that the vast majority of requests by public authorities to access all communications data—approximately 200,000 requests are made per year—must be authorised by an independent organisation overseen by a Court of Appeal judge. There are very clear safeguards in place. We are taking powers away from our law enforcement agencies in the interests of privacy.
We are, of course, mindful of our duties to protect the public and properly to investigate crimes that they suffer. A balance must be struck and these regulations strike that balance correctly. As I have said, noble Lords may have differing opinions on whether our definition of serious crime in this context is appropriate. Let me be clear. I do not want our police to be unable to effectively investigate an individual sending grossly offensive messages to someone, causing huge distress to the victim who certainly considers the offence to be serious. I do not want to damage the effectiveness of our judiciary by limiting the ability of the police to investigate contempt of court. These are serious matters.
I refer the noble Baroness, Lady Hamwee, and the noble Lord, Lord Paddick, to page 2 of my letter. It is not just the sentence that the person who commits the crime receives. That is important in terms of the 12 months, but it is not the only issue. As the code of practice sets out clearly in paragraph 3.33, a range of factors should be considered, including but not limited to the circumstances of the case, the offender, the impact on the victim, the harm suffered and the motive for the crime. I hope that that goes some way to addressing the concerns that noble Lords raised.
We have a comprehensive code of practice which provides extensive guidance on what considerations must be taken into account by individuals applying for and authorising requests for communications. As I have said, each and every request must be assessed in relation to necessity, proportionality and seriousness. We are strengthening the safeguards and oversight of a regime already world-leading in these aspects, and we are creating a regime that is compliant with EU law.
I am grateful to Members of the House for their time in ensuring that this has been such a valuable and high-quality debate. We take these issues very seriously. I would now like the regulations to be approved and I commend them to the House.
My Lords, I am grateful to the noble Baroness. It is not primarily about the definition of serious crime being an offence punishable by 12 months’ imprisonment or more. It is about the fact that it goes beyond that to include all offences, whether or not they are capable of a 12-month sentence, that have communication as an integral part, all corporate offences, whether or not somebody can be given a 12-month sentence, and all offences involving a breach of privacy. Clearly that is going beyond the definition of serious crime: it includes lots of offences that are not serious.
I am not reckless enough to jeopardise these regulations by asking noble Lords to vote against approving them, but I hope that noble Lords will agree that the Government’s attempts to get round the CJEU judgment is to be regretted, and I wish to test the opinion of the House on my amendment to the Motion.
Division on Lord Paddick’s amendment to the Motion.
Lord Paddick’s amendment to the Motion disagreed.

References: CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU