Communications Data Consultations on access and a Code of Practice for voluntary retention Simon Watkin Home Office

Policy Development - Access Any access to communications data by public authorities is an intrusion into someone’s privacy - and must satisfy ECHR principles of necessity and proportionality. “The Government believes it is time to put in place a statutory framework for authorising access to communications data … to regulate access … by investigating bodies.” Consultation Paper, June 1999 Part I Chapter II, Regulation of Investigatory Powers Act Not in force ……. yet.

Policy Development - Access Relevant public authorities listed in the Act Additional Public Authorities Order “A widespread extension of the powers of the state to snoop on its citizens...” Daily Telegraph, June 2002 “The proposals were intended to provide protection and regulation of the access to data.… when you are in a hole you should stop digging and having a full consultation on the issues raised seems the best way to do it.” Home Secretary, June 2002

Revised Proposals Consultation paper “Access to communications data - respecting privacy and protecting the public from crime” published 11 March 2003 Explains public authorities’ functions to prevent and detect crime Explains how communications data is used by public authorities now and with what outcomes Presents revised proposals for restrictions and safeguards.

Safeguards Specifying persons designated to seek access Accreditation of individuals through single points of contact (SPOCs) Compliance with RIPA statutory Code of Practice Oversight by the Interception of Communications Commissioner Sanctions for the abuse of powers to access communications under RIPA Restricting access by purpose (and function?) and by type of data

Further safeguards - The “Double Lock” Potential additional safeguards –judicial authorisation –prior approval by an independent third party –requiring the police to conduct investigations –certification scheme for public authorities

Policy Development - Retention Anti-Terrorism, Crime & Security Act 2001 Voluntary -v- mandatory Path open to deliver mandate if necessary –generally –description specified –particular provider(s) Must specify maximum period for retention Purpose for retention matching RIPA purpose for access

Policy Development - Retention Sunset clause for mandate –ability to issue mandatory direction ceases to have effect 2 years from passing of Act (13 Dec. 2003) –can be extended –must be introduced before original sunset clause comes into effect Gives options for delivery Allows discussion with Industry to continue

Parliamentary Changes Retention “for the purpose of safeguarding national security” or crime related to that Parliament decides that retention is appropriate, provided –consultation with Information Commissioner & Industry first –followed by public consultation Took a year to complete this initial consultation phase. Excessive?

Issues that have emerged All Party Internet Group Report recommendations “Legacy legislation” Multi-agency SPOCs Definition of communications data types “Predictive fishing” Subject access requests Openness and transparency of oversight State of the “technology war”

Issues that have emerged Bespoke systems required. Increase of costs Industry hesitant to volunteer –Information Commissioner’s advice –Possibility of data protection prosecution –potentially a public authority under Human Rights Law –Loss to competitors Would prefer to be mandated than to volunteer

Issues that have emerged All Parliamentary Internet Group Timed to precede public consultation –call for Home Office to drop all retention plans –ignores law enforcement/agencies case –call for negotiations on data preservation –EU-wide discussion to dismantle retention regimes –EU-law enforcement recommendation is for retention and, in specific cases, preservation not preservation alone –Industry presented behind closed doors & came out with high figures

Possible ways forward Industry willing to reveal true retention costs. Not so ‘scary’ after all Work of Technical Group consisting of Industry, agency, independent and Home Office members Data protection issues resolved by s. 28 DPA certification for national security Government to stand with Industry on any human rights challenge CSP’s giving clear indication of what is actually held Need to develop route for retention for all crime to resolve disparity concerns

Striking the right balance How should Government strike the delicate balance between respect for the privacy of the individual and protecting the public from crime? “We need a much broader public debate ….” - Home Secretary, June 2002 Chapter 4 of the access consultation paper describes the challenge for Government, asks what are the public’s privacy concerns are and invites views on the need for a wider review.

Consultation Consultation process Responses by 3 June Next steps