My Lords, Clause 199 explains the process of, and sets the time limits for, the initial examination of a dataset. The noble Baroness, Lady Hamwee, has explained the purpose of Amendments 231ZD and 231ZC, and I am obliged to her for indicating that these are probing amendments. I make no point about the technicalities of the proposed amendment, and understand the underlying rationale for making these probing amendments.
Although there may be occasions when a security and intelligence agency knows exactly what it has received, that is clearly not always the case. To give a simple example, an agency may receive a USB stick that it believes contains files relating to an organisation engaged in terrorist activity. This might, or might not, be a bulk personal dataset, and needs to be subject to an initial examination to determine whether it is a bulk personal dataset. To be absolutely clear, this initial examination process can only establish what the data are: in particular, whether this is a bulk personal dataset or not, and whether there is a case for retaining it. They cannot be searched or selected for examination without a warrant, so delaying applying for a warrant is not a way for the intelligence agency to work round the system provided for in the Bill.
It is not in anyone’s interest to delay the process. The agency cannot start using the data until a warrant is issued, and the agencies will therefore want to get warrants in place as quickly as possible, particularly as there may be concerns about whether threats and opportunities will be missed by reason of any delay. More generally, the Bill places an obligation on the agency to apply for a warrant,
“as soon as reasonably practicable”,
meaning that if it is possible to apply for a warrant sooner than the deadline set out in Clause 199 the agency would do so. The time limit here is just what I would term the “hard stop” provision within the clause. Amendment 231ZD is therefore unnecessary and indeed, in a sense, unhelpful.
From the point where the intelligence agency believes a dataset created in the United Kingdom includes personal data, as the noble Baroness, Lady Hamwee, noted, it has three months to complete the initial examination and apply for a warrant to retain and, if necessary, select data for examination from the dataset. Amendment 231ZE seeks to reduce this period from three months to one month.
The Government do not think this is appropriate. The structure and format of some bulk personal datasets can be highly complex, even if created in the United Kingdom. In some cases, it can take considerable time to be confident that the structure is sufficiently understood. Only then can the intelligence agency accurately describe the information contained in the dataset and know whether it is necessary and proportionate for it to be retained. There may be other factors that require time to resolve, including, for example, technical difficulties such as formatting, compression and encryption. Indeed, there may be language issues: the dataset, even if created in the United Kingdom, may be in a foreign language. In addition to that, the size of the dataset can be a factor. Three months is therefore considered the appropriate time limit for this initial examination. However, I underline the point that this is an outer limit—this is the hard limit for that.
Again, I emphasise to the noble Baroness that this three-month time limit does not provide a way for the agencies somehow to circumvent the safeguards within the Bill. The dataset in question cannot be used for intelligence purposes until a specific BPD warrant is in place or until the provisions set out in chapter 6 of the draft code of practice, which relate to authorising retention and use of a dataset fitting within a class warrant, are met. In these circumstances, I invite the noble Baroness to withdraw the amendment.