My Lords, I rise to speak to Amendments 15 to 20. In Committee, I moved amendments seeking to remove Clause 13 and its associated schedule. This was to retain the current arrangements, which wisely restrict a number of public authorities from being able to compel the disclosure of communications
data from telecommunications operations. Parliament restricted this power in the original legislation because it considered it to be potentially very intrusive.
What this means is that, at present, authorities such as the Environment Agency or the Health and Safety Executive are required to take further procedural steps to compel disclosure of communications data. They must obtain an authorisation under the current IPA, a court order or other judicial authorisation, or under regulatory powers in relation to telecommunications or postal operators, or they must obtain the communications data as the secondary data as part of a valid interception or equipment interference warrant.
The Bill seeks to remove that requirement for further procedural steps in relation to a wide range of public regulatory authorities. The Government’s argument for removing these restrictions is that a broader array of communications now fall into the category of communications data and a wider number of organisations now constitute telecommunications operators. As a result, the current restrictions prevent some regulatory authorities from acquiring the information necessary to exercise their statutory functions in a way that was not anticipated at the time of the original legislation.
These organisations have argued that this is particularly relevant to bodies with a recognised regulatory or supervisory function which would collect communications data as part of their lawful function but are restricted under the current Act if their collection is not in service of a criminal investigation; in particular, the changes focused on improving the position of certain public authorities responsible for tax and financial regulation, the powers of which were removed in 2018 as a result of rulings by the European Court of Justice. The ISC recognises that such bodies much be able to perform their statutory function effectively; however, we have been told that the Bill delivers only the urgent, targeted changes needed, and we have not thus far been presented with the case for that.
This was a highly scrutinised issue during the passage of the original Act. Parliament rightly ensured that the power to gather communications data was tied to national security and serious crime purposes only, to avoid impinging on the right to privacy without very good reason. We should not lightly brush that aside.
There have been a number of reported incidents of the intrusive use of investigatory powers by local councils and other public authorities for purposes that are subsequently deemed neither necessary nor proportionate; for example, things such as dog mess. The Minister said in Committee that the clause
“applies to a relatively small cadre of public authorities in support of specific regulatory and supervisory functions”.
Yet in response to my question on which bodies would see their powers restored, he said that
“it is not possible to say with certainty how many public authorities have some form of regulatory responsibilities for which they may require data that would now meet the definition of ‘communications data’”.—[Official Report, 11/12/23; col. 1759.]
How can it be right to expect Parliament to reintroduce sweeping powers for a wide range of public bodies when a previous Parliament deemed that that was too intrusive—and when we cannot even be told which
bodies they will be? Noble Lords will need to be sufficiently satisfied that these powers are to be given to bodies that cannot function without them; this cannot be a case of just giving powers back by default. I urge the Minister to consider this further. As it stands, we have not been given the information, or a convincing case, to persuade Parliament of the need for such a complete about-turn. The ISC will continue to pursue this amendment unless robust assurance can be provided that these powers will be restored in a sufficiently limited and targeted way.
Amendment 17 and its two consequential amendments seek to remove the ability of the agencies to internally authorise the use of this new, broader power to obtain internet connection records for target discovery. My amendment would require the agencies to seek approval from IPCO, thereby ensuring proper oversight. As I noted in Committee, Clause 14 creates a new, broader power for the agencies and the NCA to obtain ICRs for the purpose of target discovery. It represents a significant change from the current position because it removes the current requirement that the exact service used, and the precise time of use, be known. Under these new provisions, the agencies will be able to obtain ICRs to identify which person or apparatus used internet services in a period of time—a far broader formulation that will capture a far broader number of individuals.
As I also noted previously, the ISC agrees with broadening the power; what it does not agree with is that there is no oversight of it. The principle remains that increased powers must mean increased oversight. This new, expanded power is potentially very intrusive: it allows the agencies to obtain ICRs from a range of internet services over a potentially long period of time, and they could therefore potentially intrude on a large number of innocent people who would not have been captured previously.
It is essential in a democracy that there are appropriate safeguards on such powers, but in all cases relating to national security and economic well-being, the agencies are able to authorise use of this newly expanded, broader power internally. They make the assessment as to whether it is necessary and proportionate; there is no independent oversight of the agencies’ assessment. The Minister argued in Committee that the ISC amendment inserts a disproportionate limitation on the agencies’ ability to use condition D, as the Government
“do not assess that the new condition creates a significantly higher level of intrusion”.—[Official Report, 11/12/23; col. 1761.]
With respect, the ISC not only disagrees with this assessment but finds it incomprehensible. This is about depth and breadth. The new condition D may not represent a new depth of intrusion as ICR requests under the new regime will still return the same type of information, but it certainly represents a much wider breadth of intrusion as a far greater number of innocent internet users’ details will be scooped up by these ICR requests.
The Government may argue that, because those individuals’ details will not be retained once they have been checked and found not to be of intelligence interest, this is therefore not an intrusive power. Again, with respect, this is not an answer that Parliament or indeed the public can or should be satisfied with. I doubt any individual would feel that their privacy
had not been intruded on if they had been scooped up just because they had not been retained, particularly when the retention of details is currently contingent entirely on the judgment of the agencies themselves, with no external input on whether the judgment is proportionate. The ISC very firmly believes that the new condition is more intrusive, and therefore greater oversight is required to ensure the power is always used appropriately.
Oversight will act as a counterbalance to the intelligence community’s intrusive powers and provide vital assurance to Parliament and the public. This amendment and my two linked amendments therefore remove the ability of the agencies to authorise use of this power internally. The agencies would instead be required to seek the approval of an independent judicial commissioner from IPCO to authorise the obtaining of ICRs under this new, broader power. This strikes the right balance between security and privacy and minimises any burden on the agencies.
I move on to Amendment 18 in relation to the new same broader target discovery power in Clause 14. This amendment is to limit the purposes for which this new power would be used. As I outlined previously, target discovery has the potential to be a great deal more intrusive than target development as it will inevitably scoop up information of many who are of no intelligence interest. This is why we must tread very cautiously in this area and be quite satisfied of the need for the power, that the power is tightly drawn and limited, and is properly overseen.
The ISC agrees with the noble Lord, Lord Anderson, who, in his excellent report reviewing the Government’s proposal for this Bill, supported the need for this change. The ISC has considered the classified evidence and recognises that due to technological changes the current power is less useful than envisaged due to the absolute precision it requires. However, as this House also recognised, Parliament deliberately imposed a high bar for authorising obtaining internet connection records, given their potential intrusiveness.
The noble Lord, Lord Anderson, also recommended, therefore, that the purposes for which this new broader target discovery power could be used be limited to national security and serious crime only, and that use of it should be limited to the intelligence community. However, the Bill as drafted departs from his recommendations in both respects. Not only does it include the National Crime Agency as well as the intelligence community, but it allows the intelligence community to use the new, broader target discovery power for a third, far less-defined purpose of:
“the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security”.
In Committee, the Government argued that this decision had been taken because it is consistent with the statutory functions of the agencies and Article 8 of the European Convention on Human Rights. That is, of course, true. It is consistent, but that is not an argument in favour of simply transporting it here. Not every intrusive power should be available for every purpose that the security services have. Given the potential intrusiveness of this new power, it must be constrained appropriately and the purposes for which it can be used must be crystal clear.
However, what is not yet at all clear is exactly what critical work must be enabled under the umbrella of “economic well-being” as it relates to “national security” which is not already captured under the straightforward national security category. It must be clear exactly what harm would occur if this purpose were not included in the Bill. At the moment, the addition of “economic well-being” serves only to blur the lines between what an ICR can or cannot be used for, something which Parliament should not accept. Therefore, in addition to requiring independent judicial oversight, which is the subject of a separate amendment, this amendment seeks to prevent the agencies from using this newly expanded power for the purposes of economic well-being relating to national security. This will ensure that the rather vague concept of economic well-being is not being used as a catch-all justification for the exercise of these powers.
The agencies will of course still be able to use this power in relation to national security more broadly, and in urgent cases of serious crime. This is proportionate and indeed more in line with the recommendations of the noble Lord, Lord Anderson. Unless the Minister can provide the House with information as to exactly why it is critical to retain economic well-being for the use of these specific powers, not the agency’s powers more broadly, I urge noble Lords to support my amendment and strike this from the Bill.
5 pm