The Coming UK Surveillance Debate: Communications Data Acquisition

One of a series of posts on the forthcoming Investigatory Powers Bill

Previous: Communications Data Retention, Part 4

Next: Future-proofing 

The boundary between communications data and content is likely to be revisited. 

One area where the government might look at the possibility of reining back powers is a reduction in the number of public authorities who are able to access communications data and for what purposes.  That is in any event likely to be affected by the restriction on purposes for which mandatorily retained data may be accessed following the DRIPA judicial review judgment (subject to any appeal).

Professional and journalistic privilege should be addressed more robustly than by the current Code of Practice guidance, with at least the promised implementation of the Interception Commissioner’s recommendation for the introduction of judicial authorisation for demands aimed at identifying journalists’ sources. The DRIPA judicial review judgment may result in a broader requirement for judicial or other independent authorisation in any event, at least for mandatorily retained data.

There is room for more stringent constraints on the quantities of data covered by a single authorisation or notice. At the moment a notice could cover communications made from an e-mail address over an hour or two or over a year or more.  There are no limits other than the duty on those involved to satisfy themselves of the proportionality of the demand. Thus the Acquisition of Communications Data Code of Practice states:

“3.54. Designated persons should specify the shortest possible period of time for any authorisation or notice. To do otherwise would impact on the proportionality of the authorisation or notice and impose an unnecessary burden upon the relevant CSP(s).”

Some selected recommendations from many in the Anderson report (which was published before the judgment in the DRIPA judicial review):

Anderson

Public authorities with relevant criminal enforcement powers should in principle be able to acquire communications data. It should not be assumed that the public interest is served by reducing the number of bodies with such powers, unless there are bodies which have no use for them. There should be a mechanism for removing public authorities (or categories of public authorities) which no longer need the powers, and for adding those which need them. (Recommendation 50) The requirement in RIPA 2000 ss23A-B of judicial approval by a magistrate or sheriff for local authority requests for communications data should be abandoned. Approvals should be granted, after consultation with NAFN, by a DP of appropriate seniority within the requesting public authority. (Recommendation 66) In recognition of the capacity of modern communications data to produce insights of a highly personal nature, where a novel or contentious request for communications data is made, the DP should refer the matter to ISIC for a Judicial Commissioner to decide whether to authorise the request. (Recommendation 70)