Clause 12 - Offence of unlawfully obtaining communications data

Investigatory Powers (Amendment) Bill [Lords] – in a Public Bill Committee am 2:00 pm ar 7 Mawrth 2024.

Danfonwch hysbysiad imi am ddadleuon fel hyn

Photo of Stuart McDonald Stuart McDonald Scottish National Party, Cumbernauld, Kilsyth and Kirkintilloch East 2:00, 7 Mawrth 2024

I beg to move amendment 39, clause 12, page 33, leave out lines 16 and 17.

This amendment would remove one of the examples cases where a relevant person has lawful authority to obtain communications data from a telecommunications operator or postal operator, being where the data has been “published”.

Photo of Judith Cummins Judith Cummins Llafur, Bradford South

With this it will be convenient to discuss the following:

Clause stand part.

Clauses 13 and 14 stand part.

The schedule.

Photo of Stuart McDonald Stuart McDonald Scottish National Party, Cumbernauld, Kilsyth and Kirkintilloch East

The clause relates to section 11 of the Investigatory Powers Act 2016, which created an offence where a relevant public authority knowingly or recklessly obtained communications data from a telecoms or postal operator without lawful authority. That is an extra protection against unlawful invasions of privacy by public authorities. Comms data can of course be vital to prevent serious crime or to assist in missing persons investigations, but it can also be seriously invasive if not monitored, as such data can reveal all sorts of details about our lives and the people that we are linked with. The clause makes changes to that offence.

It is said that there is a lack of clarity around the concept of lawful authority, so the clause includes some examples of what lawful authority is. Most are uncontroversial—for example, where there is a statutory basis for gathering the data, where there is a relevant court order or an authorisation, or where it is obtained to respond to a call to the emergency services. However, we contest the assertion that new subsection (3A)(e) is a proper example of lawful authority, referring to:

“where the communications data had been published before the relevant person obtained it”.

We are concerned that that is not a correct expression of the law as it stands.

The simple fact of data being published is not in and of itself lawful authority for it to be obtained and subject to surveillance. The fact that I publish a Facebook post at such and such a time in such and such a place does not give public authorities the right to seek it from Facebook. In fact, on a Zoom meeting about a controversial political campaign, it cannot be the case that Zoom can then be ordered by the police to obtain the relevant communications data simply because the data was published and available to those who attended the meeting.

We need a very careful explanation from the Minister about what precisely is intended by the example in paragraph (e) because as drafted—again, it depends on how we interpret these things—it seems to be open to an interpretation that anything even semi-publicly available can be obtained by public authorities without anything more.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I will speak more widely to clause 12 before addressing the amendment. The clause does not create new routes to obtain communications data outside the Investigatory Powers Act. Rather, it provides examples of existing routes to acquire communications data in order to put the existing position, as set out in the communications data code of practice, on to a statutory footing. This will provide clarity that acquiring communications data in this way will amount to lawful authority for the purposes of the offence in section 11 of the IPA. It makes it clear that sharing of communications data between public bodies is lawful. It is not the intention of section 11 to discourage public sector sharing of data when administering public services for purposes such as fraud prevention. Clause 12 puts that beyond doubt.

While discussing clause 12, I will take the opportunity to set out that a communications data authorisation can amount to lawful authority to require a telecommunications operator to carry out any necessary activity on their systems to enable or facilitate the obtaining of the relevant communications data. The list of examples of what will amount to lawful authority in clause 12 will provide additional clarity to the existing drafting of section 60A(5) in the Investigatory Powers Act, which sets out what can be authorised under part 3 for the purposes of acquiring communications data.

I would also like to address an inconsistency with paragraph 176 of the explanatory notes for the 2016 Act and the conduct that the Act permits. To be clear, a communications data authorisation may authorise interference with equipment by a person where that is done to enable or facilitate the acquisition of communications data for the purposes of identifying an entity as well as information about their previous or current location.

The Government do not support amendment 39, moved by the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East. Additional authority for published material should not be required for its disclosure by a telecommunications operator to a public authority when that data has been disclosed with the consent of that operator. The consent of the operator provides the lawful authority for the obtaining of the previously published communications data, which public authorities can rely on. It places the existing position, set out in paragraph 15.11 of the communications data code of practice, on a primary legislative footing. It does not create new acquisition routes.

Clause 13 amends the definition of communications data to include subscriber and account data, ensuring that this communications data is available to investigators with an IPA part 3, even if it is transmitted as the content of the message. That is not a broadening of the definition but a clarification of scope. “Subscriber data”, or “account data”, includes the details provided when someone completes an online registration form for a telecommunications service or system. This change overcomes the current uncertainty for investigators about the data types that will be “communications data” and therefore available to them.

Clause 14 restores the general information gathering powers to regulatory or supervisory bodies, which were repealed by section 12 of the 2016 Act. It will ensure that public authorities will be able to utilise their own pre-existing statutory powers to acquire communications data for civil purposes. These are existing statutory powers that have been conferred on public authorities by Parliament—for example, in the regulation of the financial markets to ensure market stability.

Since 2016, the data sought has increasingly moved online and is now being caught by the definition of “communications data” in the 2016 Act. For example, His Majesty’s Treasury is responsible for the civil enforcement of financial sanctions regulations. Some information that is essential in carrying out its civil enforcement functions, such as the timestamp of an online banking transaction, is now communications data, and His Majesty’s Treasury cannot currently use its powers to compel that information to be provided by a telecommunications operator. Communications data is available under the IPA only if the matter under investigation is a serious crime, and so is out of reach for public authorities exercising civil enforcement functions.

Photo of Stuart McDonald Stuart McDonald Scottish National Party, Cumbernauld, Kilsyth and Kirkintilloch East

I thank the Minister for his response and his explanation. We will of course take that away and give it consideration again. He has referred to codes of practice being put into statute, so we will go away and look at those codes of practice. Of course, codes of practice can sometimes be inconsistent with various laws as well, so this is not necessarily the end of the matter. It would be helpful if the Minister could perhaps—in writing, or perhaps we will have to revisit it on Report—look at the specific examples that I gave and just explain whether or not those amount to prior publications of comms data.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I am very happy to write to the hon. Gentleman.

Photo of Stuart McDonald Stuart McDonald Scottish National Party, Cumbernauld, Kilsyth and Kirkintilloch East

I very much appreciate that, and that will hopefully help to clear things up before we get to the next stage of proceedings. I will withdraw the amendment.

Photo of John Hayes John Hayes Ceidwadwyr, South Holland and The Deepings

Before you move to the vote, Mrs Cummins—forgive me for not rising with greater speed—I just wanted to test the Minister on clause 14 in particular. Clause 14 deals with the other public authorities that will enjoy the powers that the Bill affords. That was debated at length when the 2016 Act, which this Bill amends, was considered, and the Minister will recall that I also raised it on Second Reading.

It is of course true that a number of public bodies have lawful powers to intervene in a regulatory function where a malicious activity could have dire consequences. The Minister will have many examples to hand, but I will take just one for the purpose of illustrating my argument. The Environment Agency could intervene in the case of a watercourse that had been poisoned intentionally; that would be a criminal act resulting in an investigation and prosecution. One can imagine a circumstance where it would be necessary for that body to obtain communications data to discover how that occurred.

To be clear—the Minister will no doubt tell us—this is not the “what” being communicated, but the who, the when and the where. That is what we mean when we speak of the powers in the 2016 Act and this new Bill. We are not talking about the “what”; we know the telecommunications operator will be obliged to make available the content of communications data. The endeavour that the agency concerned will be involved in is finding out why something has happened. The “why” will of course be closely associated with the investigation and the possible subsequent prosecution.

We understand why the police and our intelligence and security agencies may well need these powers; they use them currently. One can see what the operational purpose of that would be, but in the case of some of these other bodies, I think the Minister needs to make a persuasive argument—I have given him one of them; no doubt he has others at his disposal—and he needs to make it clear who these bodies are. I raised this previously, and he committed to come back to us with a list of the kinds of bodies that might exercise these powers. The public, at least, will not necessarily understand why a wide range of bodies beyond the intelligence community and the police need the pretty intrusive powers that are conferred by the 2016 Act and the Bill.

When the 2016 Act was being passed, we were quite insistent on who had these powers and who did not, and what the constraints should be, in addition to the checks and balances—the oversight arrangements—that we have already talked about this morning. This Bill does change those, which is of some concern, because if we are going to prosecute this argument, as I think we all on this Committee want to do, in a persuasive way, we need to be aware of what the public reaction will be. The Minister will be acutely aware of that—he made that clear earlier.

My anxiety is that we should be very clear about what the limits are on the public bodies concerned, who those public bodies are, and in what circumstances they might exercise the powers that the Bill confers. It will be very much in the Government’s and the Minister’s interests to be very clear and certain about that as we make this case publicly. If I were to be for a moment—but only a moment—fanciful, it might well be that a member of the public will say, “Why should a local authority have similar powers to MI5?” I am not sure that it is quite like that, and I know the Minister will be able to reassure, through me, the wider public, but that is the kind of argument one can see possibly being presented in the media and elsewhere. I speak merely to test the Minister on this and ask him to let us know when he will make this list available—perhaps during the course of our consideration. I know that the Intelligence and Security Committee of Parliament has asked for this. Will the Minister fulfil the promise he gave without delay?

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security) 2:15, 7 Mawrth 2024

As always, my right hon. Friend asks a pertinent question. I hope he will forgive me for saying that I very much hope that the letter I asked to be sent arrived in his inbox this morning. He may not have seen it, which I completely understand, as there are many pressing issues on his time. I have also attached it into the packet for the Bill and indeed copied it to the ISC secretariat, which has done such an important job in ensuring that we are all as one on this. I hope very much that that will answer my right hon. Friend’s questions. If it does not, he knows where I am—I would be delighted to clarify it further. As my right hon. Friend has very kindly asked, I shall give that list now, for the record: HM Revenue and Customs, the Financial Conduct Authority, the Department for Work and Pensions, the Treasury, the National Crime Agency, the Department for Business and Trade, and the Competition and Markets Authority.

My right hon. Friend reminds me of that famous scene in “Yes, Prime Minister”—thank God defence is held at central authority, or we would not have to worry about the Russians; we would have a civil war in two weeks. His point about local authorities having intelligence powers is valid. They do not have the same intelligence powers as MI5—let us be absolutely clear about that. That is not what we are offering.

Photo of John Hayes John Hayes Ceidwadwyr, South Holland and The Deepings

It does the Minister great credit that he has made that list available during the course of our consideration. That is very important. What I had feared might happen was that we might not get it while we were in Committee. In fact, I have not actually seen it, but I am grateful to him for making it available, at least, during our consideration.

Photo of Kevan Jones Kevan Jones Llafur, North Durham

This is an area that concerns me. I am quite certain the security services have protocols on how to deal with such things, but it worries me that the DWP is on that list. Having been involved in work on the Horizon Post Office scandal for many years, I know the DWP did not cover itself in glory on some of those cases. Can the Minister reassure the Committee that there are protocols governing when and how it will use those powers? That, I think, would give the public some assurance that there is a standard for how they will be used.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

The right hon. Gentleman tempts me towards an area that the Bill does not cover, so I hope he will forgive me for focusing on what it does cover, such as the safeguards. Clause 14 will limit communications data acquisition to the purpose of a body required to meet its civil functions and duties, such as a regulatory body providing oversight of financial markets, or indeed the DWP overseeing different elements of its responsibilities. Where disclosure is in support of a criminal prosecution and IPA part 3 authorisations for communications data must continue to be sought, using the existing safeguards and oversight provided for by the Investigatory Powers Commissioner’s office, the courts will oversee the use of those powers by public authorities in the same way as the acquisition of non-communications data under the existing powers. He has asked me specifically about a connected area, so—I hope he will forgive me—I will have a look at it and write to him very specifically about that.

Photo of Kevan Jones Kevan Jones Llafur, North Durham

May I suggest that the Minister does write to the Committee? I accept the safeguards in place, but for organisations other than the security services, I want to know what internal mechanisms they have to ensure that use of those powers is proportionate in terms of investigations and so on, and what training and protocols they are using. If the Minister could write to us on that, that would be helpful.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

Forgive me, but the right hon. Gentleman is asking for a very large piece of work there. I am setting out the legal authority under which those organisations can act. Their internal processes may be different in different circumstances and be answerable to different Ministers.

Photo of Kevan Jones Kevan Jones Llafur, North Durham

I am sorry, but I do not agree with the Minister. He is giving those other public bodies additional powers, and I think it is quite reasonable for this Committee and the public to be assured of how those powers are actually going to be used. As I say, I have no problem with the security services, because I am well aware that they have very clear, strong protocols and safeguards governing the use of their powers internally, with authorisations and so on. I think he just needs to ask those other Departments how they are going to do this, and what the internal mechanisms are.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I am very happy to ask them; I am just stating clearly that they are not under the responsibility that I have as a Minister. The legal powers that they are given are not additional powers; they are repetitions of the IPA 2016, so they are not additional powers—[Interruption.] Forgive me, but they are not additional powers. Their existing codes of practice under the different organisations have their own responsibilities within them.

Photo of Kevan Jones Kevan Jones Llafur, North Durham

I beg to differ. In the next clause, we will come on to the breadth and depth of the new powers, but that is a different argument—I will save that until then. However, he is the Minister and, in my experience, the Minister leads the Bill. I would have thought it would be quite simple to ask those other Departments what those protocols are. If he does not ask, he does not get.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I will happily ask. The right hon. Gentleman is asking for internal management structures, though.

Photo of John Hayes John Hayes Ceidwadwyr, South Holland and The Deepings

I am grateful to the Minister for offering me a second bite of the cherry. Perhaps I can offer a Hegelian synthesis between him and the right hon. Member for North Durham. We talked earlier about operational purposes, but we have to be careful about that: in the case of the agents of the police, one cannot publish purposes in fine detail, because that would be unhelpful. However, in broad terms, perhaps the way forward on this is to illustrate the kind of purposes that the bodies the Minister described might employ, within the legal constraints that he just set out. Perhaps that is the way forward; it would certainly satisfy me, and I cannot think that would not help to satisfy the right hon. Member for North Durham, who is a reasonable man—not my right hon. Friend, but a right hon. Gentleman and a personal friend, which is better than being a right hon. Friend.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

As always, I welcome my right hon. Friend’s contribution. That is covered in many areas in the letter I wrote to him.

Photo of Dan Jarvis Dan Jarvis Shadow Minister (Home Office) (Security)

In an earlier response to comments by the right hon. Member for South Holland and The Deepings, the Minister helpfully mentioned the letter that I think has been sent to the right hon. Member and possibly other members of the Committee. Can the Minister confirm that that letter will also be sent to the Opposition?

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

To be absolutely clear, the letter was in response to my right hon. Friend the Member for South Holland and The Deepings, so it was sent to him, it was copied to the secretariat of the ISC and it is in the Bill pack. The hon. Member for Barnsley Central therefore has access to it.

Photo of Kevan Jones Kevan Jones Llafur, North Durham

May I ask the Minister to look at his internal process again? We also had this problem with the National Security Bill. I do not know whether he should change the pigeon post he is using to ensure people have it. May I also point out that the ISC is not constantly in session? Therefore, if he has to send it to the ISC, we do not automatically get it until our next meeting or when we do the next reading.

Photo of Thomas Tugendhat Thomas Tugendhat Minister of State (Home Office) (Security)

I am delighted to clarify that the letter was emailed to my right hon. Friend the Member for South Holland and The Deepings. He is a traditionalist in many ways, but I believe he has entered the electronic age.

Amendment, by leave, withdrawn.

Clause 12 ordered to stand part of the Bill.

Clauses 13 and 14 ordered to stand part of the Bill.

Schedule agreed to.