The Home Office have today announced a consultation on the UK’s legal communications data retention regime – a consultation which will impact the Investigatory Powers Act 2016.
This is hugely important, as once again it will change the laws which the Government use to access people’s communications data – the information which says who sent a message to who, at what time, what they said, and where they were when they sent it.
The consultation makes clear the plans the Home Office have drawn up to adhere to the European Court of Justice judgment last December in the case of Watson (and formerly Davis), when they challenged the Government on its access to our communications data. To remind yourself of that case and what the judgment said in detail check our blogs here and here.
As an overview, the judgment basically called for four key changes which would, we hoped, improve privacy of people’s data and online activity except in cases of the most serious crime:
- Judicial authorisation: The Court stated that “access to retained data should… be subject to a prior review carried out either by a court or by an independent administrative body”, as opposed to the regime whereby the police could internally sign off on requests for access to communications data.
- Serious crime requirement: The Court made it very clear throughout its judgment that “only the objective of fighting serious crime is capable of justifying such access to the retained data”.
- Notification: The ruling stated that where a national authority accesses retained communications data, they “must notify the persons affected… as soon as that notification is no longer liable to jeopardise the investigations being undertaken by those authorities.”
- General and indiscriminate retention: It was held by the Court that national legislation could not allow the “general and indiscriminate retention” of communications data.
So today we have found out what the Home Office is proposing to deal with these issues. Its solutions are:
- Notification, or the lack thereof, will not change. The Home Office believe that a “general requirement” to notify an individual that their data has been accessed “would unnecessarily inform criminals… of the investigative techniques that public authorities use”. They say they believe the UK regime “already provides for sufficient notification of individuals where appropriate”.
- A new definition and threshold of “serious crime” in relation to communications data retention and acquisition. The threshold in the Investigatory Powers Act required for interception of communications data defines serious crime as “conduct which an adult could reasonably be expected to be sentenced to three years or more in prison”. The Home Office have decided that the ‘new’ threshold for retention and acquisition of communications data will be the much lower threshold of all offences for which “an adult is capable of being sentenced to six months or more”, as well as: all offences involving violence, those which involve a large number of people “acting in pursuit of a common purpose”, “any offence which involves the sending of a communication or a breach of privacy”, or “any offence involving a significant financial gain”.
- They propose to establish a new body within the Investigatory Powers Commissioner’s Office called the Office for Communications Data Authorisations. This body will have the power to consider and authorise communications data requests, taking the power away from the police who could previously get them signed off internally.
- And finally they have made clear that they “do not consider the existing data retention regime [to be] ‘general and indiscriminate’” and that the current framework “is based on objective criteria”.
On the surface, the Home Office are acting as though they have dealt with the incompatibilities between the UK framework and the requirements of EU law raised by the Court’s judgment, but in reality it is conducting a sleight of hand with this response to the Watson judgment. The Home Office is attempting to minimise and evade the obligations set out in the Court’s judgment.
The recommendation that the ‘serious crime’ sentence threshold in relation to the retention and acquisition of communications data will be two and a half years less than the sentence threshold for interception of communications data (6 months vs 3 years), as well as including several widely defined groups of offences, effectively means that the new ‘threshold’ for retention and acquisition will cover many more people than the ‘serious crime’ threshold in relation to interception of communications. This low threshold would allow many more people to be vulnerable to having their communications data accessed and retained than those already subject to having their communications intercepted.
Combine that with their deliberate disregard to the requirement of notification, which was clearly required by the Court’s judgment, as well as the declaration that they do not believe the communications data retention regime is “general and indiscriminate”, again as clearly stated by the Court, and you can see that the attempts of the Court to improve the law and introduce safeguards have been roundly dismissed.
We will be referring to the above issues in our response to this consultation. If you have concerns about what the Home Office is proposing, you too can make your voice heard and respond to the consultation here.