Joint Select Committee recommendations for changes in the IP Bill

1. We are grateful that the Government has provided further information on the interpretation of communications data and content. We have not had an opportunity to seek views as to whether the definitions are now sufficiently clear. Parliament will need to look again at this issue when the Bill is introduced. We urge the Government to undertake further consultation with communications service providers, oversight bodies and others to ascertain whether the definitions are sufficiently clear to those who will have to use them. (Recommendation 1) (Paragraph 69)  
2. The definition of data in Clause 195 is unclear, unhelpful and recursive. The Government must provide a meaningful and comprehensible definition of data when the Bill is introduced. (Recommendation 2) (Paragraph 76)  
3. We recommend that Parliament should give further consideration to defining the purposes for which local authorities may be allowed to apply for communications data when the Bill is introduced. (Recommendation 3) (Paragraph 83)  
4. We believe that law enforcement should be able to apply for all types of communications data for the purposes of ‘saving life’. We recommend that the Home Office should undertake further consultation with law enforcement to determine whether it is necessary to amend Clause 46 (7)(g) to make this explicit on the face of the Bill. (Recommendation 4) (Paragraph 87)  
5. We recommend that the Government should publish in a Code of Practice alongside the Bill advice on how data controllers should seek to minimise the privacy risks of subject access requests for ICRs under the Data Protection Act 1998. (Recommendation 5) (Paragraph 107)   
6. While we recognise that ICRs could prove a desirable tool for law enforcement agencies, the Government must address the significant concerns outlined by our witnesses if their inclusion within the Bill is to command the necessary support. (Recommendation 6) (Paragraph 108)  
7. We recommend that the definition of Internet Connection Records should be made consistent throughout the Bill and that the Government should give consideration to defining terms such as ‘internet service’ and ‘internet communications service’. We recommend that more effort should be made to reflect not only the policy aims but also the practical realities of how the internet works on a technical level. (Recommendation 7) (Paragraph 122)  
8. We recommend that the Government should publish a full assessment of the differences between the ICR proposal and the Danish system alongside the Bill. (Recommendation 8) (Paragraph 147)  
9. We recommend that the purposes for which law enforcement may seek to access ICRs should be expanded to include information about websites that have been accessed that are not related to communications services nor contain illegal material, provided that this is necessary and proportionate for a specific investigation. (Recommendation 9) (Paragraph 155)  
10. We urge the Government to consider the suggestion to work with the Information Commissioner’s Office, the National Technical Assistance Centre and the Communications-Electronics Security Group at GHCQ, which has recognised expertise in this area, to draw up a set of standards for CSPs. (Recommendation 10) (Paragraph 175)  
11. As the communications data will be held for purposes that are not related to the CSP’s own business purposes, we agree that the Government should provide CSPs with whatever technical and financial support is necessary to safeguard the security of the retained data. While we do not agree that 100% cost recovery should be on the face of the Bill, we do recommend that CSPs should be able to appeal to the Technical Advisory Board on the issue of reasonable costs. (Recommendation 11) (Paragraph 196)  
12. Our view is that the Government should provide statutory guidance on the cost recovery models, and that particular consideration should be given to how the Government will support smaller providers served with data retention notices. (Recommendation 12) (Paragraph 197)  
13. We agree with the Government’s intention not to require CSPs to retain third party data. The Bill should be amended to make that clear, either by defining or removing the term “relevant communications data”. (Recommendation 13) (Paragraph 205)  
14. We recommend that the Government should clarify the types of data it expects CSPs to generate and in what quantities so that this information can be considered when the Bill is introduced. (Recommendation 14) (Paragraph 209)  
15. We understand the Government’s position for not allowing the fact that a data retention notice has been served to be referred to in public. We suggest that some forum or mechanism, perhaps through the Technical Advisory Board, is made available so that CSPs subject to such notices can share views on how best to comply with them. (Recommendation 15) (Paragraph 228)  
16. We agree with the intention of the Government’s policy to seek access to protected communications and data when required by a warrant, while not requiring encryption keys to be compromised or backdoors installed on to systems. The drafting of the Bill should be amended to make this clear. (Recommendation 16) (Paragraph 263)   
17. The Government still needs to make explicit on the face of the Bill that CSPs offering end-to-end encrypted communication or other un-decryptable communication services will not be expected to provide decrypted copies of those communications if it is not practicable for them to do so. We recommend that a draft Code of Practice should be published alongside the Bill for Parliament to consider. (Recommendation 17) (Paragraph 264)  
18. We recommend that the Government should produce a Code of Practice on Equipment Interference to cover the activities both of the security and intelligence agencies and of law enforcement. (Recommendation 18) (Paragraph 288)  
19. We recommend that the Government should produce more specific definitions of key terms in relation to EI to ensure greater confidence in the proportionality of such activities and that a revised Code of Practice is made available alongside the Bill. (Recommendation 19) (Paragraph 295)   
20. We acknowledge the importance of data protection in relation to EI activities. We recommend that the assessments undertaken by Judicial Commissioners when authorising warrants should give consideration to data protection issues. (Recommendation 20) (Paragraph 298)  
21. We further recommend that the Home Office should make clear in the explanatory notes to the Bill or in a Code of Practice how EI activities can be conducted within the constraints of data protection legislation. (Recommendation 21) (Paragraph 299)  
22. We agree that material acquired through targeted equipment interference warrants should be admissible in court, though we share the concerns of witnesses about the risks involved. We believe that law enforcement and the security and intelligence agencies will need detailed codes of practice and appropriate procedures to ensure that evidence is not inadvertently compromised. We urge the Government to consider how it will reconcile the understandable desire of law enforcement and the security and intelligence agencies to keep their techniques secret with the need for evidential use and disclosure regimes in legal proceedings. (Recommendation 22) (Paragraph 305)  
23. We recommend that the Government should publish a fuller justification for each of the bulk powers alongside the Bill. We further recommend that the examples of the value of the bulk powers provided should be assessed by an independent body, such as the Intelligence and Security Committee or the Interception of Communications Commissioner. (Recommendation 23) (Paragraph 319)  
24. We recognise that, given the global nature of the internet, the limitation of the bulk powers to “overseas-related” communications may make little difference in practice to the data that could be gathered under these powers. We recommend that the Government should explain the value of including this language in the Bill. (Recommendation 24) (Paragraph 323)  
25. We recommend that the Investigatory Powers Commissioner, within two years of appointment, should produce a report to Parliament considering the safeguards that exist and making recommendations for improvements if required. (Recommendation 25) (Paragraph 349)  
26. We recommend that applications for targeted and bulk EI warrants should include a detailed risk analysis of the possibilities of system damage and collateral intrusion and how such risks will be minimised. We also recommend that such warrants should detail how any damaged equipment will be returned to its previous state at the point that the authorisation or operational need ceases. (Recommendation 26) (Paragraph 372)  
27. We recommend that the Code of Practice on equipment interference should set out how individuals and companies should be engaged with when conducting authorised EI activities to make the process more transparent and foreseeable. (Recommendation 27) (Paragraph 374)  
28. We recommend that the Home Office should produce its case for bulk personal datasets (BPDs) when the Bill is published. (Recommendation 28) (Paragraph 390)  
29. We recommend that the Intelligence and Security Committee, in their analysis of BPDs, should assess the extent to which the concerns expressed by witnesses are justified. (Recommendation 29) (Paragraph 391)  
30. We believe that a draft Code of Practice on BPDs should be published when the Bill is introduced to provide greater clarity on the handling of BPDs, not least in relation to the provisions of the Data Protection Act 1998. To the greatest extent possible, the safeguards that appear in the Data Protection Act 1988 should also apply to personal data held by the security and intelligence agencies. (Recommendation 30) (Paragraph 407)
31. We also agree that existing powers for acquiring BPDs should be consolidated in this Bill and that any other powers for the security and intelligence agencies to acquire BPDs should be repealed. (Recommendation 31) (Paragraph 408)  
32. The Committee recommends that major modifications for targeted interception warrants, as defined in the draft Bill, should also be authorised by a Judicial Commissioner. (Recommendation 32) (Paragraph 439)  
33. The Committee recommends that this apparent oversight be addressed in the revised Bill. (Recommendation 33) (Paragraph 443)  
34. We recommend that the Home Office should further review its list of investigatory powers in other legislation to ensure that nothing else has been overlooked. (Recommendation 34) (Paragraph 444)  
35. We therefore recommend that the approach to targeted equipment interference warrants should be standardised and that all modifications should be subject to judicial authorisation. (Recommendation 35) (Paragraph 450)  
36. The Committee therefore recommends that the period in which urgent warrants must be reviewed by a Judicial Commissioner should be shortened significantly. We suggest that they must be reviewed within 24 hours of their signature by the Secretary of State (Recommendation 36) (Paragraph 457)  
37. The Committee recommends the inclusion of a definition of the word “urgent” for the purposes of authorising urgent warrants. (Recommendation 37) (Paragraph 460)  
38. The Committee recommends that the language of the Bill be amended so that targeted interception and targeted equipment interference warrants cannot be used as a way to issue thematic warrants concerning a very large number of people. (Recommendation 38) (Paragraph 468)  
39. The committee is satisfied that the proposed authorisation process for communications data is appropriate but recommends that extra protections for privileged and confidential communications should be applied in the same way as is proposed for journalists in Clause 61. (Recommendation 39) (Paragraph 474)  
40. The Committee recommends the removal of emergency procedures for communications data so that the Single Point of Contact process can never be bypassed. (Recommendation 40) (Paragraph 482)  
41. The Committee agrees with the recommendation of the DPRRC on modifications to the list of ranks and offices which must be held by a designated senior officer. We recommend that Clause 56(1) and Clause 57(4) should be amended accordingly. (Recommendation 41) (Paragraph 489)  
42. The Committee recommends that authorisations for bulk personal datasets should be required to be specific and provisions for class authorisations should be removed from the Bill. The provision relating to replacement datasets (Clause 154(6)) should also be removed. (Recommendation 42) (Paragraph 497)  
43. The Committee would like to see more safeguards for the sharing of intelligence with overseas agencies on the face of the Bill. These should address concerns about potential human rights violations in other countries that information can be shared with. (Recommendation 43) (Paragraph 511)  
44. The Committee also recommends that the Bill should make it illegal for UK bodies to ask overseas agencies to undertake intrusion which they have not been authorised to undertake themselves. (Recommendation 44) (Paragraph 512)  
45. We recommend that the Government should give more careful consideration to the consequences of enforcing extraterritoriality. The Government should re-double its efforts to implement Sir Nigel Sheinwald’s recommendations. (Recommendation 45) (Paragraph 518)
46. The Committee recommends that provision for the protection of Legal Professional Privilege (LPP) in relation to all categories of acquisition and interference addressed in the Bill should be included on the face of the Bill and not solely in a code of practice. The Government should consult with the Law Societies and others as regards how best this can be achieved. (Recommendation 46) (Paragraph 537)  
47. The Home Office should review its proposals in relation to LPP to ensure that they meet the requirements of Article 8 and relevant case law. (Recommendation 47) (Paragraph 538)  
48. The Committee recommends that the Home Office should reconsider the level of protection which the Bill affords to journalistic material and sources. This should be at least equivalent to the protection presently applicable under PACE and the Terrorism Act 2000. (Recommendation 48) (Paragraph 554)  
49. The Committee recommends that if Clause 61 remains in its present form the Bill should make it clear that RIPA and Clause 61 do not act so as to enable the investigatory authorities to avoid the application of PACE or the Terrorism Act and the ability they afford to media to know about an application for communications data and make representations as to the proposed acquisition. (Recommendation 49) (Paragraph 555)  
50. The Home Office should review Clause 61 to ensure that it meets the requirements of Article 10 ECHR. (Recommendation 50) (Paragraph 556)  
51. We recommend that such a Commission [with a legal mandate] should become the oversight body in the Bill. (Recommendation 51) (Paragraph 574)  
52. The Judicial Commissioners or Commission should have the power to instigate investigations on their or its own initiative. This is vital in order to ensure effective and independent oversight. The current provisions in the draft Bill on the powers of the Judicial Commissioners do not make it clear that they have this power. We recommend that a power to initiate investigations should appear on the face of the Bill. (Recommendation 52) (Paragraph 575)  
53. We recommend that the Lord Chief Justice should have the power to appoint Judicial Commissioners following consultation with his judicial counterparts in Scotland and Northern Ireland and with the Prime Minister, Scottish Ministers, and the First Minister and deputy First Minister in Northern Ireland. This will ensure public confidence in the independence and impartiality of the Judicial Commissioners. It will also enhance political confidence in them. The Lord Chief Justice will also be able to assess the impact of appointments on the work of the High Court and the Court of Appeal, which must not be impaired by the creation of the Judicial Commissioners. The Judicial Appointments Commission must also be consulted to ensure that the appointments procedure is fair and transparent. (Recommendation 53) (Paragraph 588)  
54. The Government should reconsider both the length of terms of appointment and whether they should be renewable. Terms need to be long enough for Judicial Commissioners to build expertise but should not be so long that they have a negative impact on a serving judge’s career. It may be that three-year terms with an option for renewal is the most workable solution but we recommend that there should be careful reconsideration of these provisions in consultation with the Lord Chief Justice, Judicial Appointments Commission, the current surveillance Commissioners and other interested parties to ensure the benefits and disadvantages of the different approaches have been thoroughly examined. (Recommendation 54) (Paragraph 593)  
55. Maintaining public confidence in the Judicial Commissioners may occasionally require that a Commissioner is removed from the role because he or she has behaved in a manner incompatible with what is, in effect, high judicial office. Public confidence also requires that the power to remove from office does not damage the public perception of the Judicial Commissioners’ independence from the executive or the freedom of the Judicial Commissioners to make decisions that may be unpopular with the Government. We believe that the broad powers of dismissal contained in the draft Bill significantly impair the independence of the Judicial Commissioners. We therefore recommend that the Judicial Commissioners be subject to the same dismissal and suspension procedures as those applicable to serving senior judges: removal from office following a resolution of both Houses of Parliament and suspension and other disciplinary measures exercised by the Lord Chief Justice and Lord Chancellor. (Recommendation 55) (Paragraph 597)  
56. We believe it is inappropriate for the Home Secretary alone to determine the budget of the public body which is monitoring her exercise of surveillance powers. The Government may want to consider a role for Parliament in determining the budget. (Recommendation 56) (Paragraph 604)  
57. Clause 171 changes the existing powers of the relevant commissioners to report errors in the use of surveillance powers to the individuals affected by raising the applicable test and requiring the involvement of the Investigatory Powers Tribunal in making the decision. This approach is cumbersome and unnecessary given there are no concerns over the way the current oversight bodies have used their powers of error-reporting. We recommend that the Investigatory Powers Commissioner exercise the error-reporting power alone, without reference to the Investigatory Powers Tribunal. (Recommendation 57) (Paragraph 621)  
58. We recommend that the Government should review the error-reporting threshold in light of the points made by witnesses. (Recommendation 58) (Paragraph 622)  
59. It should be made clear in the duties laid on the Judicial Commissioners in subclauses 169(5) and (6) that they must comply with those duties in a proportionate manner. The subclauses are drafted in very broad and uncertain terms which have the potential to impact upon the work of Judicial Commissioners in unintended ways. Public confidence in the independence of the Judicial Commissioners requires clarity and transparency in both powers and duties. We recommend that Clauses 169(5) and (6) should be re-drafted to protect the Judicial Commissioners’ independence and to ensure the Judicial Commissioners are not constrained from providing effective oversight. (Recommendation 59) (Paragraph 626)   
60. We recommend that the Bill should contain an explicit provision for Communication Service Providers and staff in public authorities to refer directly to the Judicial Commissioners any complaint or concern they may have with the use of the powers under the Bill or any request for clarification on the use of those powers. Where clarification is provided the Judicial Commissioners will need to have the power to make that information public should it be appropriate in the circumstances. This will enable better compliance with the provisions of the Bill and will help to reduce costs. (Recommendation 60) (Paragraph 629)  
61. We recommend that members of the security and intelligence agencies should be able to contact the Investigatory Powers Commissioner with concerns over the misuse of surveillance powers without being at risk of prosecution for breaching the Official Secrets Act. The Investigatory Powers Commissioner should then have discretion whether to exercise his or her power to initiate an inquiry into the allegations. We recognise that there may be wider concerns over the role of whistle- blowers in this area. This is a matter which requires consultation and therefore this is not the appropriate Bill in which those wider concerns should be taken forward. (Recommendation 61) (Paragraph 630)  
62. The law in this area is complex and developing. Judicial Commissioners will have to make decisions without the benefit of adversarial argument. We agree with the Independent Reviewer of Terrorism that Judicial Commissioners must have access to both in-house legal expertise and, on request, security-cleared independent counsel to assist them in both the authorisation and oversight functions of their role. (Recommendation 62) (Paragraph 634)  
63. We recommend that the Judicial Commissioners should have a legal mandate to access all relevant technical systems required to ensure effective oversight of the powers contained in the Bill. This mandate should appear on the face of the Bill. (Recommendation 63) (Paragraph 637)
64. We recommend that the Judicial Commissioners should have access to technical expertise to assist them in fulfilling their authorisation and oversight functions. (Recommendation 64) (Paragraph 638)  
65. The Judicial Commissioners should be able to communicate with the Investigatory Powers Tribunal on a point of law without consulting the Home Secretary. Clause 172(3) should be redrafted to reflect this. (Recommendation 65) (Paragraph 640)   
66. The Judicial Commissioners should be able to make a direct reference to the Investigatory Powers Tribunal where they have identified unlawful conduct following an inspection, audit, investigation or complaint. (Recommendation 66) (Paragraph 642)  
67. The Investigatory Powers Commissioner’s annual report must include information about the impact, results and extent of the use of powers in the Bill so effective public and parliamentary scrutiny of the results of the powers can take place. (Recommendation 67) (Paragraph 646)  
68. The Investigatory Powers Commissioner should be able to inform the Intelligence and Security Committee if he or she is unhappy about the use of the Prime Minister’s power to redact his annual report. (Recommendation 68) (Paragraph 647)  
69. We recommend that the Judicial Commissioners should have the power to develop guidance to public authorities to assist them in applications seeking to use investigatory powers. This will help applicant bodies to formulate focused applications saving time and resources. Where the constraints of national security allow, the guidance should be published in the interests of public transparency and foreseeability. (Recommendation 69) (Paragraph 649)  
70. We recommend that the right of appeal from the Investigatory Powers Tribunal in Clause 181 should be amended to include cases where there has been an error of law to prevent injustice as a matter of public policy and to satisfy the rule of law. (Recommendation 70) (Paragraph 654)  
71. We recommend that rulings in the Investigatory Powers Tribunal should be subject to an interim right of appeal on the grounds of an error of law to save time and costs. (Recommendation 71) (Paragraph 655)  
72. We recommend that the appeal route for Scotland and Northern Ireland should appear on the face of the Bill. It is unclear to us why there is not a specified route of appeal in Scotland and Northern Ireland nor what appellants in those parts of the United Kingdom are expected to do before the Home Secretary issues regulations on this issue. (Recommendation 72) (Paragraph 656)  
73. The Home Office should conduct a consultation and review of the powers and procedures of the Investigatory Powers Tribunal with the aim of improving openness, transparency and access to justice. (Recommendation 73) (Paragraph 660)  
74. The Investigatory Powers Tribunal should have the power to decide whether its proceedings should be held in public. When making a decision on whether a hearing or part of a hearing should be open or not the Tribunal should apply a public interest test. (Recommendation 74) (Paragraph 663)  
75. The Investigatory Powers Tribunal should be able to make a declaration of incompatibility under the Human Rights Act. (Recommendation 75) (Paragraph 666)  
76. We have heard evidence that there is potential for the further simplification of the oversight landscape. This would improve transparency, reduce overlaps and ensure consistency of decision-making which would all contribute to ensuring oversight of the powers contained in the Bill comply with international law standards. We recommend that the Home Office should carry out a review to identify areas in which further simplification of oversight could occur. (Recommendation 76) (Paragraph 670)  
77. We call on the Government to outline its plans for the establishment of the Privacy and Civil Liberties Board. (Recommendation 77) (Paragraph 671)  
78. The Committee recommends that the Government keeps the issue of the inadmissibility of intercept material as evidence under review and takes note of the significant perceived benefits of using such material as evidence. (Recommendation 78) (Paragraph 675)  
79. The Committee recommends that the Government should consider the Chief Coroner’s proposals and engages further with him to come to a satisfactory agreement about which judges can be included in the list in Schedule 3. (Recommendation 79) (Paragraph 679)  
80. We agree with this conclusion of the DPRRC on the power in Clause 201 (2) to make consequential provision and recommend the deletion of powers to amend future enactments. (Recommendation 80) (Paragraph 682)  
81. We agree with the DPRRC that the negative procedure for these powers is inappropriate and recommend that any modifications to primary legislation be subject to the super-affirmative resolution procedure. (Recommendation 81) (Paragraph 684)  
82. The Committee recommends that the Bill should include a definition of national security in order to provide clarity to the circumstances in which these warrants can be issued. (Recommendation 82) (Paragraph 691)  
83. The Committee recommends that the Bill should include a definition of economic well-being in order to provide clarity to the circumstances in which these warrants can be issued. (Recommendation 83) (Paragraph 696)  
84. The Codes of Practice will provide essential further details on how the powers in the draft Bill will be used in practice We recommend that all of them should be published when the Bill itself is introduced to allow both Houses to conduct full scrutiny of their contents. (Recommendation 84) (Paragraph 698)  
85. We urge the Investigatory Powers Commissioner to scrutinise the automated analysis of bulk datasets conducted by the security and intelligence agencies to ensure that they are conducted appropriately and proportionately and with regard to privacy and data protection requirements. (Recommendation 85) (Paragraph 703)   
86. We recommend that a provision should be added to the face of the Bill for post- legislative scrutiny by a committee of the two Houses within six months of the end of the fifth year after the Bill is enacted. (Recommendation 86) (Paragraph 710)