Amendment 12 states that the
“Investigatory Powers Commissioner must include in his Annual Report a summary of those Operational Purposes”.
Those would likely be more limited than the full list, but it would help to have some broad understanding.
I must take a moment on new clause 3, given that it deals with such an important matter. In the ISC’s report, we recommended that class bulk personal dataset warrants be removed from the Bill on the basis that the potential intrusion into privacy was sufficient to require that each distinct dataset should require specific approval by Ministers. However, we then had further evidence—as has happened in the dialogue with the Government and the agencies—in particular from the Secret Intelligence Service, about the rationale for retaining class warrants in the Bill. In particular, the evidence highlighted the fact that many of these datasets covered the same information or type of information. In those circumstances, we considered that a class warrant would be appropriate, as the privacy considerations were identical.
However, were we to accept class warrants for bulk personal datasets, we would need safeguards to ensure that their use was limited. We therefore proposed three restrictions. The first relates to the most sensitive personal data, using the definitions in the Data Protection Act 1998, and would prohibit the retention of any dataset containing a significant quantity of data relating to a person’s race, political opinions, religious beliefs, trade union membership, physical or mental health, or sexual life. The second restriction relates to bulk personal datasets that are somehow novel or out of the ordinary. In those circumstances, we would not consider a class warrant to be appropriate, so subsection (1)(b) of new clause 3 is designed to ensure that such cases will be referred to the Secretary of State and the commissioners by way of a specific warrant.
Finally, we express concern that we should not end up with bulk personal dataset inflation and have suggested that bulk personal dataset warrants should be limited to 20 individual datasets. I emphasise to the House that that is a completely arbitrary figure in many ways. If the Government have an alternative approach, I am more than happy to listen. I accept that if we impose a limit of 20, it is possible that the Home Secretary might be asked to sign two identical bulk personal dataset warrants in one go, if they are expecting to pick up 40. However, it seems to me that there needs to be some numerical cap, above all to ensure that the Home Secretary or Foreign Secretary, depending on who it is, is aware of what is being collected.
I would emphasise that we have seen the entire list of bulk personal datasets and we have never been of the opinion that anything is being collected that is not legitimate, and some of it, I can tell the House, is pretty mundane as well. That said, it is right that the House should exercise some caution about the expansion of those datasets, because one can see that in some circumstances they could touch upon information that is regarded as highly sensitive.