My Lords, the other place approved these draft regulations on
The regulations bring into force the draft communications data code of practice and amend the Investigatory Powers Act—IPA—to comply with a European Court of Justice ruling. The ruling requires that there must be independent authorisation for requests to access communications data and, in relation to crime, where the intrusion into private lives would be serious, the offence justifying that intrusion must also be serious. The High Court declared that the Act must be amended by
I will explain what these changes will mean in practice. To clarify, we are talking about communications data—information such as the name of someone subscribing to a mobile phone contract, the time a call was made or the number that was dialled—but not the content of any calls or messages. At the moment, a police officer investigating any crime can request any type of communications data to support their investigation if it is necessary and proportionate to do so. A request is sent to a designated senior officer who, having consulted a specialist in the use of communications data, decides whether or not to authorise the request.
The regulations introduce additional safeguards to the process. The police officer will no longer be able to request any type of communications data in the investigation of all crimes. Instead, the officer will be able to access only the more intrusive types of communications data—such as where the person was when making a call—in the investigation of serious crimes. Instead of the request being authorised internally, it will now be sent externally to an independent organisation overseen by a Court of Appeal judge. The staff of this independent organisation—the Office for Communications Data Authorisations, or OCDA—will assess the request and, weighing up all the factors relating to necessity, proportionality and seriousness, decide whether or not to authorise it. Only once this independent authorisation has taken place can the officer acquire the data.
There will be cases—such as a missing child, a terrorist attack or another threat to life—where communications data must be accessed more urgently than the new regime will allow. The regulations and code of practice, therefore, include provisions for such circumstances, allowing internal authorisation by a designated senior officer, but make it clear that such authorisations will expire after only three days— not 30 as with ordinary authorisations—and all urgent requests will be reviewed by the Investigatory Powers Commissioner’s office; that is, the OCDA. Your Lordships will see that these regulations are about strengthening safeguards, limiting the availability of communications data to public authorities and ensuring that when it is made available, that happens only after proper independent scrutiny.
When we debated the regulations in Grand Committee last week, the noble Lord, Lord Paddick, raised concerns that the definition of serious crime in the regulations does not abide by the ruling of the European Court of Justice that I have already mentioned. I strongly disagree. All offences that meet the serious crime definition, and pass the tests of necessity, proportionality and seriousness set out in the code of practice, will in fact be serious and warrant the use of communications data in their investigation.
A higher threshold would not allow public authorities to investigate such offences as harassment, stalking, sexual communication with a child, sending grossly offensive messages and contempt of court among others. The Government believe that these are serious and that communications data should be available in their investigation. They are certainly not viewed as trivial by the victims.
The European Court of Justice itself, in its recent ruling on a Spanish case, Ministerio Fiscal, made it clear that a higher level of intrusion into private lives in accessing different types of data must correlate with the seriousness of the offence being investigated. The more intrusive the data request, the more serious the offence must be. Legislation alone cannot give effect to this, and I ask noble Lords to see these measures as a package, with independent authorisation, a legislative threshold that sets clear limits, and the code of practice, which involves considerations of necessity, proportionality and seriousness. As a result, less intrusive data types will still be available when investigating all crime types, but the more intrusive communications data, such as location data, will be accessed only in the investigation of serious crime. Being able to intercept—bug—phones will continue to be available only for the investigation of offences meeting the higher seriousness threshold already in the Investigatory Powers Act.
We consider the regulations to be very much in the spirit of the European Court of Justice ruling. We already have strong safeguards and oversight in relation to our investigatory powers. If an individual believes that their communications data have been accessed unlawfully, they can make a complaint to the Investigatory Powers Tribunal, which is independent of government and consists of senior members of the legal profession. The regime as a whole is overseen by the Investigatory Powers Commissioner, a Court of Appeal judge independent of government. Moreover, the Act as a whole must be reviewed after five years, allowing us to consider whether any changes must be made.
The Government have carefully considered the European court’s decisions in this area and have proposed amendments in good faith, ensuring that this important investigative tool is available to the police for crimes whose impact on the victim is considerable. The regulations are about increasing, not reducing, safeguards. If they are not passed into law by