Clause 36 - Extraction of information from electronic devices: investigations of crime etc

Police, Crime, Sentencing and Courts Bill – in a Public Bill Committee at 2:00 pm on 27th May 2021.

Alert me about debates like this

Amendment proposed (this day): 94, in clause 36, page 29, line 5, at end insert—

“(c) the user who has given agreement under subsection (1)(b) was offered free independent legal advice on issues relating to their human rights before that agreement was given.”—

This amendment would ensure that users of electronic devices were offered free independent legal advice before information on their device could be accessed.

Question again proposed, That the amendment be made.

Photo of Steve McCabe Steve McCabe Labour, Birmingham, Selly Oak

I remind the Committee that with this we are discussing the following:

Clause stand part.

Government amendment 63.

Clause 37 stand part.

Clauses 38 to 42 stand part.

Amendment 115, in schedule 3, page 198, line 29, leave out

“A person appointed as an immigration officer under paragraph 1 of Schedule 2 to the Immigration Act 1971.”

This amendment would remove immigration officers from the list of authorised persons who may carry out a digital extraction.

That schedule 3 be the Third schedule to the Bill.

New clause 49—Extraction of information from electronic devices—

“(1) Subject to Conditions A to D below, insofar as applicable, an authorised person may extract information stored on an electronic device from that device if—

(a) a user of the device has voluntarily provided the device to an authorised person, and

(b) that user has agreed to the extraction of specified information from the device by an authorised person.

(2) Condition A for the exercise of the power in subsection (1) is that it may be exercised only for the purposes of—

(a) preventing, detecting, investigating or prosecuting an offence,

(b) helping to locate a missing person, or

(c) protecting a child or an at-risk adult from neglect or physical, mental or emotional harm.

(3) For the purposes of subsection (2) an adult is an at-risk adult if the authorised person reasonably believes that the adult—

(a) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(b) is unable to protect themselves against the neglect or harm or the risk of it.

(4) Condition B for the exercise of the power in subsection (1) is that the power may only be exercised if—

(a) the authorised person reasonably believes that information stored on the electronic device is relevant to a purpose within subsection (2) for which the authorised person may exercise the power, and

(b) the authorised person is satisfied that exercise of the power is strictly necessary and proportionate to achieve that purpose.

(5) For the purposes of subsection (4)(a), information is relevant for the purposes within subsection (2)(a) in circumstances where the information is relevant to a reasonable line of enquiry.

(6) Condition C as set out in subsection (7) applies if the authorised person thinks that, in exercising the power, there is a risk of obtaining information other than information necessary for a purpose within subsection (2) for which the authorised person may exercise the power.

(7) Condition C is that the authorised person must, to be satisfied that the exercise of the power in the circumstances set out in subsection (6) is strictly necessary and proportionate, be satisfied that there are no other less intrusive means available of obtaining the information sought by the authorised person which avoid that risk.

(8) Condition D is that an authorised person must have regard to the code of practice for the time being in force under section [Code of practice] in accordance with section [Effect of code of practice] below.

(9) This section does not affect any power relating to the extraction or production of information, or any power to seize any item or obtain any information, conferred by or under an enactment.

(10) In this section and section [Application of section [Extraction of information from electronic devices] to children and adults without capacity]—

“adult” means a person aged 18 or over;

“authorised person” means a person specified in subsection (1) of section [Application of section [Extraction of information from electronic devices] to children and adults without capacity] (subject to subsection (2) of that section);

“child” means a person aged under 18;

“agreement” means that the user has confirmed explicitly and unambiguously in writing that they agree—

(a) to provide their device, and

(b) to the extraction of specified data from that device.

Such an explicit written confirmation can only constitute agreement for these purposes if, in accordance with the Code of Practice issued pursuant to section [Effect of code of practice], the user—

(i) has been provided with appropriate information and guidance about why the extraction is considered strictly necessary (including, where relevant, the identification of the reasonable line of enquiring relied upon);

(ii) has been provided with appropriate information as to (a) how the data will or will not be used in accordance with the authorized person’s legal obligations and (b) any potential consequences arising from their decision;

(iii) has confirmed their agreement in the absence of any inappropriate pressure or coercion;

“electronic device” means any device on which information is capable of being stored electronically and includes any component of such a device;

“enactment” includes—

(a) an Act of the Scottish Parliament,

(b) an Act or Measure of Senedd Cymru, and

(c) Northern Ireland legislation;

“information” includes moving or still images and sounds;

“offence” means an offence under the law of any part of the United Kingdom;

“user”, in relation to an electronic device, means a person who ordinarily uses the device.

(11) References in this section and sections [Application of section [Extraction of information from electronic devices] to children and adults without capacity] to the extraction of information include its reproduction in any form.

(12) This section is subject to sections [Application of section [Extraction of information from electronic devices] to children and adults without capacity] and [Application of section [Extraction of information from electronic devices] where user has died etc].”

New clause 50—Application of section [Extraction of information from electronic devices] to children and adults without capacity—

“(1) A child is not to be treated for the purposes of subsection (1) of section [Extraction of information from electronic devices] as being capable of—

(a) voluntarily providing an electronic device to an authorised person for those purposes, or

(b) agreeing for those purposes to the extraction of information from the device by an authorised person.

(2) If a child is a user of an electronic device, a person who is not a user of the device but is listed in subsection (3) may—

(a) voluntarily provide the device to an authorised person for the purposes of subsection (1) of section [Extraction of information from electronic devices], and

(b) agreement for those purposes to the extraction of information from the device by an authorised person.

(3) The persons mentioned in subsection (2) are—

(a) the child’s parent or guardian or, if the child is in the care of a relevant authority or voluntary organisation, a person representing that authority or organisation,

(b) a registered social worker, or

(c) if no person falling within paragraph (a) or (b) is available, any responsible person aged 18 or over other than an authorised person.

(4) The agreement of persons listed in subsection (3) further to subsection 2(b) should only be accepted where, if it is appropriate, the child has been consulted on whether such agreement should be provided and the authorised person is satisfied those views have been taken into account.

(5) An adult without capacity is not to be treated for the purposes of section [Extraction of information from electronic devices] as being capable of—

(a) voluntarily providing an electronic device to an authorised person for those purposes, or

(b) agreeing for those purposes to the extraction of information from the device by an authorised person.

(6) If a user of an electronic device is an adult without capacity, a person who is not a user of the device but is listed in subsection (7) may—

(a) voluntarily provide the device to an authorised person for the purposes of subsection (1) of section [Extraction of information from electronic devices], and

(b) agreement for those purposes to the extraction of information from the device by an authorised person.

(7) The persons mentioned in subsection (6) are—

(a) a parent or guardian of the adult without capacity,

(b) a registered social worker,

(c) a person who has a power of attorney in relation to the adult without capacity, or

(d) if no person falling within paragraph (a), (b) or (c) is available, any responsible person aged 18 other than an authorised person.

(8) The agreement of persons listed in subsection (7) further to subsection (6)(b) should only be accepted where, if it is appropriate, the adult without capacity has been consulted on whether such agreement should be provided and the authorised person is satisfied those views have been taken into account.

(9) Nothing in this section prevents any other user of an electronic device who is not a child or an adult without capacity from—

(a) voluntarily providing the device to an authorised person for the purposes of subsection (1) of section [Extraction of information from electronic devices], or

(b) agreeing for those purposes to the extraction of information from the device by an authorised person.

(10) In this section and section and [Application of section [Extraction of information from electronic devices] where user has died etc]—

“adult without capacity” means an adult who, by reason of any impairment of their physical or mental condition, is incapable of making decisions for the purposes of subsection (1) of section [Extraction of information from electronic devices];

“local authority”—

(a) in relation to England, means a county council, a district council for an area for which there is no county council, a London borough council or the Common Council of the City of London,

(b) in relation to Wales, means a county council or a county borough council, and

(c) in relation to Scotland, means a council constituted under section 2 of the Local Government etc (Scotland) Act 1994;

“registered social worker” means a person registered as a social worker in a register maintained by—

(a) Social Work England,

(b) the Care Council for Wales,

(c) the Scottish Social Services Council, or

(d) the Northern Ireland Social Care Council;

“relevant authority”—

(a) in relation to England and Wales and Scotland, means a local authority;

(b) in relation to Northern Ireland, means an authority within the meaning of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2));

“voluntary organisation”—

(a) in relation to England and Wales and Scotland, has the same meaning as in the Children Act 1989;

(b) in relation to Northern Ireland, has the same meaning as in the Children (Northern Ireland) Order 1995.

(11) Subsections (10) and (11) of section [Extraction of information from electronic devices] also contain definitions for the purposes of this section.”

New clause 51—Application of section [Extraction of information from electronic devices] where user has died etc—

“(1) If any of conditions A to C is met, an authorised person may exercise the power in subsection (1) of section [Extraction of information from electronic devices] to extract information stored on an electronic device from that device even though—

(a) the device has not been voluntarily provided to an authorised person by a user of the device, or

(b) no user of the device has agreed to the extraction of information from the device by an authorised person.

(2) Condition A is that—

(a) a person who was a user of the electronic device has died, and

(b) the person was a user of the device immediately before their death.

(3) Condition B is that—

(a) a user of the electronic device is a child or an adult without capacity, and

(b) an authorised person reasonably believes that the user’s life is at risk or there is a risk of serious harm to the user.

(4) Condition C is that—

(a) a person who was a user of the electronic device is missing,

(b) the person was a user of the device immediately before they went missing, and

(c) an authorised person reasonably believes that the person’s life is at risk or there is a risk of serious harm to the person.

(5) The exercise of the power in subsection (1) of section [Extraction of information from electronic devices] by virtue of this section is subject to subsections (2) to (8) of that section.

(6) Subsections (10) and (11) of section [Extraction of information from electronic devices] and subsection (9) of section [Application of section [Extraction of information from electronic devices] to children and adults without capacity] contain definitions for the purposes of this section.”

New clause 52—Code of practice—

“(1) The Secretary of State must prepare a code of practice containing guidance about the exercise of the power in subsection (1) of section [Extraction of information from electronic devices].

(2) In preparing the code, the Secretary of State must consult—

(a) the Information Commissioner,

(b) the Scottish Ministers,

(c) the Welsh Government,

(d) the Department of Justice in Northern Ireland,

(e) the Victims Commissioner,

(f) the Domestic Abuse Commissioner,

(g) any regional Victims Champion including the London Victims Commissioner,

(h) persons who appear to the Secretary of State to represent the interests of victims, witnesses and other individuals likely to be affected by the use of the power granted in subsection (1) of section [Extraction of information from electronic devices], and

(i) such other persons as the Secretary of State considers appropriate.

(3) After preparing the code, the Secretary of State must lay it before Parliament and publish it.

(4) The code is to be brought into force by regulations made by statutory instrument.

(5) The code must address, amongst other matters—

(a) the procedure by which an authorised person must obtain and record confirmation that a device has been provided voluntarily;

(b) the procedure by which an authorised person must obtain and record confirmation that agreement has been provided for the extraction of specified information, including the information which must be provided to the user about—

(i) how long the device will be retained;

(ii) what specific information is to be extracted from the device and why, including the identification of the reasonable line of enquiry to be pursued and the scope of information which will be extracted, reviewed and/or retained;

(iii) how the extracted information will be kept secure;

(iv) how the extracted information will or may be used in a criminal process;

(v) how they can be kept informed about who their information is to be shared with and the use of their information in the criminal process;

(vi) their right to refuse to agree to provide their device and/or to the proposed extraction in whole or in part and the potential consequences of that refusal; and

(vii) the circumstances in which a further extraction may be required, and what will happen to the information after the case has been considered;

(c) the different types of extraction processes available, and the parameters which should be considered in defining the scope of any proposed extraction from a user’s device;

(d) the circumstances in which the extraction of information should and should not be considered strictly necessary and proportionate;

(e) the considerations to be taken into account in determining whether there are less intrusive alternatives available to extraction for the purposes of subsection (7) of section [Extraction of information from electronic devices];

(f) the process by which the authorised person should identify and delete data which is not responsive to a reasonable line of enquiry and/or has been assessed as not relevant to the purposes for which the extraction was conducted; and

(g) the records which must be maintained documenting for each extraction or proposed extraction, including—

(i) the specific information to be extracted;

(ii) the reasonable lines of enquiry pursued;

(iii) the basis upon which the extraction is considered strictly necessary, including any alternatives considered and why they were not pursued;

(iv) confirmation that appropriate information was provided to the user and, if applicable, agreement obtained;

(v) the reasons why the user was not willing to agree to a proposed extraction.

(6) A statutory instrument containing regulations under subsection (4) is subject to annulment in pursuance of a resolution of either House of Parliament.

(7) After the code has come into force the Secretary of State may from time to time revise it.

(8) References in subsections (2) to (7) to the code include a revised code.”

New clause 53—Effect of code of practice—

“(1) An authorised person must in the exercise of the power granted under section [Extraction of information from electronic devices] have regard to the code of practice issued under section [Code of practice] in deciding whether to exercise, or in the exercise of that power.

(2) A failure on the part of any person to comply with any provision of a code of practice for the time being in force under section [Code of practice] shall not of itself render him liable to any criminal or civil proceedings.

(3) A code of practice in force at any time under section [Code of practice] shall be admissible in evidence in any criminal or civil proceedings.

(4) In all criminal and civil proceedings any code in force under section [Code of practice] shall be admissible in evidence; and if any provision of the code appears to the court or tribunal conducting the proceedings to be relevant to any question arising in the proceedings it shall be taken into account in determining that question

Photo of Victoria Atkins Victoria Atkins The Parliamentary Under-Secretary of State for the Home Department

As the Committee will remember, I gave a very quick example of circumstances in which it would be appropriate for the authorised person to use information extracted from a digital device: when a person is missing, it would be appropriate to do that rather than wait for a review of many hours of closed circuit television footage. I hope that has dealt with that part of new clause 49.

New clause 49 also incorporates a definition of “agreement”. In order for authorised persons to exercise the power to extract information from digital devices, device users other than children or adults without capacity must voluntarily hand over their device and agree to the extraction of information. Authorised persons must explicitly ask device users for their agreement. The code of practice will provide guidance on: how agreement is to be obtained by the authorised person; ensuring it is freely given; and how the device user is made of aware of their right to refuse. The code will set out the best practice that authorised persons should follow when obtaining agreement, such as providing a copy of the digital processing notice for the device user to read and sign.

The final change made by new clause 49 is that it would define an adult as a person aged 18 or over, rather than 16 or over, as set out in chapter 3 of part 2. I understand this was not raised by the Victims’ Commissioner, but we have listened, and have thought very carefully about the imposition of that age in the Bill. In setting the age at 16, we were keen to ensure that those aged 16 to 17 were given appropriate control over their personal devices. That is not dissimilar from the position in other legislation, such as the Mental Capacity Act 2005, which recognises the rights of young people aged 16 and 17. However, we note the concerns raised in the debate, and we will reflect on them.

Photo of Sarah Champion Sarah Champion Chair, International Development Committee, Chair, International Development Committee

May I say how grateful I am that the Minister is clearly in listening mode on this issue? The difference with the Mental Capacity Act 2005 is that it does not define 16 and 17-year-olds as adults. It is that particular word, not the inclusion of that age bracket, that we are concerned about.

Photo of Victoria Atkins Victoria Atkins The Parliamentary Under-Secretary of State for the Home Department

I thank the hon. Lady. As I say, we will reflect on the issue.

New clause 50 would provide that, where the user of a device was a child or adult without capacity, their views were sought and taken into account when someone else was making a decision on their behalf regarding the extraction of information from their device. We agree on the point about children. Indeed, clause 37(4) makes an equivalent provision, so we are not sure there is much between us on this point. We rely on clause 37(4) to ensure that the views of the child are taken into account.

We do not, however, agree that it is appropriate to include equivalent provision for adults without capacity. With such people, it is the capacity of the individual user that is relevant, and that is determined on the basis of a case-specific assessment. It is only if, as a result of that assessment, the person is deemed not capable of making the decisions that someone else is asked to make it. Authorised persons using that power will still have to comply with their existing responsibilities under the Mental Capacity Act 2005 and the associated code of practice or equivalent provisions in Scotland and Northern Ireland. We will, however, include guidance and direct authorised persons to the relevant statutory responsibilities in the code of practice.

New clause 52 seeks to expand the list of statutory consultees in respect of the code of practice to include the Victims’ Commissioner, the Domestic Abuse Commissioner and representatives of victims and witnesses, but clause 40 already places a duty on the Secretary of State to consult

“(a) the Information Commissioner,

(b) the Scottish Ministers,

(c) the Department of Justice in Northern Ireland, and

(d) such other persons as the Secretary of State considers appropriate.”

We believe this last line affords sufficient flexibility to capture those other persons listed in new clause 52. I can assure the Committee that we will work closely with the Victims’ and Domestic Abuse Commissioners, and other relevant groups, as we develop the code.

The new clause also lists matters to be addressed in the code of practice. We do not dispute the relevance of many of the matters listed in new clause 52(5), but putting such a list in the Bill is unnecessary. The code needs to be comprehensive and fit for purpose, and it will be prepared in consultation with interested parties and subject to parliamentary scrutiny.

Amendment 94 seeks to provide for independent legal advice for device users. Ensuring that victims are properly supported is a priority for this Government. The code of practice will make it clear that investigators should inform people about the use of the power, and ensure that they are fully aware of their rights. This information will include: why they are asking for agreement, what will happen to the individual’s device, what information will be extracted from the device, how long it may be retained for, and what will happen to any irrelevant material found on the device.

We are aware of the impact that requests for personal information can have on victims of sexual violence, and we believe that individuals should be supported in the process. We are fully committed to giving support to victims of crime, including access to independent sexual violence advisers, who we believe have a role in helping to explain the power to victims; as I have said, we are investing in 700 more of these posts this year.

We are exploring the findings of the sexual violence complainants’ advocate scheme, piloted in Northumbria, as part of the rape review, which will be published shortly. We do not think that chapter 3 of part 2 of this Bill is the right place to address this broader issue about the provision of legal advice to victims and witnesses, given the wider impact across the criminal justice system.

Amendment 115 to schedule 3 seeks to exclude immigration officers from the list of persons authorised to carry out a digital extraction. Immigration officers play a vital role in protecting vulnerable people, particularly those who may be victims of trafficking, and it is important that they are able to obtain information that may be vital in those and other investigations. The power in schedule 3 ensures that all authorities extract information in a consistent way, and put the needs and privacy of the user at the forefront of any request. Any person being asked to provide a device will be made aware of their rights, including their right to refuse.

The hon. Member for Rotherham asked about a parliamentary question that the Under-Secretary of State for the Home Department, the hon. Member for Croydon South, answered. I am told that mobile phones are seized under statutory powers where there is a reasonable belief that evidence of a criminal offence will be found. The subsequent examination of the device will be conducted in forensic conditions, and in such a way as to target only the relevant material. The handset will be retained for as long as is required to support any criminal proceedings before being returned to the owner.

Finally, there is also a Government amendment in this group: amendment 63, which ensures that the definition of the common council of the City of London is used consistently throughout the Bill. The City of London Corporation has both public and private functions, and it is therefore appropriate that public legislation applies to the corporation only in respect of its public functions. Government amendment 63 provides that the reference to the common council relates to

“its capacity as a local authority”,

which brings clause 37 into line with other provisions in the Bill referencing the common council.

To sum up, this is the first time that a clear and consistent approach to the extraction of information from digital devices with the device user’s agreement has been written into primary legislation. The provisions remove legal ambiguity around the practice and, for the first time, enshrine the protections and safeguards that authorised persons must adhere to when exercising that power. It is a significant step forward in driving a consistent approach across the Union for the law enforcement authorities that exercise these powers, and for victims and witnesses in the criminal justice system. Of course, there is more to do outside the Bill in a range of areas, but we are committed to working with victims and survivors and with charities and commissioners to ensure that when implemented, the provisions command the trust and confidence of victims and witnesses. Many of the issues raised in the new clauses can and will be addressed through the code of practice, so I hope that the hon. Member for Croydon Central will feel able to withdraw her amendments and support Government amendment 63 and clauses 36 to 42 standing part of the Bill.

Photo of Sarah Jones Sarah Jones Shadow Minister (Home Office)

We all agree on the problems here; we have suggested some solutions and the Minister has explained why she is not convinced. I think it would be hard for the Minister not to agree with quite a lot of what Vera Baird said when giving evidence. We will have to come back to some of those new clauses and decide how we vote at an another time.

Given what the Minister said on three points—first, that she would look at the age issue and the definition of an adult; secondly, that there would be a draft code of practice by Report, and that she would incorporate some of the measures we discussed into that; and thirdly, that the rape review will be published soon, and that in it, the Government are looking at work such as that done in Northumbria, and at police training—I am content not to push the amendment to a vote. I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 36 ordered to stand part of the Bill.