On July 10, Theresa May, the Home Secretary made an oral statement in the House of Commons introducing “fast track legislation” – the Data Retention and Investigatory Powers Bill. The Bill, together with explanatory notes and related documents, can be found here.
The Home Secretary explained the importance of communications data and its interception, including by reference to “the threat context,” viz…
“the threat from terrorism – from overseas and from here in the UK – but also the threat from industrial, military and state espionage practised by other states and foreign businesses; the threat from organised criminal gangs; and the threat from all sorts of criminals whose work is made easier by cyber technology”
The Home Secretary justified the need for the Bill by reference to “two significant and urgent problems” relating to both communications and interception:
“First, the recent judgement by the European Court of Justice that calls into question the legal basis upon which we require communication service providers in the UK to retain communications data. And second, the increasingly pressing need to put beyond doubt the application of our laws on interception, so communication service providers have to comply with their legal obligations, irrespective of where they are based.”
The first “problem” is a reference to the European Court of Justice judgment of April 8, 2014 in Case C -293/12 Digital Rights Ireland and Case C-594/12 Seitlinger (see my previous posts on that here and here). The Home Secretary continued:
“[W]e must respond to the ruling by the European Court of Justice that the Data Retention Directive is invalid.
This directive was the legal basis upon which the governments of EU member states were required to compel communication service providers to retain certain communications data, …the ruling provides us with such a problem precisely because very strong data protection laws mean that, in the absence of a legal duty to retain specific data, companies must delete data that is not required beyond their strict business uses. This means, if we do not clarify the legal position, we risk losing access to all such communications data, and with it, the ability to protect the public and keep our country safe.
The ECJ ruling said that the Data Retention Directive does not contain the necessary safeguards in relation to access to the data. But it did not take into account the stringent controls and safeguards provided by domestic laws – and in particular the UK’s communications data access regime, which is governed primarily by the Regulation of Investigatory Powers Act 2000. RIPA was, and remains, designed to comply with the European Convention on Human Rights. It ensures that access to communications data can only take place where it is necessary and proportionate for a specific investigation. It therefore provides many of the safeguards that the European Court of Justice said were missing from the Data Retention Directive.
…Other countries, such as Ireland and Denmark, implemented the Data Retention Directive through primary legislation, which means that they have retained a clear legal basis for their data retention policies, unless a separate, successful legal challenge to their legislation is made.
The UK does not have that luxury, because here the Data Retention Directive was implemented through secondary legislation. While we are confident that our regulations remain in force, the Government must act now to remove any doubt about their legal basis and to give effect to the ECJ judgment. The legislation I am publishing today – and the draft regulations that accompany it – will not only do this, they will enhance the UK’s existing legal safeguards and in so doing it will address the criticisms of the European Court.
The House will understand that I want to be clear, as I said earlier, that this legislation will merely maintain the status quo… Without this legislation, we face the very prospect of losing access to this data overnight, with the consequence that police investigations will suddenly go dark and criminals will escape justice. We cannot allow this to happen.”
In relation to the second “problem” the Home Secretary stated,
“[T]here is growing uncertainty among communication service providers about our interception powers.
…[T]he communication service providers that serve the UK but are based overseas need legal clarity about what we can access.
…We need to make sure that major communication service providers cooperate with the UK’s security and intelligence and law enforcement agencies when they need access to suspects’ communications. Otherwise we would immediately see a major loss of the powers and capabilities that are used every day to counter the threats we face from terrorists and organised criminals.
The Bill I am publishing today will therefore put beyond doubt the fact that the existing legal framework, which requires companies to cooperate with UK law enforcement and intelligence agencies, also extends to companies that are based overseas but provide services to people here in the UK.”
She said that it was “crucial” for the Bill to have Royal Assent by the summer and added:
“[A]longside the legislation I am publishing today, the government will also introduce a package of measures to reassure the public that their rights to security and privacy are equally protected.
We will reduce the number of public authorities able to access communications data. We will publish an annual transparency report giving as much detail as possible – within obvious parameters – about the use of these sensitive powers. We will appoint a senior former diplomat to lead discussions with other governments to consider how we share data for law enforcement and intelligence purposes.
We will establish a Privacy and Civil Liberties Board, based on the US model….
And we will review the interception and communications data powers we need – as well as the way in which those powers and capabilities are regulated – in the full context of the threats we face.”
The timetable for its consideration is extremely tight – no more than a week according to a parliamentary briefing paper:
“The final Bill, with further accompanying documents, is to be published and given first reading on 14 July. All remaining Commons stages are set for 15 July. The Lords will consider it on the two following days and it will return to the Commons if necessary on 17 July for consideration of Lords amendments (if any).”
Stay tuned for further coverage and analysis.