- Committee (1st Day)
- Scottish Legislative Consent sought.
- 3:23 pm
- Clause 1 agreed.
- Clause 2: Low or no reasonable expectation of privacy
- Amendment 1
- 1: Clause 2, page 3, leave out lines 24 to 27 and insert— “(b) the extent to which information contained within the personal data has been made public as a result of steps deliberately taken by the data subject;”Member’s explanatory statement This amendment would ensure the definition of a low privacy bulk personal dataset is in line with the definition set out in Schedule 10 of the Data Protection Act 2018.
- My Lords, before I get to the specifics of my Amendment 1, I will make some general remarks. I thank the Minister and all his officials for their very helpful briefing and the collaborative way in which they have approached the Bill. As he knows, we support the Bill, but we will seek clarification and further information about a number of clauses and the details in them.It is important for me to say that this is the Committee stage, so some significant details will be explored that will be helpful to us. Indeed, on my own part, there may be one or two misunderstandings as to the actual meaning of certain parts of the Bill. None the less, it is an important Bill and an important step forward for our country and its security; I think we all want to see it be as successful as it can be.This group of amendments deals with bulk personal datasets. These include personal data where a large majority of people included will not necessarily be relevant to an intelligence investigation. Currently, all BPD warrants must go through a double-lock process of approval via the Secretary of State and then a judicial commissioner, and must be renewed every six months. Agency heads must also perform certain functions associated with the warrant.As the importance of data-based intelligence grows, the Bill rightly includes several measures to make it easier and quicker to analyse various datasets. Individual BPDs considered to have a low or no expectation of privacy could be approved by intelligence agency heads if urgent or if they fall into a category approved by a judicial commissioner. For urgent cases, judicial commissioners have three days to review the warrant.BPD warrants will need to be renewed only after 12 months, instead of six, which seems sensible. Some functions can be delegated from heads of agencies to an official while maintaining overall responsibility. The Bill also ensures that third-party BPDs—mostly commercially held data—are regulated similarly to other BPDs. The double lock of the Secretary of State and the judicial commissioner would remain for all BPDs, apart from ones considered urgent by the Secretary of State. For urgent cases, a judicial commissioner would have three days to review the warrant. Again, much of that is very sensible and improves the current situation.
- 3:30 pm
- My Amendment 16 seeks to ensure that the Intelligence and Security Committee is involved in the overall oversight of what is happening. The Government included in new Section 226DA in Clause 2 an annual report, so they have accepted the idea, which my amendment lays out, of having an annual report. But noble Lords will see that my amendment, rather than having the report going just to the Secretary of State as the Government propose in new Section 226DA, seeks to understand why the Government would not want such a report to go to the Intelligence and Security Committee as well. Indeed, my noble friend Lord West has put a similar amendment exploring the same point. It would be useful for the Committee to understand why the Government have excluded the Intelligence and Security Committee from such oversight.
- The Minister will know that I was exercised by the role of the Intelligence and Security Committee with respect to the National Security Act during its passage. Again, it is important to understand what role the Government feel the Intelligence and Security Committee has with respect to the changes and amendments included in this Bill. Therefore, at this stage, my Amendment 16 simply probes that. It is a probing amendment; I just want to understand what the Government’s view of the Intelligence and Security Committee should be and how they have come to a view, in new Section 226DA in Clause 2, that they feel an annual report is important but that it will go only to the Secretary of State and not to the Intelligence and Security Committee. It seems a bit strange.
- Again, because it is important for the Committee to understand what the Government’s definition of serious crime is, noble Lords will see that my Amendment 17 to Clause 5 would use the definition of serious crime as in Section 263 of the Investigatory Powers Act 2016. It is just to ensure that we understand the definition of serious crime that we are using in the Bill vis-à-vis the earlier Act. My understanding is that in Section 263 of the Investigatory Powers Act 2016, serious crime is defined as
- “an offence for which a person who has reached the age of 18”
- in England and Wales, or 21 in Scotland or Northern Ireland,
- “and has no previous convictions could reasonably be expected to be sentenced to imprisonment for a term of 3 years or more”,
- or if various other conduct such as violence is included. Can the Minister confirm that that is the definition to be used? While he does that, can he just underline whether there is any problem with the difference in age in Section 263—18 in England and Wales, and 21 in Scotland and Northern Ireland—with respect to this? For my own clarity—I apologise to noble Lords if it is obvious to everybody else—how does this Act apply to children under 18 and what are the consequences with respect to that for the changes there?
- I have some other specific questions for the Minister. How does the Bill ensure that the sensitivity of information is central to whether a dataset is used, not just whether it has been made public? How does the Bill ensure—within it, not necessarily in guidance—that sensitive information such as facial images and medical information is correctly identified as sensitive information that should go through the double lock? Frankly, there are some questions to be asked about what the access should be to that anyway.