Police, Crime, Sentencing and Courts Act 2022 (Extraction of information from electronic devices) (Amendment of Schedule 3) Regulations 2023

Considered in Grand Committee

Moved by

That the Grand Committee do consider the Police, Crime, Sentencing and Courts Act 2022 (Extraction of information from electronic devices) (Amendment of Schedule 3) Regulations 2023.

My Lords, the extraction of information powers introduced in the Police, Crime, Sentencing and Courts Act 2022 have provided a statutory basis for police and other authorised persons to obtain information from electronic devices to support investigations.

These powers came into force last November, along with a code of practice that provides guidance to authorised persons to ensure that the powers are used appropriately and effectively. They can be exercised by the authorised persons named in Schedule 3 to the Act. This is divided into three parts, which set out the different purposes for which authorised persons may exercise the powers. It is crucial that authorised persons extract information only for the purposes set by the part of the schedule in which they are placed.

At present, the Royal Navy Police, the Royal Military Police and the Royal Air Force Police can extract information only for the purposes set out under Section 37 of the Act:

“preventing, detecting, investigating or prosecuting crime … helping to locate a missing person, or … protecting a child or an at-risk adult from neglect or physical, mental or emotional harm”.

These regulations will amend Schedule 3 so that the Royal Navy Police, the Royal Military Police and the Royal Air Force Police are moved from Part 2 to Part 1 of the schedule. This change will allow these police forces also to extract information from a deceased person’s electronic device, using the power in Section 41, for the purpose of an investigation or inquest into that person’s death.

Electronic devices such as mobile phones contain a wealth of personal information and can be helpful in an investigation when someone has died in unexplained circumstances. Although data protection regulations do not apply to deceased persons, we must still ensure that information extracted from an electronic device where the user of the device has died is handled appropriately and sensitively. Additionally, an electronic device such as a mobile phone or laptop is almost certain to contain information about living people, so the authorised person will still need to be satisfied that extracting such information is necessary and proportionate.

The powers under Section 41 of the Police, Crime, Sentencing and Courts Act 2022, much like the powers under Section 37 of the Act, can be exercised only where the authorised person reasonably believes that there is information on the device that is relevant to the purposes set out under this section—in this case for an investigation or inquest into a person’s death. It is vital that these intrusive powers are available only to the authorities that need them. When the Bill was passed, it was not yet agreed that the Royal Navy Police, the Royal Military Police and the Royal Air Force Police had sufficient investigative requirement to use Section 41 powers or that their investigative needs could not be met with other existing powers.

My Lords, this is a straightforward piece of secondary legislation, adding the Royal Military Police, the Royal Air Force Police and the Royal Navy Police to the list of people who can exercise extraction of information powers under Section 41 of the Police, Crime, Sentencing and Courts Act 2022.

First, I declare what may be a tangential interest: I have a son-in-law who flies jets for the RAF. I would never have thought about it, but it is possible that his and my family would be affected if Section 41 powers were to be used in the event of his untimely death, if that were to happen.

I have two questions to ask the Minister. They relate to the guidance in the extraction of information code of practice, which was provided in relation to the Act and as a result of the words of the Information Commissioner, who believed that this was necessary. I am pleased that it is provided.

My first question relates to paragraph 69 of the guidance, which talks about the use of a mobile phone device “around the time of” the death of the person concerned. It uses the words “the user”. Earlier, in relation to Section 37 of the Act, the code of practice talks about where people are not necessarily the owner of the phone or mobile device. It distinguishes clearly people who own a phone from people who have a phone which is owned by somebody else—something we parliamentarians know because we have a parliamentarian phone that is not our property but is used for all sorts of communication, as well as for the business of Parliament. I do not expect the Minister to have an answer yet, but could there be some clarification of paragraph 69 that refers back to the earlier information given in the code of practice to say exactly what it means about a shared-user phone?

My second question is about paragraph 90 of the code and current practice among police forces to keep up to date with technology in order to separate personal information from necessary information related to the event being investigated—the death, criminal event or whatever. Does the Minister have any information about whether police forces of all sorts are using similar technology? The real problem, which is quite obvious, is that there is a variety of technological options available to police forces and they may all be using different ones. That means that they may not necessarily be able to do what is required in the code of practice and keep up to date with

My Lords, I too am happy to say that this is a straightforward statutory instrument, and we are happy to support it from the Labour Party’s point of view. The SI adds members of the Royal Navy Police, the Royal Military Police and the Royal Air Force Police to those given the power to extract information from a device after a user of that device has died, as part of an investigation or inquest into the death, to investigate crime and to safeguard others.

I think it is fair to ask the Minister why these police forces were left out of the original Bill. Was there a particular reason, or was the consultation process not complete?

The Labour Party tabled a series of amendments to the PCSC Bill creating new checks on police powers to extract data from electronic devices. This was due to concerns about vulnerable people and the intrusive nature of these searches—in particular, for rape and sexual abuse victims, who can feel that requests for information, including digital information taken from their phone, can be overly invasive and collect highly personal information that is not relevant to the inquiry. It may make people more reluctant to come forward to the police if they know that they will get this interrogation of their phones.

I understand that this SI covers something different—cases in which the owner of the device has died—and we are happy to support this amendment. However, I would still like to ask the Minister what assurance he can give about how devices and information taken from them will be handled sensitively so as not to discourage potential victims and witnesses from coming forward.

There have also been serious concerns about digital resources and the use of digital information by the police, outlined in the report last year from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services. Can the Minister give any update on what action is being taken and whether any specific concerns have been raised about the use of digital items by the forces being given additional powers today? That is a more general question; the two questions raised by the noble Lord, Lord German, are very pertinent, so I shall be interested to hear the Minister’s response on shared-user phones and what impact the measure would have on them, as well as on the interoperability of different technologies and different police forces, as I am sure that that will be a tripping block. I am sure that it is not the intention to create any problems but it is always difficult, in my experience, to get different sources of technology to work together in a seamless way. That seems to be a challenge facing businesses, police forces and everybody battling with new digital technologies. However, overall, we support this SI.

My Lords, I thank both noble Lords who have spoken in this very short debate. I shall address all the questions asked of me shortly. Before I do that, I make the general point that the introduction of extraction of information powers in the 2022 Act and its code of practice are just the start of changes being made to improve the experiences of victims involved in the criminal justice system. These specific powers were introduced to ensure that victims and witnesses who report crime can be confident that their personal information will be handled appropriately and that their privacy rights will be respected.

As has been discussed, the amendment relates to the extraction of information from electronic devices when the device user is deceased, so some of the issues debated during the passage of the Police, Crime, Sentencing and Courts Bill are not available there.

The noble Lord, Lord Ponsonby, asked why it was not introduced with regard to these police forces in the original iteration. As I said in my opening remarks, at the time it was not agreed that the Royal Navy Police, the Royal Military Police and the Royal Air Force Police had a sufficient investigative requirement to use Section 41 powers or that their investigative needs could not be met with other existing powers. We have now taken the time thoroughly to consider their case and are in agreement with those police forces that their investigative duties meet the requirements for the use of the powers. In short, it is about ensuring that giving those police forces those powers is indeed the proportionate and correct thing to do, which is why it has taken a little bit of time.

On some of the more technical questions asked of me by the noble Lord, Lord German, there is a broader debate here about whether extraction of information from a personal device is always necessary, given the risks to privacy. Of course, there is a balance to be struck, which must be achieved when undertaking any investigation. All reasonable lines of inquiry must be followed to guarantee a fair trial with the right to privacy. As I said in my opening remarks, it is vital that victims and witnesses feel confident to come forward, but it is equally important that police and other agencies have access to the evidence that they need—I accept that there is no disagreement about this—including mobile data, to fully investigate crime and guarantee a fair trial.

On ensuring that the technology is, in essence, future-proofed in the code of practice, the Extraction of Information from Electronic Devices: Code of Practice will always be updated to reflect changes being made to Schedule 3, but changes to the code of practice can be made only by regulations made by statutory instrument and require a duty to consult with others. It will be updated when other significant amendments need to be made. I think that covers future-proofing in its various forms. Of course, it is very difficult to say whether the technology is adequate until it has been invented.

Just to interrupt the Minister for a second, I was asking whether a common set of software is used across police forces.

I am coming to that. There is a digital evidence programme, because the Government are determined to address the challenges associated with selectively extracting, analysing and reporting digital evidence gathered in criminal investigations, as we have been discussing.

We are supporting the Police Digital Service with £1.36 million in 2023-24 to undertake work to better understand the challenges in this area and to work with the private sector to develop and test new technologies. The evidence programme has been set up with a wide range of deliverables, including landscape reviews of force capabilities and gaps; creation of a new RASSO tech partnership board, bringing actors across policing together with the private sector—please do not ask me what the acronym RASSO stands for; development and testing of a range of private sector tech products within police forces; and, through the ACE impact lab process, working with technology companies to develop innovative solutions to key RASSO problems. The work is focused on solving the problems that victims experience and the selective extraction, analysis and reporting of digital evidence. It is fairly safe to say that all the questions asked of me by the noble Lord will be covered under that piece of work.

I am sorry to interrupt the Minister again, but the acronym RASSO stands for rape and serious sexual offences.

I thank the noble Lord very much for that.

On the progress being made on recommendation 5 of the HMICFRS report, which relates to budgets and the funding of digital forensics, we have also set up a commissioning board, jointly led by policing and the Home Office, to enable joint decision-making around prioritisation and to increase the transparency of funding decisions, including those in digital forensics, in line with that recommendation. In addition, we are investing £11 million into providing forces with technology that will enhance their capability to carry out rape investigations quickly and to provide a better service to victims.

I thank noble Lords very much for their questions. I hope I have answered them; I think I have. In closing, I repeat my thanks for the time taken to discuss and consider these issues. I once again commend the regulations to the Committee.

Motion agreed.