Quick Comment on UK Draft Data Retention and Acquisition Regulations 2018 and the Definition of ‘Serious Crime’ for Bulk Surveillance Powers

The UK Government has published the Draft Data Retention and Acquisition Regulations 2018, which propose changes to the Investigatory Powers Act 2016 (.pdf) (IPA) and the Regulation of Investigatory Powers Act 2000 (RIPA). Both the IPA and RIPA provide a legal basis for Government surveillance, including bulk surveillance techniques.

The changes included in the draft were brought about, in large part, as a result of adverse findings by the Court of Justice of the European Union in the Watson case, which held that the EU Charter of Fundamental Rights:

"…must be interpreted as precluding national legislation governing the protection and security of traffic and location data and, in particular, access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, is not restricted solely to fighting serious crime, where access is not subject to prior review by a court or an independent administrative authority, and where there is no requirement that the data concerned should be retained within the European Union." (para 125)

A key issue, therefore, is the definition of ‘serious crime’ adopted by the Government, and whether this satisfies the high human rights law threshold associated with bulk surveillance measures.

Significantly, the Draft Data Retention and Acquisition Regulations 2018, lowers the previous threshold. The IPA defines ‘serious crime’ as:

"the offence, or one of the offences, which is or would be constituted by the conduct concerned is an offence for which a person who has reached the age of 18 (or, in relation to Scotland or Northern Ireland, 21) and has no previous convictions could reasonably be expected to be sentenced to imprisonment for a term of 3 years or more."

This definition is already contentious, in light of the potential human rights harm associated with bulk surveillance powers, and the high threshold established under human rights law. However, it is now proposed that the IPA’s three-year custodial sentence threshold be reduced to 12 months. It is difficult to see how this could comply with human rights law requirements.

Ourselves and other colleagues at the Human Rights, Big Data and Technology Project prepared a submission to the Home Office, regarding the initial proposal. It is worth excerpting here, as although directed at the original Home Office proposal, the reasoning remains relevant to the draft Data Retention and Acquisition Regulations:

How may human rights concerns be addressed?

Both the European Court of Human Rights and the Court of Justice of the European Union have established that bulk surveillance practices should be evaluated on the basis of ‘strict necessity’.* Although neither the European Court of Human Rights nor the Court of Justice of the European Union have defined the specific circumstances in which bulk powers may be used concrete guidance is given. As stated by the European Court of Human Rights:

A measure of secret surveillance can be found as being in compliance with the Convention only if it is strictly necessary, as a general consideration, for the safeguarding the democratic institutions and, moreover, if it is strictly necessary, as a particular consideration, for the obtaining of vital intelligence in an individual operation.**

This test indicates that the use of bulk powers should be restricted to exceptional incidents, where the inadequacy of alternative techniques has been demonstrated.*** It is in accordance with this approach that extensions of the law to use bulk powers should only be made where they are shown to be strictly necessary.

Recommendation regarding the definition of serious crime for the purposes of the Investigatory Powers Act

[…]

However, the Government’s proposal to extend the definition of ‘serious crime’ for the purposes of the Investigatory Powers Act, [from three years to 12 months custodial sentence], is problematic. This proposal represents a significant extension of the authority by which communications data may be retained or acquired, and is unlikely to satisfy the strict necessity test. Concerns already exist regarding the scope of the existing provisions. The current proposals will only add greater uncertainty, and it is likely that they will be held inconsistent with the Government’s legal obligations.

It may be the case, as argued in the Government’s consultation paper, that the retention and acquisition of communications data is necessary for certain offences falling outside the existing scope of the Investigatory Powers Act. As yet, however, this is insufficiently demonstrated. The Government’s proposed approach is overly blunt and risks the unwarranted extension of powers, whereby communications data may be retained or acquired in circumstances where such powers are not strictly necessary.

Developments in this area should not be entered into hastily. This is a key lesson to be learned from the process surrounding the Investigatory Powers Act to-date, whereby a rushed process has resulted in elements already being found inconsistent with human rights law.

Serious efforts must be made, for instance, to identify the specific circumstances in which communications data may be retained or acquired, to elaborate the characteristics of the relevant offences, or to define an appropriate threshold. Further research and analysis is required. It is essential that the Government provides clear justification for the for proposed extension of these powers. Such justification should demonstrate why the new provisions are necessary and why existing provisions are inadequate.

*With respect to the CJEU see, Tele2 Sverige AB v Post-och telestyrelsen and Secretary of State for the Home Department v. Watson and others, Judgment, Grand Chamber, European Court of Justice, Cases C-203/15, C-698/15, 21 December 2016, para. 116.

**Szabo and Vissy v. Hungary, Judgment, European Court of Human Rights, Application No. 37138/14, 12 January 2016., para. 73. Although this decision was applied to content data, it is suggested that an equivalent approach would be adopted should a communications data case arise. As noted in the above footnote, the CJEU has adopted the strict necessity approach vis-à-vis communications data.

***The inadequacy of alternative techniques is indicative of the ‘vital’ nature of the powers. In this regard the comments by David Anderson QC, the former Independent Reviewer of Terrorism Legislation, are pertinent: ‘Cause and effect in this area are not always straightforward […][a] mosaic of different information sources is classically involved in identifying a target or threat.’ See, David Anderson, Independent Reviewer of Terrorism Legislation, 'Report of the Bulk Powers Review', August 2016, para. 4.12.