§ Mr. HealdI beg to move amendment No. 14, in page 23, line 45, leave out from "health" to end of line 3 on page 24.
Mr. Deputy SpeakerWith this it will be convenient to discuss amendment No. 58, in page 24, line 21, at end insert—
'( ) Communications data obtained on grounds falling within those specified in subsection (2) shall not be subsequently used or disclosed for any other purpose.'
§ Mr. HealdThe amendment deals with the purposes for which communications data may be obtained. Many 593 commentators in the industry and individuals who have contacted me have made the point that clause 21 is a wide provision-especially subsection (2)(h), which provides that the Secretary of State may specify any purpose for obtaining communications data and goes beyond what is reasonable or in the Government's interests.
Great concern has been expressed about the very wide terms of clause 21. It is believed that, when taken with clause 24(1)(f)—which provides that the Secretary of State can specify any public authority as designated for the purposes of obtaining communications data—any public authority could obtain communications data for any purpose. Such matters would obviously be subject to an element of scrutiny, but the uncertainty of the position has created concern, especially among City institutions. I do not believe that the Minister is uncertain about what he wants to achieve, so it seems a pity that he has not nailed his colours to the mast by saying what the purposes are, as he has done in clause 6, in which he has been prepared to list those who may apply for an interception warrant. Why not list the purposes without adding the catch-all?
Friendship tree technology exists today—one can learn a lot on these Bills, Mr. Deputy Speaker. If one has enough communications data, one can use that technology to find out in tremendous detail who communicates with whom. One can find out all sorts of interesting information about a person's life. It is an invasive form of investigation, not just a matter of finding out who telephoned whom and when, but of finding out in great detail about their internet communications and a range of other communications.
That is a valuable tool if used against a serious criminal, but the danger is that it will be used against others. If City institutions fear that they will be subject to it, there will come a point when we lose the benefits because the industry will not function effectively. Vodafone, one of the leading players in the field, has expressed concerns, saying that the underlying assumption is that communications data access represents a lesser intrusion into the rights of privacy than interception does. That is not necessarily true.
Verification is also a concern, as I have said before. Verification of a request for communications data is important, and the protections that we have already discussed must be provided. Finally, I cite again what Philip Virgo said in his e-mail, which was copied to the Minister. He wrote:
Most of the City institutions do not appear particularly concerned by the Human Rights issues. Their main concern is over the uncertainty as to who will have what rights of access to their data and communications and the risk of criminal access under guise of a warrant or via the law enforcement agencies themselves.He also points out that all organisations have occasional bad apples—people who do not live up to the standards of the institution. That is as true of law enforcement authorities as it is of any other organisation, although one would hope that they would take great steps to avoid it. These things happen, and City institutions, in which secrecy and confidentiality of information is of the utmost importance, see giving information to the security forces or any law enforcement agency as a security risk.594 We need proper protections. Saying that communications data may be obtained for any purpose that is specified by any public authority that the Minister chooses to designate simply is not good enough. We ask the Minister to think again.
§ Mr. Harry Cohen (Leyton and Wanstead)Amendment No. 58 is linked with amendment No. 14, which was so well moved by the hon. Member for North-East Hertfordshire (Mr. Heald). He was right to point out the importance of communications data and the invasive nature of its collection, analysis and use—or misuse. I pay credit to the hon. Gentleman for what he said.
My probing amendment states that communications data
obtained on grounds falling within those specified in subsection (2) shall not be subsequently used or disclosed for any other purpose.I want to explore the extent to which communications data collected for one purpose could subsequently be used for another. In Committee, my hon. Friend the Minister stated that such communications data cannot be used for other purposes, such as council tax and the collection of vehicle excise duty. I am not so sure about that—as I shall explain to the House.Let us suppose that the police obtain communications data, subject to proper authorisation procedures, codes of practice and other notices required by the Bill. Under section 29 of the Data Protection Act 1998, a disclosure from the police can be made if they are satisfied that the failure to disclose would prejudice
the collection of any tax or duty or of any imposition of a similar nature.During the debates on that measure in 1998, it was held that that provision included council tax and vehicle excise duty.If the police obtained communications data in accordance with chapter II, there would seem to be nothing to stop them—at a later stage—volunteering the data, by virtue of section 29 of the 1998 Act, for example, to local authorities for the collection of council tax, to the Driver and Vehicle Licensing Agency or, of course, for use by the Inland Revenue or Customs and Excise. As far as I can see, that is lawful; it is permitted under section 29 of the Data Protection Act. If my interpretation of the law is wrong, I hope that my hon. Friend will tell me clearly, so that my concern can be put to rest.
What is more likely is that another Department will be able to exercise powers to demand communications data from the organisation that obtained them. For instance, I am sure that other legislation covering the operations of the Inland Revenue, the Department of Social Security, the immigration authorities or Customs and Excise would permit a demand for such data. Indeed, under the previous Conservative Government, the immigration authorities required local authorities to provide them with such information.
I thus conclude that it is possible for communications data to be demanded for other purposes after its collection—if that is permitted by other legislation. However, if I am wrong, I hope that the Minister will state clearly that no other legislation would require such subsequent disclosure. If the Minister cannot provide that assurance, I must conclude that such further use is a possibility and is legal.
595 If I am correct, the authorisation process in chapter II would be irrelevant to the protection of privacy, because communications data could be volunteered to, or demanded by, other bodies at a later stage. An official could legitimately authorise collections of communications data and keep proper records only for them subsequently to be used for another purpose. If that is true, the relevant commissioner, who examined the authorisation process, would not know of such disclosures; nor would the telecommunications operator or the public. To put it bluntly, the whole authorisation process and all the protections afforded by chapter II could be reduced to a meaningless sham, because there would be no record of subsequent disclosures as part of the authorisation process.
That is an unacceptable prospect—hence my probing amendment. Its purpose is to stop any subsequent use that was not authorised at the time of the collection of the communications data.
In Committee, I expressed a difference of view with the Minister on communications data. He seemed to regard the matter as being not particularly important—certainly in respect of other forms of data and information collected. There is a danger that he and the Government are being too casual about communications data. There is potential for misuse and there should be proper controls.
§ Mr. Simon HughesI am grateful to the hon. Members for North-East Hertfordshire (Mr. Heald) and for Leyton and Wanstead (Mr. Cohen) for raising this important subject and for giving us the opportunity to have a short and important debate on it.
I shall discuss the issues in the order that they were raised. Liberal Democrats are sympathetic to amendment No. 14, which was moved by the hon. Member for North-East Hertfordshire. It would remove the general additional justification for the acquisition of communications data.
As the hon. Gentleman spoke, I reflected on a thought that I have had before. It is generally accepted that the acquisition of data on patterns of communication can be as intrusive as the interception of the communication itself. For example, the interception of a letter or a telephone call might, in a sense, be no worse than someone knowing whom one phones and how often one does that. If that process is carried out illegitimately, it is a modern form of stalking. Someone's telecommunications movements can be followed in the same way as someone else's physical movements are followed. That can be equally threatening and oppressive.
The tracking of telecommunications movements can be carried out comprehensively. In one of my meetings with the police since becoming Liberal Democrat home affairs spokesman, I examined how they do that for the perfectly proper purpose of criminal investigation. They monitor dealings between persons A and B who might be plotting or arranging a meeting to hand over illegal goods or imported drugs. Every phone call and communication will be monitored. The methods used to get round the monitoring are becoming ever more imaginative, but technology continues to catch up. It is important that the police have the power to monitor communications, and that is why our general premise from the beginning was to support the Bill. However, not just the interception of 596 communications, but the management and control of that interception must be brought within the framework of legislation.
We welcome the proposal that data should be collected only if that is justified by the seven specific grounds in clause 21. We should not provide for the general and completely unqualified ground that is outlined in subsection (2)(h). It is worth noting that clause 5 does not give such a wide power to Secretaries of State or to those who grant warrants on the interception of data. Although it provides a more general provision to cover the protection of national security, the detection or protection of serious crime or to safeguard the economic well-being of the United Kingdom, it qualifies that power. Subsection(3)(d) states:
for the purpose, in circumstances appearing to the Secretary of State to be equivalent to those in which he would issue a warrant by virtue of—a crime prevention or detection provision—giving effect to the provision of any international mutual assistance agreement.Although that is a wide power, it is not unlimited in the same way as the power in clause 21.On amendment No. 58, which was tabled by the hon. Member for Leyton and Wanstead, it is right, in principle, to make sure that information obtained, for example, for the prevention or detection of crime or in the interests of public safety should not be generally available so that it can be shipped from one agency to another. The hon. Gentleman's remarks were considered and cautious when he said that it was a probing amendment and it is worth raising the issue at this stage. However, if he and the House are not satisfied by the Minister's reply, we or the other place should consider returning to the subject later. It is important that there is a specific power that authorises the interception of communications only for a specific purpose. Once we have obtained information, we should not allow it to be passed around the system.
I have a question for the Minister about a matter that was not dealt with earlier. I am not aware that the various notices that can be applied for, and which we debated when we dealt with part III, are legally time limited and therefore automatically lapse after a certain period. That issue is related to the implications of the amendment in the name of the hon. Member for Leyton and Wanstead. If we introduce a power to acquire information, we should not only prevent it from being used for any purpose but make sure that it is not given indefinitely and that there is a requirement to have it renewed.
Where in the Bill is there a provision to end the power given by a warrant or other measure? If there is no such provision, does not the Minister consider that we ought to amend the Bill to limit the duration of a power, in the same way that search warrants and other warrants obtained by the police are time limited?
§ Mr. Charles ClarkeBefore I respond to specific points, I must comment on the quote from Philip Virgo given by the hon. Member for North-East Hertfordshire (Mr. Heald). Mr. Virgo's e-mail said:
On Thursday I attended a City event and had my ear bent as to why the debate on the RIP Bill was on the Civil Liberties issues with little/no mention of the threat to the UK position in international business-to-business e-business and the City Institutions and Large Multinationals who—597 he claims—are quietly moving…operations out of the UK to avoid being caught by the Bill.I emphasise, as I have tried to do throughout these debates, that any perception that we are concerned only with civil rights issues, and not with e-commerce business issues, is wrong. We have sought to address a wide variety of issues with many contacts, including the European Informatics Market.The hon. Member for North-East Hertfordshire quoted Mr. Virgo's statement that
Most of the City institutions do not appear particularly concerned by the Human Rights issues.I do not agree. City institutions generally are concerned about human rights issues, and obviously have different views about how they should be addressed. I want to put on the record the fact that the Government do not accept Mr. Virgo's assessment, first, of the debate in general and, secondly, of the importance of human rights issues to commercial organisations.
§ Mr. HealdThe Minister will agree that throughout the proceedings on the Bill, there has been considerable discussion of the position of business and the way in which it is influenced—I have gone on about that a lot. Does the Minister have any evidence in connection with Mr. Virgo's point about companies leaving the UK?
§ Mr. ClarkeNone at all. I have heard that assertion only from Mr. Virgo. It would be of concern if it were true, but we do not have evidence of that. Obviously, we consider issues of the overall commercial environment with colleagues from the Department of Trade and Industry. The reverse of the assertion is true: the regime that we are establishing will increasingly be seen as one that strengthens e-commerce, rather than weakens it, because it strengthens public confidence in the whole of e-commerce.
Amendment No. 14 is an attempt to restrict the purposes for which communications data may be required from eight to five. That matter was fully debated in Committee, but I am happy to restate the main reasons why we need to retain the three purposes in question. Clause 21(2)(f) includes the purpose
of assessing or collecting any tax, duty, levy or other imposition,and so on. That is a reflection of section 29(4) of the Data Protection Act 1998, and although not used extensively, it is currently used by agencies such as Customs and Excise to investigate the shadow economy.An example of a situation in which such a provision is used is when flyers promising cheap cigarettes or tobacco, and giving a phone number to call, are pushed through letter boxes. An investigation at that early stage may very well not be a criminal investigation, but merely to ascertain whether the supplier had a tax liability. Another example is that of a tradesman who advertises in a newspaper, but is not VAT registered. If he earns enough to advertise, the chances are he is close to the VAT threshold and might have a tax liability, but an investigation would not necessarily be a criminal investigation.
The second purpose, set out in clause 21(2)(g), is that of
in an emergency…preventing death or injury or any damage to a person's physical or mental health.598 In Committee, I gave an example of a case in which that might apply: a child telephones the emergency services to say that a parent has collapsed, but is unable to give the address. I agree that such cases do not often occur, but they are important. I emphasise that the whole purpose of the Bill is to extend the protection of the European convention on human rights.The most serious of the three points relates to clause 21(2)(h), which contains the broadest framework, starting with the words "for any purpose". Although I accept that that provision means that new purposes could be added fairly easily, I should like to make two points. First, we are dealing with a new area of legislation and, despite all the effort that my colleagues and others have put into the Bill, we are still not absolutely certain that the existing purposes cover everything which may be required. It is possible that the purposes will have to be extended in future, especially if other Government Departments apply to be subject to those provisions, rather than relying on the Data Protection Act. However, I stress that the Government have absolutely no plans to do that at present. My second point should reassure anyone who believes that subsection (2) gives the Government a blank cheque. It does not, since any new purpose would, of course, be limited by article 8 of the European convention on human rights; that imposes a serious restriction.
If I gave my hon. Friend the Member for Leyton and Wanstead (Mr. Cohen) or any other member of the Committee the impression that I do not consider communications data important, I did so inadvertently: I believe that such data are important. However, during our discussion in Committee of the hierarchy of intrusion of different forms of data collection—including someone standing in one's front room, someone listening to one's phone conversations and so on—I suggested that the collection of communications data is not as individually intrusive as some of the other forms of surveillance. I firmly believe that communications data are important, and if I gave the contrary impression in Committee, I correct it now.
The amendment would restrict the purposes for which communications data may be used or disclosed to purposes for which it may be required under the Bill. Although the Bill does not address that particular issue, we believe that to a large extent, the purpose of the amendment is met by the Data Protection Act. My hon. Friend made that point in Committee. Several of the data protection principles are relevant, especially the second principle, which is that
personal data shall be obtained only for one or more specified purpose, and shall not be further processed in any manner incompatible with that purpose or those purposes.Processing includes using or disclosing. That clear principle offers protection.I do not believe, therefore, that there is any need to add further restrictions on the use or disclosure of communications data, although I perceive the merit in explaining the relevant data protection principles in the code of practice to ensure the proper handling of communications data. The Government accept the principle that data should be used only for the specific purpose for which they are collected.
It is true that there is an exemption for national security under the Data Protection Act. However, each of the three security and intelligence agencies is bound by statutory 599 arrangements under the Security Service Act 1989 and Intelligence Services Act 1994. Those arrangements mean that they may not disclose material that they have obtained except for the purpose of properly discharging their functions, or for the purpose of criminal proceedings. I hope that I have now responded adequately to the points that were clearly made and well put by my hon. Friend the Member for Leyton and Wanstead, and that he draws comfort from my remarks.
The hon. Member for Southwark, North and Bermondsey (Mr. Hughes) asked about the question of time—an interesting and characteristically existential point. I have no detailed answer to offer, but I believe that we discussed that point in Committee when, if memory serves, the hon. Member for Sheffield, Hallam (Mr. Allan) raised it. I shall write to the hon. Gentleman if he wants me to, but I believe that data are collected for a specific purpose, not for a specific period of time; the key question is what period of time is appropriate for that purpose. As I said, we debated the matter at length in Committee, and I shall not repeat what I said there on the hon. Gentleman's final point. I shall write to him further if my remarks have been misleading.
§ Mr. Simon HughesI, too, stand to be corrected, especially in relation to part III and clause 47. I understand that there may still be an unanswered time question.
With regard to the amendment tabled by the hon. Member for Leyton and Wanstead (Mr. Cohen), did the Minister say that the Data Protection Act 1998, rather than any code or subsidiary legislation, was clear about all such
| RELEVANT PUBLIC AUTHORITIES DESIGNATED FOR THE PURPOSES OF SECTIONS 27 AND 28 | ||
| Public Authority | Directed Surveillance | Use of Covert Sources |
| Police forces, including: | ✓ | ✓ |
| British Transport Police | ✓ | ✓ |
| Ministry of Defence Police | ✓ | ✓ |
| Service Police | ✓ | ✓ |
| National Crime Squad | ✓ | ✓ |
| National Criminal Intelligence Service | ✓ | ✓ |
| HM Customs &Excise | ✓ | ✓ |
§ matters? I would be troubled if it were suggested that something other than legislation were being prayed in aid as a higher authority than the Bill, which will become law.
§ Mr. ClarkeI believe that the Data Protection Act 1998 is clear. That is why I quoted the data protection principle established in it. I believe that it is compatible with other legislation, including the Bill. It is incumbent on us to explain the relevant data protection principles in the code of practice, to make them clear to everyone.
I hope that on that basis, the hon. Member for North-East Hertfordshire and my hon. Friend the Member for Leyton and Wanstead will withdraw their amendments.
§ Mr. HealdWe are not entirely satisfied, but I do not intend to press the amendment to a Division. The matter may be raised again in another place. Accordingly, I beg to ask leave to withdraw the amendment.
§ Amendment, by leave, withdrawn.