Regulation of Investigatory Powers (Intrusive Surveillance) Order 2003

HL Deb 13 November 2003 vol 654 cc1521-62

11.6 a.m.

The Attorney-General (Lord Goldsmith) rose to move, That the draft order laid before the House on 11th September be approved [28th Report from the Joint Committee ]

The noble and learned Lord said: My Lords, I rise to move the orders on behalf of my noble friend. It may be for the convenience of the House if I first explain the procedure which, following discussion, we propose to adopt. Subject to the leave of the House, we shall have one debate covering all five orders. Formally, it will take place on the first order on the Order Paper—the Regulation of Investigatory Powers (Intrusive Surveillance) Order. I shall therefore move to approve the order and will speak to all five.

The noble Baroness, Lady Blatch, will then move her amendment and debate will take place on all five orders and all the amendments. I shall then close the debate, followed by the noble Baroness. The first Question to be put will be on the noble Baroness's amendment to decline to approve the intrusive surveillance order—unless, of course, she does not press it. I make it clear that although the debate will take place on all five orders and I am presently inclined to move all five orders when we reach them, I shall obviously want to consider the position in the light of any Divisions that may take place.

The order in which I now propose to speak to the orders—again, I hope that this will be for the convenience of the House—is, first to the intrusive surveillance order, then to the directed surveillance order, then to the communications data order and then, finally, to the two orders under the Anti-terrorism, Crime and Security Act 2001.

I therefore turn first to the Regulation of Investigatory Powers (Intrusive Surveillance) Order 2003. The order before the House is made under Sections 41(3) and (4) of the Regulation of Investigatory Powers Act 2000 and relates to the Northern Ireland Office. It designates the Northern Ireland Office as a public authority that may apply to carry out intrusive surveillance under Part 2 of the 2000 Act, so that the Northern Ireland Prison Service has statutory cover for intrusive surveillance operations. The order also specifies that within the Northern Ireland Office only staff in the Northern Ireland Prison Service may apply to use the power.

I should say a little more about what this covers. Under Part 2 of the 2000 Act, intrusive surveillance is defined in Section 26(3) as any covert surveillance carried out in relation to residential premises or private vehicles. The definition of residential premises includes prison cells. There may be occasions when such surveillance by the Northern Ireland Prison Service is considered necessary—for example, in prison hostage situations. So the order is necessary.

On intrusive surveillance, Part 2 of the Act provides that the authorisations that will permit the Northern Ireland Prison Service to carry out such intrusive surveillance will be given personally by the Secretary of State, who will have to be satisfied that the action is necessary on one of the grounds listed in Section 32(3), and that it is proportionate to what is sought to be achieved by carrying out the surveillance. As with the rest of the Regulation of Investigatory Powers Act-authorised activity, those are important tests: the tests of necessity for one of the permitted reasons and proportionality.

In considering the circumstances of the individual case, the Secretary of State must also consider whether the information thought necessary to be obtained could reasonably be obtained by any other less intrusive measures. The oversight of the use of intrusive surveillance will fall to the Chief Surveillance Commissioner by virtue of Section 62(1)(a) of RIPA. Under Section 65(5)(d), the independent Investigatory Powers Tribunal is the appropriate forum to consider complaints about intrusive surveillance activity by the Northern Ireland Prison Service. It can award compensation for unlawful use of powers against an individual.

So I have identified the requirements—necessity and proportionality—authorisation by the Secretary of State; oversight by the chief surveillance commissioner; and complaints procedure with the independent Investigatory Powers Tribunal.

The Government's view is that the order represents an important move to ensure that public authorities carry out their activities in a strictly regulated manner, in a way consistent with the European Convention on Human Rights and Human Rights Act 1998. That is the purpose of the order. Throughout the debate noble Lords will hear me say on the orders that an important part, and the reason that the Government brought them forward, is to provide a strictly regulated manner for the exercise of the different powers that we will discuss. In the Government's view the order is compatible with the rights set out in the European Convention on Human Rights. On behalf of my noble friend, I commend the order to the House.

I shall now speak to the Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) Order 2003. It is made under Section 30(l),(3),(5) and (6) and Section 78(5) of the RIPA Act 2000. It designates bodies as "relevant public authorities" that may grant authorisation to carry out directed surveillance and/or use covert human intelligence sources under Part II of the 2000 Act.

Directed surveillance, also defined in Section 26(2) of the Act, is covert surveillance that is not intrusive. On the first order I talked about intrusive surveillance relating to residential or private premises, but this is covert surveillance that is not intrusive but undertaken for a specific investigation or operation likely to result in obtaining private information. An example might be the use of a CCTV camera in a public place to survey an activity or people.

A covert human intelligence source, also known as a CHIS in the world of law enforcement, is defined in Section 28(8). It includes those previously known as agents, informants or undercover officers. A person becomes a covert human intelligence source if he establishes or maintains a personal or other relationship with someone for the covert purpose of obtaining information or to disclose information covertly obtained by the use of such relationships.

Part II of the 2000 Act provides for the first time a statutory framework compliant with the European Convention on Human Rights for the use of covert surveillance and covert human intelligence sources. Neither are new activities for law enforcement agents, but the Act provides a statutory framework compliant with the European Convention and strict requirements for the exercise of the powers. If the order is approved, as I hope it will be, it will ensure that the public authorities listed have their surveillance activities tightly regulated in such a framework. Let me be clear: the order is not about giving those public authorities any powers either to intercept the content of communications or to carry out intrusive surveillance. The only intrusive surveillance about which the debate is concerned is that of the first order on the Northern Ireland Prison Service.

The order will also repeal the previous order, Statutory Instrument 2000 No. 2417, the Regulation of Investigatory Powers (Prescription of Offices, Ranks and Positions) Order, which designated authorising officers for the public authorities listed in Schedule 1 to the Act. That will allow us to provide for the House and the public clarity in a single order about which authorising officers in what public authorities can authorise that activity under Part II. It restricts the power to authorise only to those people. That is why the order includes existing public authorities already listed in Schedule 1 to the Act as well as additional public authorities.

Not only does the order restrict who can authorise; for the first time, it also restricts the grounds on which authorising officers can grant authorisation. That ensures consistency with the Retention of Communications Data Order before the House today, to which I shall speak shortly. I wish to make it absolutely clear that we are not multiplying the number of agencies and public authorities included within the framework of the Act. We are adding only 12 public authorities to Schedule 1 to the Act and removing health authorities from the list of bodies that can authorise directed surveillance.

I recognise how complicated the order may appear, but perhaps I might explain how it works in practice. Article 2 adds to the list of public authorities contained in Part I of Schedule 1 to the Act, which are authorised, subject to the requirements, to carry out directed surveillance and to use covert human intelligence sources. It includes the United Kingdom Atomic Energy Authority Constabulary, the Northern Ireland Office, fire authorities, the Charity Commission, the Gaming Board for Great Britain, the Office of Fair Trading, the Office of the Police Ombudsman for Northern Ireland and the Postal Services Commission.

Article 2 of the order also adds four public authorities, but only for the purpose of carrying out directed surveillance, not covert human intelligence. They are: local health boards in Wales, Her Majesty's Chief Inspector of Schools in England, the Information Commissioner and the Royal Parks Constabulary. Those are the authorities.

Column 2 of the schedule identifies the level of officer who may authorise the relevant public authorities. It covers both the normal situation and urgent cases, where there is a need to make special provision. In urgent cases the person listed may authorise where necessary. However, noble Lords will see that column 4 limits the grounds on which particular authorising officers can authorise surveillance, by reference to the list in Sections 28(3) and 29(3) of the 2000 Act. I remind Noble Lords that these powers—directed surveillance and covert human intelligence sources—are covered in Sections 28(3) and 29(3), but the lists are exactly the same in other provisions. Paragraphs (a) to (g) of subsection (3) list the permitted grounds for an authorisation, provided that it is necessary and proportionate and,

1. "(a) in the interests of national security;
2. (b) for the purpose of preventing or detecting crime or of preventing disorder;
3. (c) in the interests of the economic well-being of the United Kingdom;
4. (d) in the interests of public safety;
5. (e) for the purpose of protecting public health;
6. (f) for the purpose of assessing or collecting",

any taxes. Finally, paragraph (g) permits the adding of another purpose, but no addition is being made.

That list of permitted grounds appears in the 2000 Act. They entirely reflect the permitted grounds under the European Convention on Human Rights. Privacy is not an absolute right under the European convention, as noble Lords well know, and the permitted exceptions are in the list. An authorisation would have to be necessary on one of those grounds.

Column 4 identifies which grounds are relevant to the particular agency. Noble Lords will also see that in relation to other orders. The Government want to ensure that the authorisation for particular bodies is appropriate and necessary for that body. We have therefore required the bodies to demonstrate what they need, and have included that in the provision. For example, the Charity Commission is listed in column 1 by virtue of its addition to Schedule 1 by Article 2 of this order. The rank of senior investigations manager has been designated as the appropriate rank of authorising officer to authorise either directed surveillance or covert human intelligence authorisations. If there is an urgent case, an investigations manager in the Charity Commission is prescribed to authorise either. However, in both routine and urgent cases, only the designated authorising officers can grant authorisations and they can do so only if such authorisations an; both necessary and proportionate for the purpose in paragraph (b): for the purpose of preventing or detecting crime or of preventing disorder".

It may also help if I give examples of the type of activity carried out by some of the public authorities that we seek to add to the list by order. I will take the example of the Charity Commission, because noble Lords may wonder why it has been included. It is the statutory authority for the regulation of charities in England and Wales. It is a non-governmental ministerial department, which is accountable to the Home Office for its efficiency and to the courts for its decisions. However, within its general function of promoting the effective use of charitable resources, it has particular responsibility to investigate criminal offences under the Charities Act 1993.

Under Section 8 of that Act, the Charities Commission can institute a formal inquiry if it suspects that abuse has occurred. The Act therefore gives the commission a range of information-gathering and remedial powers, so such a body is already within a transparent framework. The commission may wish to use techniques such as directed surveillance and it may need to use people to provide intelligence or work under cover—to use that shorthand—to prevent or detect crime. I am afraid to say that crime such as fraudulent charity fundraising or the misappropriation of charity funds does happen, as noble Lords know. Having the additional powers in this regulated way would enhance the commission's regulatory role in a way that is strictly compliant with the ECHR and strictly regulated.

The United Kingdom Atomic Energy Authority Constabulary is responsible for the policing and protection of special materials on designated civil nuclear sites in England and Scotland and when nuclear materials are being transported. The constabulary requires these powers as part of a package of measures to protect the civil nuclear industry from threats of terrorism, sabotage, proliferation and other criminal acts. I am sure that noble Lords would not hesitate to agree that to protect us all against such threats is an important objective.

Another example may raise questions in noble Lords' minds—that of Her Majesty's Inspectorate of Schools. Ofsted is the non-ministerial department headed by Her Majesty's Chief Inspectorate of Schools for England. It is not an agency of another department and a person may be appointed chief inspector by Order in Council. Its principal task is the management of school inspection, originally defined by the Education (Schools) Act 1992. As noble Lords know, its role has expanded over successive years and now includes inspection of: teacher training courses; education in the private, voluntary and independent nursery sector; independent schools; LEAs; and sixth form and further education colleges. Ofsted does not need to carry out directed surveillance activities in connection with those functions.

Since 2001, however, the inspectorate has also been responsible for the regulation and inspection of child minding and day care in England. That responsibility was transferred from local authorities as a result of amendments to the Children Act 1989. Ofsted may need to undertake surveillance activities in connection with powers as the registration authority for child minders and day care providers. It has the responsibility for taking enforcement action when people are child minding or providing day care without being registered and when registered people contravene the terms of their registration.

I will put flesh on those bones to give a more practical example. The two most frequent uses of regulated surveillance—which is not intrusive or within the house—is the investigation of whether a person is acting as a child minder without being registered or whether registered child minders are caring for more children than they are allowed. I need not stress the importance of a properly regulated regime in relation to child minders, because it has already been the subject of comment in this House. There have been some worrying and tragic incidents. To achieve a properly regulated regime it may be necessary to carry out surveillance on people's homes to investigate whether children are being looked after illegally or record the number of children going in and out. Again, I emphasise that this is not intrusive surveillance, but surveillance from a public place. In either case, the person concerned could be committing a criminal offence. Even more importantly, the safety and health of the children being looked after may be at risk.

I would be happy to deal with how such powers may be used by other bodies. My speaking notes give the examples of the Office of Fair Trading and the Gaming Board for Great Britain, but we have quite a lot to cover. I hope that what I have said is sufficient to indicate, first, why the Government believe that it is important to regulate; and, secondly, the strength of the conditions imposed—that is, necessity, the level of authorisation, the purpose for the particular body, and the need for such action to be proportionate. I trust that I have given enough examples to enable noble Lords to recognise why directed surveillance or covert human intelligence sources may be appropriate for the important functions that these bodies carry out.

Baroness Williams of Crosby

My Lords, perhaps the noble and learned Lord will forgive me; I am not a lawyer. How far are the rights to undertake such surveillance limited to the purpose for which the agency was created? How far is it limited in such a way that those investigations cannot go beyond that particular purpose? Finally, does there need to be evidence to show that there may be reasons to believe that a criminal act—for example, in the case of an unregistered childminder—has been suspected, so that this is not an open mandate to that agency to investigate every household in which there may be children?

11.30 a.m.

Lord Goldsmith

My Lords, it certainly is not an open licence. Perhaps I may take the questions asked by the noble Baroness, Lady Williams, in two parts. First, are agencies limited to their own statutory functions? The answer is absolutely yes. They have the powers to carry out their particular functions and no others. I am grateful to the noble Baroness for asking the question. In addition to the requirement that surveillance should be necessary for one of the listed purposes, it must also be within the functions of that particular agency. In relation to a particular agency, there may be only one listed purpose—namely, the prevention of crime—and no other. There are several layers of requirement.

Secondly, surveillance must be necessary for that purpose and proportionate. I would not say that a particular agency might not take the view that it is necessary by reason of knowledge about an individual or that it is necessary to use the powers in a particular case. The agency would also need to be satisfied that it was proportionate to what was being considered. I would not go so far as to say that it must already have evidence of crime, but it would have to be satisfied that it is necessary for the purpose and proportionate to the use of that purpose. In considering whether it is proportionate, the agency would also have to consider whether there is some other way of obtaining the same information.

I hope that that at least goes quite a long way to reassuring the noble Baroness that these are strict and well defined requirements. I am grateful to her for giving me the opportunity to make the point that as well as the requirement in the Act—for example, the prevention of crime—each agency in each of these orders is limited by its own functions. We absolutely are not suggesting that the chief inspector should suddenly take on, for example, a roving brief to investigate any crime of any kind that he comes across.

Passing over the further examples that I offered to give—to which I will return if any noble Lord would like me to deal with those particular agencies or any other agency listed—we have also taken the opportunity to amend the definition of "local authority" so that it now excludes parish councils and a meeting of a parish council. That was following a recommendation made by the Chief Surveillance Commissioner in his annual report of 2001–02 to the Prime Minister. That undertaking was given in response to a Parliamentary Question answered by my right honourable friend the Home Secretary on 11th February 2003.

I turn now to the two issues with which I dealt under the first order. What about oversight? What about complaints? Oversight of the use of directed surveillance and the use of covert human intelligence sources falls, in the main, to the Chief Surveillance Commissioner by virtue of Section 62(1)(a) of the Act. That excludes those authorisations granted by the intelligence services, the MoD and Her Majesty's forces, which are overseen by the Intelligence Services Commissioner. Either way, there is oversight by a commissioner.

As regards complaints, again, the independent Investigatory Powers Tribunal is the appropriate forum to consider complaints. As I said on the first order, it has power to award compensation for unlawful use of powers against an individual.

Baroness Blatch

My Lords, does the noble and learned Lord agree that if one does not know an abuse has taken place, it is not possible to complain? For every case that has gone before the tribunal to date, no single case has been found in favour of the complainant.

Lord Goldsmith

My Lords, I am grateful to the noble Baroness for giving me the information in her second point; I was unaware of it. No doubt, it will be checked. I take that as very reassuring. It indicates that the independent tribunal has not found evidence of misuse. I noticed that one or two noble Lords were amused by that remark, which I hope was because it was apposite rather than surprising. It certainly seems a proper response.

Lord Elton

My Lords, perhaps I may return to a point the noble and learned Lord made before he was interrupted. He said that, within the context of the powers, the definition of a local authority had been changed to exclude a parish council or a parish meeting. Do we imply from that that these powers will be available to district councils?

Noble Lords

Yes.

Lord Goldsmith

My Lords, everyone on this side of the House is saying, "Yes". I shall come back to that question in case there is an issue in relation to it. I am told that the answer is yes: I am delighted to say that there is unanimity on that point. I shall come back to the issues about where local authorities, at whatever level, have a role to play under these orders. One of the examples given in the consultation paper on the access to communications data is that of trading standards officers concerned with protecting people who may be at risk from those who provide defective gas installations. That may be something that local authorities will be responsible for policing and on which will need some powers in order to protect people. I shall come back to that when we deal with access to communication data.

Lord Roberts of Conwy

My Lords, will the noble and learned Lord answer the first point of my noble friend Lady Blatch about how people will know whether there has been abuse or not?

Lord Goldsmith

My Lords, I am obliged. I did not intend to overlook that point. The noble Lord, Lord Elton, asked a supplementary question before I managed to answer the noble Baroness, Lady Blatch, fully. I want to deal with this issue more comprehensively. On looking at the powers of the oversight of the commissioner, we would expect commissioners to draw attention to abuses that they have discovered. I shall also come back to that issue later so that I can give a full answer. One of the difficulties of dealing with five orders together is the risk of moving from one to another. I want to be careful not to do that.

I repeat what I said in relation to the first order because it is apposite. It is another move to ensure that public authorities carry out their activities in a strictly regulated manner in a way that is consistent with the European Convention on Human Rights and Human Rights Act obligations. That is the purpose of the orders, which we believe they will achieve.

As we go through the orders, I want to make a general point. Of course, a great deal of the activity with which we are concerned is already capable of being carried out and is being carried out. In the orders, the Government are anxious to produce a strong regulatory framework, strictly regulated with requirements of necessity, proportionality and oversight. The whole framework of regulation should be ECHR compliant, which the 2000 Act sets down.

I turn now to the Regulation of Investigatory Powers (Communications Data) Order 2003. That was laid before Parliament on 1lth September. It is made under Sections 21(1), 25(2) and 25(3) and Section 78(5) of the Regulation of Investigatory Powers Act 2000. Approval of this order will enable implementation of Chapter II of Part I of the Regulation of Investigatory Powers Act. In the Government's view, that will bring long overdue regulation to public authorities' acquisition of communications data and will improve the protection of individual privacy rights.

The use of data, such as telephone and Internet subscriber information, itemised billing records—even mobile telephone location data—is a vital tool in the prevention and detection of crime and, in some cases, saves lives.

Communications data is information about communications. It is about who called whom, and when. It is not about the interception of communications—this is an extremely important point about which I want to leave no doubt. It is not about what is said in telephone calls or written in e-mails or letters. That is already regulated quite differently and very tightly by Chapter I of Part I of the 2000 Act. We are not concerned here with the content of phone calls and e-mails.

Parliament has already approved that certain authorities—the police, Customs and Excise, the intelligence agencies and the Inland Revenue—may, when the relevant provisions are implemented, use the Act to acquire communications data. The draft order designates additional relevant public authorities that may use the provisions. For all of these authorities, that is, both the existing authorities and the additional ones, the order restricts the purposes for which they can acquire data.

Further, the order will restrict the type of data that public authorities may acquire. Where an authority, or type of authority, has demonstrated a necessary and proportionate requirement for access to a type of data, the order provides for that, but not otherwise. It also restricts those persons who may use the powers to identified, designated senior authorising officers.

As I mentioned a few moments ago, I want to make clear a further point. The acquisition and use by public authorities of communications data is not new. Noble Lords have seen references to such access even this week, as we noted in the reports of a particular case. This activity already goes on, but it is not subject to the regulation set out in the Act; in effect, it is unregulated. Most of the public authorities listed in the draft order already seek communications data from communications service providers, using existing statutory information-gathering powers and by providers exercising exemptions to non-disclosure set out in the Data Protection Act 1998.

Some public authorities with statutory responsibilities for the investigation of specific offences have identified a necessary and proportionate requirement for acquisition of communications data in particular cases, but have chosen not to pursue that. Instead, they have elected to wait until they can demonstrate very clearly that they have assessed their requirements against the principles of the Human Rights Act 1998 and the convention, as the Regulation of Investigatory Powers Act explicitly requires.

The aim of the order, therefore, is to bring these public authorities within the strict control and oversight regime of the Regulation of Investigatory Powers Act. This means that all requisitions for the acquisition of data will have to be subject to the following requirements: first, they will have to be for a specific purpose, one that is drawn directly from the European Convention on Human Rights—such as the prevention of crime, matters of national security and so forth, as set out in the Act. Secondly, it must be necessary for one of those purposes—not simply desirable, but necessary. Thirdly, it must be proportionate to what is sought to be achieved by obtaining the data; a balance will have to be struck between the potential importance and the degree of intrusion. Finally, it will have to be authorised by an officer at a specific and senior level within the public authority.

The exercise of these powers will be subject to oversight by the Interception of Communications Commissioner, Sir Swinton Thomas, a former Lord Justice of Appeal in the Court of Appeal and a very distinguished and experienced High Court judge. He is obliged to keep under review the exercise and performance of powers and duties relating to the acquisition of communications data under Chapter II of Part I of the 2000 Act.

The commissioner must report to the Prime Minister if, at any time, it appears to him that there has been a contravention of the provisions of the Act relating to the acquisition of communications data. His annual report to Parliament on the interception of communications includes details of all errors that are made. It will be for the commissioner to determine how he should fulfil his obligations in respect of the acquisition of communications data—this has not arisen because we have not yet managed to put this part into force, which we are seeking to do by way of this order. It will be for him to determine how this is reported to Parliament and to consider whether, and the extent to which, he should notify individuals affected by any inappropriate or deliberate misuse of the provisions for access to communications data.

In answer to the question raised a little earlier by the noble Baroness, Lady Blatch, concerning access to communications data, it will be for the commissioner to decide the extent to which he thinks it right and appropriate to notify individuals affected by any inappropriate or deliberate misuse of the provisions for access. If so notified, those individuals will be in a position to act.

11.45 a.m.

Lord Phillips of Sudbury

My Lords, I am very reluctant to interrupt the noble and learned Lord, but it may be helpful to the House if I were to question the advice the Attorney-General has just given. So far as I am aware, there is no right under Chapter II of Part I of the Act vis-à-vis communications data for the Interception of Communications Commissioner to inform a citizen whose information has been purloined of that fact. I make the point now because it may be possible for advice to be given to the noble and learned Lord by his officials. However, it is an important issue.

Lord Goldsmith

My Lords, I am grateful to the noble Lord for giving me notice of his point and I shall take up his proposal with regard to advice. Others have heard his question and I shall come back to it with an answer.

The Countess of Mar

My Lords, while the noble and learned Lord is having a break, may I ask him whether he considers that the commissioner, who I understand has a staff of only four people and receives in the region of half a million inquiries every year, has sufficient capacity to deal with the work that he is expected to do?

Lord Goldsmith

My Lords, again, I shall take advice. However, I think the answer is that if the commissioner considers that he does not have adequate resources and staff to his job, then he will make that plain to the Government. I shall come back to the noble Countess if I can give her any further information. Certainly no one has suggested heretofore that the commissioner will not be in a position properly to carry out his important functions, ones which the Government now want him to be able to exercise in relation to access to communications data, which is in part why we have brought forward this order.

I shall make an additional point. Whatever the commissioner may decide to do, anyone who thinks that their data have been wrongly acquired will have the right to go to the Investigatory Powers Tribunal. The Home Secretary has made it quite clear that the commissioner will have the resources he needs to carry out his duties effectively; that is, to report to Parliament and the public. That is the assurance given by the Home Secretary. It corresponds exactly with what I have just said in response to the noble Countess, Lady Mar.

All the public authorities listed in this order must follow the procedures set down in the code of practice on acquisition of communications data explaining the statutory provisions in detail. A draft code has been published, has completed a public consultation exercise, and exists in draft for public authorities to follow. Further, the draft code will be laid before Parliament for approval.

In addition, public authorities may develop their own guidance material to foster professional standards. The Association of Chief Police Officers, working with the Association of Chief Police Officers in Scotland and Customs and Excise, has developed a manual of standards for accessing communications data under the Regulation of Investigatory Powers Act. That manual has already been published.

There are further administrative safeguards. These include a "double lock" safeguard where the acquisition of certain types of data, such as itemised call records, by certain authorities is granted only after prior approval by the Interception of Communications Commissioner. He will determine which authorities should be subject to such additional approval.

Specialist training for public authorities will support the proficient and appropriate use of the provisions, building on that developed jointly with the communications service industry by the police service and Customs and Excise. The accreditation of trained officials and authorising officers will ensure that those with legitimate and necessary access to such information know the legal and technical issues, which provides another safeguard. Accreditation of authorised officers will also support the authentication of disclosure notices served upon communications service providers.

I have spelt out a number of the safeguards that are in or lie behind the draft order. The regulation it provides and the clarity it introduces is welcomed by public authorities; it is welcomed by the communications service industry; and it was broadly welcomed by the public in response to the consultation issued by the Government last summer.

The scope of the order is constrained by what primary legislation permits it may cover. I know that in Committee in another place and in various public meetings concerns were expressed about the order. I anticipate that noble Lords will raise some of those concerns today and it may be helpful to noble Lords if I indicate the Government's response to them. This will enable noble Lords who wish to speak to them to know in advance the Government's position.

As we understand it, the concerns do not relate to the principle of regulating public authorities' acquisition of communications data—I hope that no one will disagree with the proposition that that is highly desirable—or the enhanced protection that will be provided to an individual's human rights. The concerns are not about what the order will put in place but about the practical arrangements and how the legislation will work in practice.

Let me deal with those concerns, one of which relates to the so-called legacy powers. At the moment, various public authorities undertaking their statutory function use powers that they have already for compulsory disclosure of information—usually defined in terms of information not restricted to communications data—to acquire communications data. RIPA approves a regulated scheme for acquisition of communications data which is specifically designed to be compliant with the purposes permitted by the ECHR.

The public authorities have identified that they can best demonstrate their compliance with the Human Rights Act by using the new specific legislation—the RIPA legislation—rather than relying, as they do now, on the pre-Human Rights Act legislation that gives access to this range of information. I hope noble Lords will agree that that is a very important step to bring their acquisition of communications data within the specific, human rights-compliant, regulated scheme.

But it would not be right to repeal the legislation that is already in existence—which still provides powers for necessary and proportionate disclosure of other information—because, since the introduction of the Human Rights Act, public authorities have to exercise those powers, however they are expressed, in accordance with that Act.

There has been only one example subsequent to the coming into force of the Human Rights Act and the passage of the Regulation of Investigatory Powers Act where Parliament approved specific provision—in the Social Security Fraud Act—for benefit fraud investigators, primarily those in the Department for Work and Pensions, to acquire communications data. That is why the Department for Work and Pensions and the Social Security Agency in Northern Ireland are absent from the public authorities listed in the schedule to the order.

These bodies have a requirement to acquire communications data to prevent and detect benefit fraud, and they intend to exercise that requirement using the legislation that Parliament has relatively recently approved—and, as I said, since RIPA and the Human Rights Act were passed—for that specific purpose.

I turn now to the next issue: for what purpose may data be acquired? I hope I have made it clear, because it runs through all that I am saying, that the permitted purposes under the Act are derived directly from Article 8.2 of the European convention. In their consultation paper the Government invited views on whether public authorities' access to communications data under the Act could be restricted not only by purpose but also by function. Although the functions of some public authorities can be captured in a way that is meaningful in law, the functions of many others responsible for enforcing wide and diverse pieces of legislation cannot.

The Government have concluded that it is not necessary to restrict by function because, as I said to the noble Baroness, Lady Williams, public authorities which try to do something that is not within their statutory remit would be acting ultra vires. They would not be acting in accordance with the law as required by the European convention and they could not properly and lawfully do so.

I know that there is some concern about the definition of communications data within Section 21 of the 2000 Act. The definition was deliberately conceived to be technology neutral and, as my note puts it, durable in a time of very rapid technological advance. Noble Lords will not need to be reminded how quickly this area can and does change—new methods of technology seem to come on stream all the time—and it was important that the definition should be neutral as to the form of technology so that it would be a durable provision. Parliament approved that definition rather than a complex and technically precise menu of categories of data. Those who work with the legislation will interpret the statutory definition. There was a guide to interpretation included in the consultation paper and, where necessary, the courts will interpret the definition.

I know that there is a concern about the transfer overseas of communications data. That subject will be raised later in an amendment and, given the length of time that I have been on my feet, I will deal with it when we come to that particular aspect.

The order represents a significant move to ensure protection and to ensure a regulated system of things which are happening already.

I turn now to the two orders arising under the Anti-terrorism, Crime and Security Act—that is, the Retention of Communications Data (Code of Practice) Order and the Retention of Communications Data (Extension of Initial Period) Order. I apologise for having to withdraw and relay the order originally laid on 11th September 2003. This was due to human error as the reference under Article 2 of the initial order for the code of practice did not precisely replicate the title of the code.

Part 11 of the 2001 Act allows for the publication of the code of practice for the voluntary retention of communications data by the communication service providers. It is not about the retention of the content of communications—it is not about the content of telephone calls and e-mails—but about the retention of related communications data such as telephone subscriber information, numbers dialled or addresses to which e-mails have been sent. It is, again, a vital tool in the investigation of terrorist incidents.

The purpose of the order is to bring into force the draft code of practice on the retention of communications data. The code relates to that information which is already kept by the communications service providers for their own business purposes. It does not require additional information to be stored. It sets out two matters: first, it identifies the kind of data that the Government would like to see retained by the communications service providers; secondly, it details the length of time for which they would like to see that data retained.

Terminologically, I should draw a distinction between "retention" and "preservation". "Data retention" means storage of everyone's communications data; "data preservation" relates to specific individuals—for example, those who are already under suspicion.

Past experience has shown that we are unlikely to know the identity of perpetrators of any attack at the time it takes place. Only painstaking investigative work after the event—which may depend upon identifying the communication trail of those who have committed such an outrage—will enable that to be done. The reason for the provision in the Act is the threat of terrorism. Regrettably, that threat is as clear and present today as it was when the Act was passed.

Sometimes this information may be the only piece of evidence that links a terrorist suspect to an attack. It may be available to identify any co-conspirator belonging to the same terrorist cell and ultimately it can provide clues as to how that cell links to others all over the world. There are many investigations in which the crucial steer for investigators has been communications data. I know that a number of issues have been raised about this—again, I will deal with them so far as they are raised by noble Lords.

Finally, the purpose of the Retention of Communications Data (Extension of Initial Period) Order is to extend the powers of the Secretary of State in Section 104 which would otherwise lapse on 14th December this year. It will extend those powers for a further two years. The powers in question allow the Secretary of State to give directions that he considers appropriate about the retention of communications data. Before using those powers, he must consult the communications service providers to whom it will apply.

The period of nearly two years between the passage of the Act and the presenting of the code to Parliament has been taken up with the consultative process required by the Act, but during that time the threat to the United Kingdom from terrorist activity has not diminished. This extension is necessary because by the time the voluntary code of practice has been in operation for three months and reviewed, the powers under Section 104 would have lapsed. It is essential that the Secretary of State should retain the ability to make such directions. I beg to move.

Moved, That the draft order laid before the House on 11th September be approved [28th Report from the Joint Committee].—(Lord Goldsmith. )

Noon

Baroness Blatch rose to move, as an amendment to the above Motion, to leave out all the words after "That" and insert "this House declines to approve the draft order laid before the House on 11th September".

The noble Baroness said: My Lords, I should like to take the opportunity to address all five orders and the associated amendments. I have to say that we regret that the retention orders have not been withdrawn and their inclusion on the Order Paper.

I thank the noble and learned Lord the Attorney-General for his speech, particularly as I believe he was posted in only last night to deal with these extremely complex orders.

These orders have had a chequered passage so far. The Home Office has not distinguished itself in the process. The parent Act for the amendments to the first three orders is, as Home Office officials and Ministers have admitted, flawed. Sadly, that means that many of our concerns that will be expressed during the course of this debate cannot properly be addressed without amendment of the primary Act. This is an issue which I hope the noble and learned Lord accepts requires urgent redress.

When these orders were produced last year, there was widespread concern about them—so much so, that the Secretary of State withdrew them. Unfortunately, when they were re-presented, they were hardly changed. When the Home Office was asked about this, officials replied that the time was used not to amend the orders but to improve the presentation of their case. Although some concerns have been allayed by the process of consultation, it still has to be recognised that the substance of the orders remains substantially unchanged from the text of a year ago, which earned the tag "snoopers charter".

The orders before us pose a huge dilemma. However, let me make one thing crystal clear right from the start. We do not underestimate the immense value of communications data in the fight against crime and terrorism. None of us on these Benches disputes that. Nor, in opposing these orders, are we seeking to obstruct or undermine the superb service that our agencies of law enforcement, especially the police, provide. Quite rightly, they have an expectation that they will be granted all appropriate means to safeguard our citizens.

We accept that some form of data retention should be part of their armoury, and we endorse the desirability, as expressed by law enforcement agencies, of having an effective system of data access in place as a matter of urgency. However, the Government's proposals in respect of data retention access justify what some have described as flawed legislation. That said, this House has a responsibility to ensure that what is enacted into law not only is fit for purpose but affords the ordinary citizen adequate protection—the more so, given the Human Rights Act.

I recognise that several problems are more relevant to primary legislation, aspects of which are to be found at the margins of these orders. We find the first order the least controversial. The arguments put during debate on these issues in another place, coupled with discussions I have had with the noble Viscount, Lord Colville of Culross, an Assistant Surveillance Commissioner, have eased my worries. However, could the noble and learned Lord provide the answer for the questions outstanding from another place which have yet to be answered? For example, can he comment on how the proposed regime in Ireland will differ from that in England, Wales and Scotland? Why was it that the powers given to the Northern Ireland Prison Service could not have been exercised through the Northern Ireland Police Service?

To comment generally on the communications data order and the directed surveillance order, I simply make the obvious point that the Joint Committee on Human Rights highlighted grave misgivings regarding the risk of, undermining the proportionality of the statutory scheme".

In particular, we are profoundly concerned about the disparity between the requested retention of data under the anti-terrorism legislation and the retention orders for national security, and the access of this data using Clause 22(2) of RIPA for other purposes.

Linked with this is the idea that Parliament really needs to make a judgment about whether the level within each public authority at which authorisations for data access are determined are, in fact, appropriate to take the decision regarding whether the necessity and proportionality of individual requests are compliant with the Human Rights Act 1998 and the Data Protection Act. For example, should a team member of the Environment Agency have power to access forms of communication data or a service manager at a county or district council? Just as a matter of interest, will the noble and learned Lord tell me what a service manager is? Could it be the head of catering services of an LEA? Could it be the head of refuse collection at a district council? There is no qualification or definition of these posts.

The communications data order specifically extends the list of public authorities which will have access to data under RIPA. These bodies are, according to the Home Office, already accessing data using other statutory powers. This raises two questions for consideration: first, those using previous legislation are apparently accessing communications data under the definition of "information". There is some question as to whether the use of "information" in the 48 different Acts used to collect data would have been designed with communications data in mind.

The oldest Act on the list was enacted in 1930. There is no way that in 1930 Parliament could have envisaged the mobile phone and Internet system that we have now. Therefore, there is a very real question about whether the Home Office is exceeding its legislative authority in applying an information rather than a communications data test to assess which public authorities should be included in the RIPA regime.

There is no provision to rescind any of the existing orders under RIPA when it comes into force. How crazy—the whole rationale for introducing this system was to replace the old, disparate system.

I understand but do not accept that other powers are tied up in the old laws so that they cannot be rescinded. The Home Office has made it perfectly clear to public authorities and communications service providers alike that RIPA is the only scheme to be used. Whatever the Home Secretary may say, as long as the legacy powers remain on the statute book, the Home Secretary has no power to prevent them being exercised legitimately and legally. That situation is unacceptable.

I support each of the amendments in the names of the noble Lord, Lord Lester, my noble friend Lord Northesk, and the noble Lord, Lord Phillips. They will speak in detail to their amendments, so I will be brief in my comments on them.

The noble Lord, Lord Lester, is rightly concerned about the interaction and tension between the working of the RIPA scheme and other statutes, particularly focusing on personal privacy.

In his amendment, my noble friend Lord Northesk addresses a real anomaly. If the new RIPA system is designed to be inclusive and bring in all the disparate bodies under one regulatory umbrella, it makes no sense whatever to leave on the outside the Department for Work and Pensions or the Northern Ireland social security office. Even, as my noble friend will argue, notwithstanding the Social Security Fraud Act 2001, nothing that the Home Office has said convinces me about the rationale of that anomaly.

The noble Lord, Lord Phillips, has raised an extremely important point—that a person could be adversely affected by the wilful and/or reckless abuse of the system. That issue requires remedy along the lines of the noble Lord's amendment.

The issue of oversight of the system is particularly crucial, and the Interception Commissioner has been particularly silent on his methods of oversight. That is yet another flaw to which the Home Office has admitted, arguing that it cannot pre-empt what the commissioner might want or need to fulfil his role with regards to RIPA. Yet we, in this House, are being asked to agree legislation without knowing what proper safeguards are in place.

Some of us heard at a gathering last week that there is little communication between the various commissioners who will have oversight of the RIPA scheme. Will the noble and learned Lord tell me what is being done to improve collaborative working between the different oversight bodies? I take it from what he has already said that there is an absolute commitment that the office of the Interception Commissioner and all oversight policing of the activities that we are discussing will be adequately funded to do a thoroughly effective job.

My amendments focus on the international dimension in the communications data order. This is a non-fatal amendment, as can be seen, exhorting the Government to consider an area linked to these issues, which I and various NGOs consider to have been sorely neglected. Much of the debate to date has focused on the necessary grounds listed under Section 22(2) of RIPA, under which data can be accessed, and the list of UK authorities which would be able to use RIPA to access communications data.

However, there are significant international dimensions to the policies, not least due to the disparity already mentioned between the ability to retain data for one purpose under the anti-terrorism order and the ability to access that data under RIPA for other purposes. The potential for overseas countries to access communications data via RIPA comes from both UK legislation and a range of international treaties. Part 1, chapter 1, Section 5 of RIPA allows, under a mutual assistance agreement, for the disclosure of interception and communications data, which may also be used for intelligence purposes.

I understand that under the EU Mutual Legal Assistance Convention, retained data will be shared across member states. That was decided originally on the grounds of international co-operation, since when there has been an EU/US international co-operation agreement, which allows for the sharing of communications data across the Atlantic. The recent Council of Europe Convention on Cybercrime also allows for mutual law enforcement assistance between nations. So far, 37 countries have signed the treaty, including ex-communist countries. Countries such as Armenia, Greece, Lithuania, Turkey, Estonia and Croatia have signed it. So, a Greek police officer could gain access to my communications data for whatever purpose he or she thinks fit. What safeguards are there in the Greek system to ensure that their requests are necessary and proportionate? What are the oversight safeguards in Croatia?

What authority do our public authorities have to assess any requests that they might channel on behalf of a foreign country? How are those making the requests identified? It has been suggested that a private investigator from, say, France or Turkey could make a request. Surely, that could break the necessity and proportionality conditions that the Government are so keen to impose. Even more chilling, can we be guaranteed that countries such as Zimbabwe would be denied access to communications data when their protection schemes leave much to be desired?

To my mind, it would be an international breach of Article 8 of the ECHR in respect of all 56 million citizens in the United Kingdom, an opinion supported in recent months and years by various sources. Groups such as Privacy International and the Foundation for Information Policy Research argue that the minimal standard of evidence and authentication required for the transfers could create dangers for many people in the United Kingdom. The current conditions for sharing communications data are such that the transfer does not require the condition of dual criminality, and the grounds for the refusal to disclose are very limited.

Second to the USA, the UK is the most likely candidate to receive communications data requests from countries with which we have mutual legal assistance treaties. Therefore, the situation portrayed is one in which the current orders and the implementation of data retention would make communications data regarding UK citizens available to governments around the world, with little oversight or control. Data may be made available without regard to dual criminality, which may in turn be kept by foreign authorities as they see fit, and without guarantee that their data protection regime is sufficiently robust.

The Home Office has predicated the composition of the list of authorised bodies on equivalence between information and communications data. In pursuing that logically, any countries with which the UK has a tax treaty, in so far as those treaties contain information-gathering provisions, could have access to communications data about individuals within the UK. If the Minister argues that there is no difference between information and communications data, the Home Office cannot have it both ways. On one hand, it says that the reason why the legacy powers cannot be easily rescinded is because information-gathering involves more than merely access to communications data. However, the concern exists that some countries around the world could adopt the same logic and thereby gain access to communications data on any United Kingdom citizen.

I want to preface my comments on the data retention orders, for the avoidance of doubt and in order not to be misunderstood, by repeating that we agree with the need for a scheme that is properly regulated, as a tool against the fight against crime and terrorism. I also repeat that it should be introduced in a way to protect, that the legislation should be fit for purpose, and that safeguards protecting the British public should not be ignored. As the legislation stands, I am far from convinced that the Home Office has achieved that.

One can only say that the passage of the retention orders has been a chequered one. The code of practice order in particular has been chaotic. There is some doubt as to whether the order that has been published is consistent with the parent Act, Sections 102 and 103. Some of my colleagues believe that the code should have been laid before the order, but I leave that aside, as I do not believe it to be a very strong point to raise at this stage.

There has also been confusion about the availability of the code in the Printed Paper Office. We have been asking for it and were told that it was not there. Yesterday, it was there, and this morning we have been told that it has been there since 18th September. I simply say that that has caused very real confusion for those of us working on the orders.

The laying and relaying of the order has not helped. However—

12.15 p.m.

Lord Goldsmith

My Lords, given that the noble Baroness raised the question of the availability of the code, I should put it on record that the House authorities have made inquiries and are satisfied that the code was provided to the Printed Paper Office on 1lth September, and has been available ever since.

Baroness Blatch

My Lords, the information that we had this morning was that it had been available since 18th September, but that does not alter the fact that those of us who asked for it have not received it.

The most extraordinary point that I want to raise relates to a Written Question put down by my noble friend Lord Skelmersdale, which was answered on 5th November, one week ago. The Question was as follows: Which orders give directions about retention of communications data under the Anti-terrorism, Crime and Security Act 2001; and on what dates such orders were made [HL5107]". The Answer given by the noble Baroness, Lady Scotland, was: No orders giving such directions have been laid".—[Official Report, 5/11/03; col. WA 111] That Answer came one week ago.

Even the Joint Committee on Human Rights, in its latest report, has argued that after a draft of the code has been laid and approved by resolution of each House of Parliament, the Secretary of State should bring the code into force by statutory instrument. As we all know, the code, unlike the order, is not subject to the parliamentary approval of both Houses.

Due to the emergency nature of the anti-terrorism Act itself, the parent Act, there has been insufficient discussion in both Houses. There was no discussion whatever in the House of Commons about the issue of retention. There was, fortunately, some discussion in this House, but there was not enough.

I turn, finally, to the orders dealing with retention. It would be wholly wrong to ratchet up the powers granted to law enforcement and government without ensuring that a correct balance is struck between those powers and individual rights. We have palpable concern that the proposals for data retention fail this test, as the Joint Committee on Human Rights said. It observed that it was not able to say that it was satisfied that the arrangements in the draft code would be proportionate to legitimate objectives. That should, and does, set alarm bells ringing as to whether it is right to pass these orders into law.

Contemplating the Retention of Communications Data (Extension of Initial Period) Order 2003, it is worth reminding ourselves of the thinking that underpinned the House's scrutiny of Part 11 of the Anti-terrorism, Crime and Security Act 2001. The Government's proposals for data retention were deemed a legitimate and appropriate response to the emergency situation. However, and evidently this is acceded to by the Government, it was also added that, because of the threat to civil liberties and individual rights posed by the proposals, it was appropriate to make any mandatory scheme specifically subject to a sunset clause. In fact, the presumption at the time, and certainly the impression conveyed by Ministers, was that not only could a voluntary scheme be put in place relatively quickly, but also that there were no reasons to move a mandatory scheme.

During your Lordships' scrutiny of Part 11 of the Act, the noble Lord, Lord Phillips of Sudbury, in particular sought to persuade the Government to recognise how muddled that approach was, not least because of the likely futility of a voluntary scheme and the absence of any proper linkage back to the Regulation of Investigatory Powers Act, the Data Protection Act and the Human Rights Act—a matter with which the noble Lord, Lord Lester, will no doubt deal in speaking to his amendment. For whatever reason, those warnings went unheeded. It cannot be denied that there is a serious tension between the passage of these orders and other statutes.

We are now nearly two years on and, contrary to expectation, the Home Office has so far been unable to initiate the voluntary scheme. Indeed, far from showing any sense of urgency, it could be said that they have been somewhat lackadaisical in their efforts to implement one. In these circumstances, we feel that it is inappropriate that the will of Parliament as expressed in the sunset clause—and I repeat that the Government have also acceded to this point—should be subverted for the convenience of the Home Office, the more so because it has demonstrated such a casual attitude. At the heart of this is the sense that, if data retention is so important and so urgent, two years should have been more than enough time to implement a voluntary scheme in the first instance. In effect, by accepting this order, we are circumventing the very purpose for which this House put the sunset clause on the face of the legislation. That strikes me as ludicrous.

I turn to the Retention of Communications Data (Code of Practice) Order. I have already suggested that a voluntary scheme for data retention is doomed to failure. In fact, I suspect that the Government have come to the same conclusion—that was more than hinted at in our meetings with officials. Bluntly, it is unsettling to realise that in all sorts of ways, the Home Office is only going through the motions of attempting to establish the voluntary scheme because it is the only route to what, despite protestations and commitments to the contrary, it has decided it wants all along— namely, a mandatory scheme.

However, be that as it may, it is generally recognised that very few, if any, communications service providers will sign up to a voluntary scheme. The reasons are obvious. The proposals are fraught with legal uncertainty, a matter with which, as I say, the noble Lord, Lord Lester, will no doubt deal in due course. There are myriad issues here, including potential breaches of Article 8 of the ECHR and so on. However, I shall confine myself to what I understand to be the nub of the issue.

Communications service providers will be legally required to retain data under the code of practice in breach of the provisions of the Data Protection Act. It is unreasonable to suppose that a CSP should be required to expose itself to that sort of liability. What flows naturally from that is that it is inconceivable that the voluntary scheme in the code of practice can be effective.

For avoidance of doubt, I repeat that we on these Benches are well seized of the significance and importance of data retention in the fight against crime and terrorism. We would welcome the opportunity to make common cause with the Government in implementing a scheme that is fit for the purpose and that strikes the right balance between the needs of the state and the rights of the citizen. Part 11 of the Anti-terrorism, Crime and Security Act and these orders are not such a scheme. It is in the gift of the Government to introduce a new Bill in the next Session to deal with this matter properly and sensibly. We would welcome that and we would give it all possible co-operation. In such circumstances, I can offer the Minister a guarantee. If such a Bill were to come forward, we would work tirelessly with the Government to ensure its enactment at the earliest opportunity.

I have covered many issues of real concern. There will be more elaboration by other noble Lords during our debate. My plea is to invite the noble and learned Lord to accept that there is real desire on our part to arrive at an effective, deliverable scheme with proper safeguards for the British people. I beg to move.

Moved, as an amendment to the above Motion, to leave out all the words after "That" and insert "this House declines to approve the draft order laid before the House on 11th September".—(Baroness Blatch.)

Lord Richard

My Lords—

The Deputy Speaker (Lord Elton)

My Lords, the original Question was that the draft order laid before the House on 1lth September be approved, since when an amendment has been moved, to leave out all the words after "That" and insert the words, "this House declines to approve the draft Order laid before the House on 11th September". The Question I now have to put is that this amendment be agreed to.

Lord Richard

My Lords, I was trying to ask the noble Baroness a question before she sat down. Perhaps I can at least metaphorically ask her a question before she sits down. I should start by apologising for having missed the first two or three minutes of her speech.

Do I take it from what the noble Baroness has said this morning that the Front Bench of the Official Opposition are moving a fatal Motion on a statutory instrument? She will know, as I do—I have good cause to know—that throughout the whole period when we were in opposition we did not move a fatal amendment. We certainly did not vote on a fatal amendment. Indeed, there was a practice, verging on a convention of this House, that statutory instruments were not voted on in a fatal way. The only example I can think of in recent years, I suppose, involved the Rhodesia order in the mid-1960s.

If the noble Baroness will be kind enough to address herself to that question, I would be greatly obliged. Is it now the policy of the Official Opposition to move fatal amendments to statutory instruments in this House?

Lord Smith of Clifton

My Lords, I should like to ask the noble and learned Lord the Attorney-General a question on the intrusive surveillance order. Is there expected to be any provision by which the Northern Ireland Assembly will be able to monitor the activities of the Prison Service?

The Earl of Northesk

My Lords, I rise to speak to the amendment in my name on the Order Paper.

There is no doubt that communications data can be of immense help in the fight against terrorism and crime. None of us would disagree with that. Moreover, I readily accept that law enforcement agencies believe delivery of powers to retain and access data to be a matter of urgency. Equally, I am entirely happy to state my support for the underlying principle of the RIPA orders; namely, that activity which has thus far been unregulated should be regulated under a single— I repeat, single—procedure. Notwithstanding my support for those general principles, the devil is in the detail, as usual. Happily, the eloquent contribution of my noble friend Lady Blatch has covered many of the points of concern. It would be invidious for me to repeat her arguments. I merely say for the record that I wholeheartedly support and endorse her comments. That said, there are a few additional points that I believe are relevant.

There is a perception that the subject matter of all five of these orders is the exclusive province of "anoraks", or "geeks" or "techies". It is true that it would be quite easy to fall into the trap of mouthing incomprehensible techno-babble in speaking to them. However, I shall try to avoid that. Rather I think it useful to attempt to measure them against a statement of general principle. One that I have in mind is the following: Any limitations on individual freedom must be proportionate to the threat; they must be sanctioned by law and cannot take place on an ad hoc basis; and they must be implemented in a way which ensures that there are safeguards and that the activities of the executive are subject to monitoring, scrutiny and accountability".— [Official Report, 26/3/03; col. 852.] Those are fine words, but they are certainly not mine. They are those of the noble and learned Lord the Lord Chancellor in March of this year in his then incarnation as a Home Office Minister. I think we can therefore safely assume that they are a fair representation of the Government's view.

Evidently these orders represent a "limitation on individual freedom". The Joint Committee on Human Rights has highlighted the fact that data retention and access raise, very important issues relating to the rights to respect for private life and for correspondence". That being so, I fear that, as a generality, the orders do not stand up to the general statement of principle of the noble and learned Lord the Lord Chancellor. I quote again from the Joint Committee's report on the data retention orders: It is [therefore] particularly important to establish the necessity for and proportionality of standard retention of all communications data. However, we have insufficient information which would enable us to satisfy ourselves that those requirements are met". Evidently there is doubt that the Government's proposals for data retention are "proportionate to the threat".

It is appropriate here for me to turn to the amendment in my name on the Order Paper. It is, of course, the case that in respect of the RIPA orders the Home Office is seeking to establish a single procedure for regulation of surveillance activity that is ECHR compliant. As I say, I adjudge that to be both welcome and desirable. However, because it has separate legislative provision under the Social Security Fraud Act 2001, the Department for Work and Pensions and the Northern Ireland social security investigators, in so far as they need access to communications data in their investigations, have elected to exclude themselves from the regime. To my mind that is nonsense. Either we have a single procedure with all—I stress "all"— appropriate public authorities bound by it, or we do not. Leaving the Department for Work and Pensions outside the regime wholly undermines the premise upon which this Home Office policy is based.

There is the additional problem here already mentioned by the noble and learned Lord the Attorney-General and by my noble friend Lady Blatch. In determining which public authorities should be included on the face of the communications data order, the Home Office has assumed that there is equivalence between information and communications data. The justification for inclusion of the authorities listed is that they have all been granted "information gathering" powers in previous legislation. Yet, as my noble friend observed, there are no plans to repeal or rescind any of the "legacy legislation" powers because, so the Home Office argues, information is a different commodity from communications data. The simple fact that the Department for Work and Pensions is outside the RIPA regime and a host of unregulated information-gathering powers remain in statute—again outside the RIPA regime—cannot mean anything other than that an ad hoc approach is being adopted to the whole issue.

I need not dwell on the issue of whether adequate safeguards are in place to protect individual rights. The noble Lord, Lord Lester of Herne Hill, will no doubt cover that ground much more adequately and with far more expertise and eloquence than I. However, I would just make one small point. It is important to realise that, by definition and of necessity, data access under the existing communications data proposals would be to all intents and purposes covert in character. Data subjects, individual citizens, can have no way of knowing whether or not their data have been accessed or for what purpose. That must be wrong. As I understand it, knowledge of this by an individual is a specific right granted by provisions in the Data Protection Act. To this extent the safeguards for the individual citizen are less robust than they should be.

There are considerable problems too with "monitoring, scrutiny and accountability" of both the retention and access regimes. I acknowledge that this is probably not relevant per se to the orders. Nevertheless it is important to understand the context in which the respective regimes will operate. It has been estimated that the Office of the Interception Commissioner will have oversight of more than a million surveillance requests per year, although I suspect that the Home Office considers that that figure is rather overstated. Whatever the true figure, even when properly resourced, it is unlikely that the office will be able to examine more than a fraction of the total requests made. It should be noted too that the Information Commissioner has already reported "significant" and "unacceptably high" numbers of errors in RIPA Part 1, Chapter I interception warrants. The Home Office, and, indeed, the noble and learned Lord the Attorney-General, may wish to parade the success rate of the interception of communications and investigatory powers tribunals as testimony of the robustness of this element of the oversight regime. However, for the convenience of the noble and learned Lord I confirm that of the 470 cases considered by them between 1996 and 2003, none was adjudicated in favour of the complainant.

As Dr Chris Pounder has observed—in contrast to the Attorney-General's view— This 100% 'perfection', like 100% support for Saddam Hussein in the recent 'presidential election' in Iraq, is simply not credible". From a broader perspective he adds: The oversight system is fragmented, overlaps and is riddled with competing bodies". In effect there is a justifiable case for arguing that "monitoring, scrutiny and accountability" of the oversight regime is less than adequate.

I turn to a matter of which I have given the Government advance notice—the status of the orders in respect of the technical standards and regulations directives. I am extremely grateful to the noble Baroness, Lady Scotland, for the promptness of her written reply to me on that yesterday. None the less I think that it would be helpful if the noble and learned Lord the Attorney-General could state the position for the record.

My antipathy towards data retention as encapsulated in Part 11 of the Anti-terrorism, Crime and Security Act is well known. I stand by the remarks that I made at that Bill's Second Reading; namely, that the provisions fail four essential tests: those of effectiveness, necessity, proportionality and consequence. I need not rehearse those arguments here. They are a matter of record. Quite apart from that, as my noble friend Lady Blatch has already said, the implementation of the Government's voluntary scheme is an exercise in futility. It will be wholly ineffective if only because there is every prospect that very few, if any, CSPs will sign up to it. Nor should we lose sight of the fact that a form of data retention is already permitted under extant statute. As the Explanatory Notes to the Anti-terrorism, Crime and Security Bill stated: Whilst the Regulations permit the retention of communications data on national security and crime prevention grounds there is currently no general guidance given as to when these might apply". To my perception the Government could more usefully have turned their attention to determining appropriate general guidance for the exercise of those extant powers rather than getting bogged down by their ill fated attempts to make credible sense of Part 11 of the Act. I have pursued this issue on a number of occasions and have yet to receive an adequate reply. So, can the noble and learned Lord now confirm that powers for data retention already exist, irrespective of the status of Part 11? Can he also confirm that, in so far as such powers do exist, they were exercised in the wake of the September 11th atrocity? Can he shed some light on the period of time for which these powers were granted, indeed, whether or not even now they are still being actively exercised in the interests of national security and criminal investigation? Can he indicate whether the exercise of retention powers has led directly to any arrests?

I have a host of other issues and concerns—the blurring of the data categories on the face of RIPA, the single point of contact arrangements, the absence of appropriate sanctions against abuse of the access regime, and so on. However, time is short and in the circumstances I refer to them only in passing. In sum, I have deep misgivings as to the wisdom of enacting the communications data order and the two data retention orders irrespective of whether they are amended. I ask myself a simple question; should flawed law be entrenched?

12.45 p.m.

Lord Lester of Herne Hill

My Lords, I should like to speak to the two amendments in my name to the communications data order and the code of practice order. I am very pleased that the Official Opposition, led by the noble Baroness, Lady Blatch, and the noble Earl, Lord Northesk, have supported the principles underlying my amendments.

I am sorry that the noble Lord, Lord Richard, is not in his place when I say that my amendments are not fatal. I would not have dreamed of tabling fatal amendments unless the clock had stopped at 13 and we really were in George Orwell's world of Nineteen Eighty-Four. In those circumstances, I would have done, but I did not. My amendments are designed to send back the orders, to have them returned to us in a form that gives adequate respect to personal privacy.

It is very agreeable to be able to say that I am particularly glad that the noble and learned Lord the Attorney-General introduced the debate, not only because he and I are old and good friends, but because we were colleagues on the Joint Committee on Human Rights. I have no doubt about his personal commitment to human rights as Attorney-General, and it is very good that he should be dealing with the subject today.

As a member of that committee, I pay tribute to its chair, the right honourable Jean Corston MP. Although she is also chair of the Parliamentary Labour Party, she and my colleagues have always performed their jobs on the committee with conspicuous independence. We do not play politics, as I am sure that the noble Baroness, Lady Whitaker, who is a member of the committee, would confirm.

I said that the clock had not stopped at 13, as it did at the beginning of George Orwell's Nineteen Eighty-Four, but the debate raises very important issues about the right to personal privacy and the principles of legal certainty and proportionality to which the noble and learned Lord the Attorney-General referred. No one other than him has yet said something that I recognise; namely, that such orders are necessary to meet one important principle of the convention, that of legal certainty. That is to say that there has to be lawful authority for the kind of invasions of personal privacy that would otherwise not be regulated by law. Therefore, if one is to have a regime of this sort at all, such orders are certainly necessary. As the noble and learned Lord recognises, that leaves over the key issues of proportionality.

The House has the benefit of two reports that had not been before the other place when it debated the matter. The first is that of the Joint Committee on Human Rights of 10th November, and the second is that of the Joint Committee on Statutory Instruments of 12th November, although the subject matter of that came earlier. When the matter was debated by the Third Standing Committee on Delegated Legislation on 4th November, it was made clear that several Members of the other place wished to have the report of the Joint Committee on Human Rights before them before they approved the orders. However, they did not have that benefit.

That is why it is important in this House to give careful attention to what the Human Rights Committee said. Although reference has been made to part of the report, I would like to focus on the main issues, if I may without boring the House to death, so that the House fully understands the context. I was not present at the meeting that finalised the report on Monday, but I was present before that, and I respectfully agree with what my colleagues put in the report.

There are four main important issues. The first issue dealt with in the report was that: The communications providers which retain the communications data are nearly always likely to be private businesses rather than public officials. If they are not 'public authorities' for the purposes of the Human Rights Act 1998, they are not directly subject to the legal obligation imposed by section 6 of that Act to act compatibly with Convention rights". The committee was concerned, because it is, unclear how the Draft Code would ensure that the state can discharge its obligations under ECHR Article 8 in relation to the retention and storage of the data". The second important issue is that: It is not clear how the Draft Code's standard periods of retention would meet the requirement of proportionality", in accordance with Article 8. The third issue is that: The availability of the communications data to agencies for purposes other than the protection of national security would call in question the legitimacy of the aim for which the data are to be retained, the necessity for that retention and its proportionality, all of which are elements", required by our convention rights.

The fourth and final issue is that: It is not clear how thoroughly the consultation exercise required by section 103 of the Anti-terrorism, Crime and Security Act 2001 was carried out and how far the frui:s of it have been taken into account in the Draft Code". I shall go back to the first issue, which is about the fact that the communications providers are mainly private and not public, and therefore not subject to direct liability under the Human Rights Act.

We asked the Government, whether it considered that service providers holding information for the purposes of the Anti-terrorism, Crime and Security Act 2001 were to be regarded as functional public authorities for the purposes of the Human Rights Act 1998. The Home Secretary told us that the Government takes the view that the retention of communications data by communications providers is 'a private function that arises out of the commercial service that the communication services providers provide"'. We pointed out that that had "the disadvantage"—it is a serious one—that, the communications providers are not public authorities for that purpose and are not bound by… section 6 of the Human Rights Act". We then pointed out that that makes it absolutely vital to ensure that other safeguards can deal with the problem that the communications providers are not public authorities yet can exercise the powers given to them under the orders. That is a real problem that the House needs to consider.

The more substantial matter is that of: Across-the-board standard retention periods for communications data in various categories". As the House will know, in: Paragraphs 7 and 8 of the Draft Code … the Secretary of State considers it to be necessary for the purpose of national security for service providers to retain communications data for the periods set out in Appendix A to the Draft Code … This would not deal with the position under ECHR … and the Human Rights Act 1998. If a service provider is a functional public authority when retaining data for national security purposes, it would have to show both that the retention is necessary (… to a pressing social need) and proportionate … We therefore asked the Government why it considers that it would be proportionate to retain communications data by reference to across-the-board standard periods of time, without reference to the identity of the user of the service or the circumstances in which the communications took place". We expressed the view that whether or not the service provider is a functional public authority, the state has an obligation under the convention to take positive steps to safeguard the service user's right to respect for private life and correspondence. I would be grateful if the noble and learned Lord the Attorney-General would confirm that it is the Government's view that they do have a policy of obligation, under Articles 1 and 8 of the convention, in that respect.

We also asked the Government whether, and if so why, they consider that a code that does not mention the requirement of proportionality would discharge the UK's international obligations. In paragraph 18 of our report, we give the Government's response. Although the following point has been partly quoted, I want to emphasise it because it illustrates the importance of our debate and the view taken by this House. We noted that the provisions had not been debated in another place at all and that after receiving evidence from the Home Office, we had not been able to establish for ourselves how pressing is the need or how often the police and the security and intelligence services find it necessary to make use of such data or are significantly hampered by their absence. We stated: Those matters seem to us to be relevant to the assessment, to be made by each House, of the necessity for the retention which would be sought by the Draft Code, and of the proportionality of the periods set for retention". Having raised the issue clearly in our report, we hope that the noble and learned Lord the Attorney-General will give more than a blanket or general reply to our dilemma in paragraph 19 of the report. It is important that he satisfies the House on those matters.

We dealt thirdly with the equally important matter of the transfer of data from the terrorist context to other contexts, because of the interaction of the two statutes. We pointed out that the draft order would greatly extend the range of bodies by whom the data could be obtained and how they could be disclosed. The Home Secretary told us the Government do not intend to take any legal or technological measure to restrict the use of the data for national security purposes, because it is their view that if the data are available, they should be accessible to other public authorities for other purposes.

After considering the matter, we recognised that there may be cases not involving national security where it is necessary, as the noble and learned Lord the Attorney-General has submitted, that there should be access to that data; for example, for the investigation of a murder. We pointed out in the report that, we do not consider the relationship between the powers under the two Acts is as straightforward as the Government suggests". Your Lordships can read that in paragraph 24 of the report.

The report goes on to state: It seems to us that the main safeguard against abuse of the power to access for non-national-security purposes communications data retained under the 2001 Act is the fact that any access will have to be authorised or required by a designated person in a public authority empowered to access such data by the 2000 Act. The designated person will be a public authority, bound by the Human Rights Act 1998". I am sure that the noble and learned Lord the Attorney-General was gratified to read that: On balance, we were prepared to accept the Government's view that, as a matter of policy, it should be possible to have access to any communications which are available and are relevant to a case if those conditions are satisfied on the facts of a particular case". We came to the conclusion that the safeguards already mentioned, plus the availability of judicial review of a notice or authorisation and the need to comply with the data protection legislation, are capable of being proportionate. I would be grateful if the noble and learned Lord the Attorney-General could tell the House exactly how the judicial review would provide an effective remedy in the sensitive context that we are discussing.

Lord Goldsmith

My Lords, the noble Lord quoted the conclusion from the Joint Committee's report. Would he agree that while it expressed the view that the safeguards are capable of being adequate, the conclusion of the committee was that, "on balance", it was "satisfied" that those safeguards, are likely to provide adequate safeguards for Convention rights"? I am reading from paragraph 32 of the committee's conclusion. It is an important point.

Lord Lester of Herne Hill

My Lords, I was reading from paragraph 25. In that paragraph, we reported in the way in which I have just described. In paragraph 32, we reported in the way in which the noble and learned Lord the Attorney-General has quoted. I regard that as confirmation that, on balance, the requirement of proportionality would be satisfied, but perhaps I may ask the noble and learned Lord the Attorney-General exactly how he believes that the availability of judicial review could provide an effective safeguard. That is obviously important to this House.

I shall not detain the House much further on consultation. I shall not repeat the views that were expressed so eloquently by the noble Baroness, Lady Blatch, but in paragraph 30 of the report, we made an observation on the parliamentary procedure and stated: The total sitting period allowed for consideration of these proposals… amounts to about five weeks. In our view, this is not sufficient in view of the importance of the measures, their potential to affect human rights, and the long period of gestation of the proposals since December 2001". The Joint Select Committee on Statutory Instruments was also concerned about that. The Government are therefore confronted by two watchdog bodies, neither of which has been satisfied by the manner in which the consultation on matters of such great importance to the citizen has been handled. I would be grateful if the noble and learned Lord the Attorney-General would express at least some regret on behalf of the Government at the way in which the matter has been handled. The other place has not been allowed to consider the proposals properly and it now requires us to do so in a hurry, not in terms of the length of the debate, but of the length of the consultation.

Lord Phillips of Sudbury

My Lords, I want to speak to the amendment standing in my name, which would amend in a non-fatal way the orders before us; in particular, the Regulation of Investigatory Powers (Communications Data) Order 2003. We are not staging in any sense a contest about who has the best civil libertarian credentials. Our debate might well have taken place during the course of the RIPA legislation itself. However, as the noble and learned Lord the Attorney-General has rightly said, and others have reflected, I not aware of any measure during my five years in this House where your Lordships' House has been so at sea for so much of the time. The issues with which we are contending are arcane, complicated and interlocking, and one of the dangers in such circumstances is that the politics of the issue does not reach the wider public. If ever a measure affected the wider public—not in thousands, but in millions, because the communications data of millions will be accessed under the order—this is it. However, as I have said, it is not a contest, but rather a challenge to try, even at the eleventh hour, to improve an order that everybody believes needs to be improved.

It would be cynical and irresponsible for us to pretend that we protect the citizen against abuse of his communications data while denying the selfsame citizen the information without which he cannot protect his personal data, because he will not know that an abuse and a breach has taken place. That is most vividly demonstrated by the whole tribunal mechanism to which the noble and learned Lord the Attorney-General referred in his opening remarks. The tribunal exists to protect aggrieved citizens. Section 65(4) of the Act states: The Tribunal is the appropriate forum for any complaint if it is a complaint by a person who is aggrieved by any conduct falling within"— and so forth. I suggest that it is a farce to have that section and the others alongside it if there is no means of the citizen knowing of the abuse. Judge Brandeis of the Supreme Court said: Experience should teach us to be most on guard to protect liberty when the Government's purposes are beneficent". And that they are beneficent there is no doubt. We support the broad thrust of the legislation in the orders, but this is a challenge to our ability.

While thanking Home Office officials for the help they have tried to give to those of us who are bemused by these orders, I remind the House that the Home Office has form when it comes to legislation of this kind. Perhaps I may take noble Lords' minds back to the Anti-terrorism, Crime and Security Act 2001. In my view, and in the view of many Members of this House, it was not proper, correct or right that on the back of emergency anti-terrorism legislation the Government should sweep up many petty offences which had nothing whatever to do with terrorism—

Noble Lords

Hear, hear!

1 p.m.

Lord Phillips of Sudbury

My Lords, if there is a touch of extra caution, that must be excused. In any event, we must be jealous and vigilant when liberties are at stake, particularly when seeing the libertarian woods for the bureaucratic and state trees is hugely difficult, as it is here.

Let me come to the point. What are the protections for a citizen whose communications data rights have been abused? First, the communications data definition in the RIPA is not at all clear. That is an impediment to the huge number of officials who under the order will have the right and duty to seek authorisation to tap into the communications data concerned.

Secondly, the Attorney-General repeats the mantra of proportionality. That is all very well because lawyers, particularly the able, senior lawyers such as himself and my noble friend Lord Lester, live by proportionality— they wake up breathing proportionality. However, the officials who will have to deal with this legislation are not chief constables and the like; they are middle-ranking civil servants. In the Charity Commission, their rank is PB5, if that means anything to your Lordships. That is a middle-ranking civil servant. It is totally excessive for the Government to place such huge reliance on this rubbery word that only expensive lawyers can understand—and even they cannot because they have to go to the House of Lords to have it decided.

Furthermore, the severe drawback in the regime on communications data compared with any other part of the RIPA is that there is no pre-event check on a decision made by a middle-ranking civil servant to seek authorisation. Under any other part of the Act, it is necessary to go to the Secretary of State for an interception warrant. That is a massive protection of the citizen because the Secretary of State will be extremely cautious and judicious in the way he exercises the power. Above all, if there is no second check, the matter is left solely in the hands of the official who is personally involved in wanting the information, and who may have an excessive zeal in relation to his actions. That is not good enough.

I have referred to the fact that without information, the tribunal protection which exists in the RIPA is useless. Furthermore, the Interceptions of Communications Commissioner has no duty to tell a citizen when his or her information has been purloined or otherwise abused. I am afraid to say that I take no solace from the point made by the noble and learned Lord the Attorney-General in his opening remarks that under Section 58(2)(a) he will be required to report to the Prime Minister. We achieved that change to the Bill. The duty report is in respect of contraventions of the provisions of the Act. That refers to the many criminal offences that are available as a protection for the citizen in all other parts of the Act except this. In Chapter 2 of Part 1 of the RIPA legislation there is no criminal offence. Therefore, I do not believe that there will be a duty to report to the Prime Minister because I do not believe that there will be contraventions within the technical meaning of that word.

Even if I am wrong on that, what solace to the citizen? The matter goes to the Prime Minister, but he has no duty to do anything in regard to it. There is a duty to report and the report is laid before Parliament. Jolly good, but there is no warrant in the legislation to name names in the report. The most recent report of the Interception of Communications Commissioner for 2002 is extraordinarily cautious in its detail. For example, at paragraph 34 he states: I can only provide the information on the total number of complaints made to the tribunal". Nothing more. One assumes that the Interception Commissioner has a great body of people charging around the country seeing that nothing amiss is occurring. I have to tell the House that the staff available to the commissioner is not remotely sufficient to do that. At paragraph 7 of his recent report, he talks of his twice yearly visits to various bodies, which he names. He then states: '"I then select, largely at random … a sample of warrants for close inspection". Fair enough, but how big is the sample? And what about the majority—I suggest the vast majority—of matters which are not investigated at all? This is the only protection for the citizen against this massive extension of state surveillance. And it is a massive extension. We are not talking about 10,000, 20,000 or 50,000 because estimates from the industry are between 1 million and 1.5 million authorisations a year. I put it to the House that that is not good enough.

We then come to the question of whether the interception of communications data is important. There was a hint that it was pretty minor beer compared with interception, direct surveillance, covert human surveillance and so forth. I suppose in the sense that it does not go to the contents, that is a fair point. However, sometimes what is not said is more important than what is and often actions are more important than communications. Communications data include who, when, where and how any of us communicates at any time with any other person by any technological means. I am told by people in the industry that an extremely sensitive profile can be built up of any of us who uses any of those instruments frequently. There can be built up an extremely sensitive profile of our life patterns, our contacts, where we go and when we go—not why we go, but the "why" can be built up out of a great deal of data. The Rio Ferdinand case gave one a slight hint of the kind of thing that can occur.

Therefore, the reason for putting forward the amendment—I am grateful for the support of others who have spoken and I, in my turn, extend my support for their amending resolutions—is that there are simply not sufficient and adequate protections in place for the so-called "ordinary" citizen.

I extend to the noble and learned Lord the Attorney-General my deep sympathy for the fact that he is sitting where he is today. I would extend it to him even if he had had three years to prepare for the occasion. However, when he comes to respond, I should be grateful if he could say whether or not the Government would be minded to make a wilful or reckless abuse of the communications data chapter the subject of an offence. The same protection might be afforded as under the Data Protection Act, which, incidentally, provides all the protections that do not occur in relation to personal data. The protection would be that there would not be a prosecution without the consent of the Interception of Communications Commissioner or the Director of Public Prosecutions.

Lord Jenkin of Roding

My Lords, my noble friend Lady Blatch delivered what I can describe only as a devastating attack on the way that this whole matter has been handled by the Home Office. I have every sympathy with the plea that she has made for the Government to take away these orders and think again. We have heard other attacks. My noble friend Lord Northesk and the noble Lord, Lord Phillips of Sudbury, have very much reinforced that case.

I ask only one question and, in a sense, I ask it of my noble friend Lady Blatch. I do so on behalf of the local authorities. I declare an interest in that I am a vice-president of the Local Government Association and a joint president of the Association of London Government.

Local authorities make regular use of the powers to intercept—in particular, with the communications data and the directed surveillance and covert human intelligence sources—frequently to detect and so prosecute serious fraud, which they are under a duty to do in order to protect local communities and local families. However, if the orders are now withdrawn, as has been sought, or if they are voted down—the noble Lord, Lord Richard, made the point that this is a somewhat unusual procedure—will local authorities continue to have the powers which they currently use?

Can I also be assured that there would be no lacuna between the powers being defeated today and the point at which the orders are brought back in a more acceptable form? Local authorities would be devastated if they found that suddenly their powers to detect rogue traders were stopped. Glass fitters have been mentioned. There is another case of an electricity fitter who left equipment in a thoroughly dangerous state. The only way that local authorities can get such people is through the use of telephone and other information. I hope that I can be given that assurance.

Viscount Colville of Culross

My Lords,—

Baroness Blatch

My Lords, it may be for the convenience of the House if I respond to my noble friend, given that he directed the question to me. In the meetings that we have had, I have received reassurance on two points. One is that the RIPA scheme is doing no more than bringing under a single umbrella and a single regulatory framework all the organisations which currently have powers to seek and access information. It is absolutely true that no single power to access information is being rescinded as a result of the orders, and we believe that that is a problem. It means that the orders under which local authorities presently operate will continue and that there is respite time for the Government to take away the orders and bring them back in good order. However, in the mean time, having spoken to Home Office officials, my understanding is that local authorities will be able to continue to pursue crime and disorder in their localities.

1.15 p.m.

Viscount Colville of Culross

My Lords, I believe that the noble Baroness is correct. I declare the interest that she has already declared to the House—that is, I am a Surveillance Commissioner. I operate under Part 2 of RIPA and I have visited a very large number of local authorities under the aegis of the noble Lord, Lord Jenkin of Roding. I am sure that they will be able to continue to act in the way described, whether or not the orders are made. However, I wish to put in a word for the RIPA orders to be endorsed by this House. I shall do so very briefly, otherwise we shall never finish in time for the Law Lords.

The first one brings the intrusive surveillance procedures and safeguards in Northern Ireland prisons on to the same basis as prisons in England, Wales and Scotland. At present, there is no system to deal with that. I have talked to the Prison Service in Northern Ireland, which would benefit from having this power, and I am sure that the prisoners would benefit from the supervision that they would receive under that order.

So far as concerns the communications data order, there is, indeed, great confusion, particularly among local authorities and, I believe, other public bodies as well. Until Chapter 2 of Part 1 is brought into force, there is a very haphazard system whereby they can find out the type of information about which the noble Lord has just spoken. They need it to enforce their duties and the powers that they have under other legislation. Therefore, it would be very convenient for them, although perhaps not essential, that this order should be made.

I believe that the third order should be approved. It brings up to date Statutory Instrument 2417, which is now hopelessly out of date. It includes a whole collection of public authorities which no longer exist but it does not include many public authorities that do exist. The whole system of authorising officers needed to be reviewed, and a fourth column has now been included in the schedule, which describes under which category of necessity each public authority can operate. All those issues will make for greater clarity, will bring the measure up to date and will make it far easier to carry out the duties that the Office of Surveillance Commissioners must carry out under Part 2. It would be the greatest possible pity if the order were to fail.

I do not want to say very much about the Anti-terrorism, Crime and Security Act matters because they are not in the least within my jurisdiction or much within my knowledge. However, I believe that two things could be said. Earlier, a noble Lord said that there are a large number of commissioners and other bodies that supervise this whole matter. So there are, and one will now be the Information Commissioner under the orders and procedures that occur in Part 11 of the 2001 Act.

I want to ask the noble and learned Lord the Attorney-General a question. There is now a directive—2002/58/ EC—which pulls together this whole matter. Having read it, it seems to me to provide a very sensible regime— probably rather better than cobbling together Part 11 of the 2001 Act with the Data Protection Act, which, although it bears some resemblance to the ECHR regime, certainly preceded it and is not entirely in tune with it. When will the directive be implemented? It would take the place of both these matters; it is entirely up to date; and it should have been introduced in this country by 31st October last. Perhaps that would be a good opportunity to reconsider this issue and pull together all the threads.

Lord Cobbold

My Lords, briefly, I support the amendment of the noble Lord, Lord Phillips of Sudbury. My personal concern is that there are still inadequate safeguards for the individual citizen against the possibility that those gathering permitted information may accidentally or deliberately come across data of a personal or market-sensitive nature which they can obviously exploit.

The Earl of Erroll

My Lords, I want to make one or two comments on the commercial side of this subject. I shall not take very long because I agree with, and shall heartily support, everything that has been said so far.

In principle, like everyone else I thought that the concept of RIPA was good as it would bring everything together. Then I suddenly remembered the old saying: "Just because you are paranoid doesn't mean to say they're not out to get you". So, what is the fear?

My remarks will address the second order, the Regulation of Investigatory Powers (Communications Data) Order 2003. As the noble Lord, Lord Phillips, so accurately said, the terms of the order enable a picture to be built up of a person's life. The definition of data which fall within Section 24(4)(a)(b) will determine the information district authorities and people working at fairly low levels can obtain to build up a picture of someone's life. Some of that could be commercially sensitive, and on this point I agree with my noble friend Lord Cobbold.

Unscrupulous people could build up a picture of someone's life. For example, a person trying to "chase up" a divorce case, who knew someone at the right level in the local authority, could, if the right data were released, obtain a picture of when and where someone was at a particular time and with who they communicated. As has been mentioned, from the point of view of foreign agencies and commercial intelligence, it could be useful to know who senior executives are talking to in other companies, particularly if one were bidding for large contracts. One would be able to build up a picture of what was going on. I do not think people realise how much intelligence information is gathered from analysing publicly available data. The order would make a lot of data more or less publicly available, particularly if one was abroad because of the lower level of scrutiny. Assurances on that point would be useful.

The key words here are "strictly regulated", on which I agree with the noble and learned Lord the Attorney-General. The problem is the word 'strictly". I am concerned about self-authorisation—authorities will authorise themselves to proceed with inquiries— and the word "proportionate". Thousands of people will be involved. The police, four other bodies and intelligence services will be authorised under RIPA. This will add another 28 bodies or types of body to that. Will the people who are trained to carry out such authorisations understand the word "proportionate" and what that is to mean?

I am told that there will be checks from around eight oversight bodies. However, according to Home Office figures, we are talking of half a million general requests per year. That is some 2,500 inquiries per working day. Not many of those will be got through and checked by just four people. I do not know what the resources are, but that needs to be considered.

There is no requirement in the code of practice to report to the oversight bodies what one is up to; they will have to come in and investigate. The other point is that you do not know what it is that you do not know. Will you catch in your trawl what is going on?

One of the interesting points made is that if we do not pass the order it will cause a lot of trouble but that it does not really matter because the police carry out 85 to 90 per cent of the requests. I find that interesting. If only 10 per cent of requests are to come from all the other bodies, why are they not channelled through the police, who would do a brilliant job of ensuring that other authorities are not abusing their power? Police services would have to be increased slightly to do that, but it would be a wonderful check. I would prefer checks to be done by the police than by an outside body. The other threat is that we should have to proceed under the existing powers of PACE: and so forth, and for authorisations to be carried out by circuit judges. That would be wonderful as there would be yet more checks. We are removing the checks and balances, which concerns me.

We are talking about people trying to investigate information on other people—communications data are a subdivision of that. This is where I find real difficulty with the comments of the noble and learned Lord the Attorney-General. On the one hand he says that we need RIPA in order to be compliant with the ECHR. Part of the ECHR concerns the right to a personal and private life. Therefore, paper files are equally relevant to the ECHR. Either these powers are ECHR compliant, in which case RIPA is not so urgent, or they are not, in which case they have to be repealed and come under RIPA, and requests for all information on a person must be regulated by RIPA.

Equally, if it is so important to bring all of this under one umbrella—I echo the noble Earl, Lord Northesk— so that the communication service providers (CSPs) know what they are doing and there is one single training process, why are we excluding the Department for Work and Pensions? Unfortunately, we did not realise the implications when this was slipped through. Therefore, it is no good saying that Parliament approved this. Parliament did not understand the implications at the time. A small Bill to remove those powers and bring them under RIPA is essential.

I have two final points. First, I do not know whether people realise but there are 500 to 600 small internet service providers (ISPs) employing five or fewer people. As these 2,500 inquiries go out, some of them will have to trawl for data and will have a serious problem responding to requests. I am not sure how they will handle that without going bankrupt.

Secondly, paragraph 32 of the code of practice states: Once the individual communication service provider has the technical capacity to retain data for the extended time periods-then the communication service provider shall inform existing and new customers that the purpose for retention and the periods of retention have been varied to meet with the needs of the Act". There are no powers to do anything about that; they cannot reject it. Yet that means that everyone with a mobile telephone, an e-mail address and a landline telephone will have to be mailed or informed somehow by their CSP that information has been retained. There is nothing they can do about it anyway. What a waste of money. Of course, I may be wrong.

I do not understand the undue haste. Protections are in place. Interestingly, I learnt that at present, CSPs vet applications. Some are referred to the information commissioner under the Data Protection Act and some are turned down. So, we are not unprotected at present. Measures are in place. I believe that this is a better way to proceed and that this is the way forward for the future but we must get it right. I shall vote to approve the first order. I shall vote in favour of all the non-fatal amendments. I shall not vote for the fatal amendments, with the exception that I shall think about data retention.

The Parliamentary Under-Secretary of State, Department for Work and Pensions (Baroness Hollis of Heigham)

My Lords, by the leave of the House I shall seek to respond briefly to the amendment in the name of the noble Earl, Lord Northesk, as it affects the Department for Work and Pensions. This was picked up by the noble Baroness and referred to as a major anomaly. That is why I intrude on your Lordships' time.

There has been no challenge that DWP needs the powers it has. I bridle a little at the assumption that your Lordships did not scrutinise the Bill. I remember vividly the noble Lord, Lord Higgins, pressing me on credit agencies, fishing trips and the like. But it was a Bill which passed through this House without Division.

No one denies that the powers that the DWP has are ECHR-compliant. No one would deny that fraud is a major concern of the department and of your Lordships costing perhaps £2 billion or very much more per year. Each year we initiate around 330,000 to 340,000 inquiries and take around 9,000 to prosecution. Therefore, given that communications information is vital to us, why are we not happy to accept the amendment standing in the name of the noble Earl, Lord Northesk?

The noble Earl raises three basic issues concerning RIPA: first, the issue of transparency and accountability, which was the particular concern of the noble Lord, Lord Phillips; secondly, cost; and, thirdly, effectiveness. As regards transparency and accountability, I am perfectly happy on behalf of my department to take away some of the concerns to see whether in the annual report to Parliament and the like we could increase the transparency of our procedures. That would be entirely proper. If I can meet the concerns of the House in that way I am very happy to do so and would do so in good faith.

However, I wish to explore briefly two other options. The first is that of cost. Ever since the foundation of the Department of Social Security in 1948, on behalf of taxpayers and to protect taxpayers, it has requested information as of right from employers for National Insurance purposes and from landlords for housing benefit and the like. If within RIPA we were required to pay, as we would be, for telecommunications details and then were not able to refuse similar requests from banks, building societies and other agencies which give us information about health, income, capital, identity, address and family circumstances—all of the bread-and-butter data of the department which piggybacks on other sources of information for the benefit of the taxpayer—we would face multi-million-pound bills in order to pay for what we currently get with consent in the public interest. So I urge the House not to go down that path.

The third consideration—to my mind the most important—is the consideration of effectiveness. As I say, we lose something like £2 billion—perhaps £4 billion—per year in fraud. We need this information. Since the enactment of the Social Security Fraud Act 2001 we have had an integrated, robust and effective structure for pursuing fraud. Let me give one example. Operation Utah was an investigation in which four defendants pleaded guilty to 25 charges of benefit fraud of a total overpayment of nearly a quarter of a million pounds. The Act was used for 42 credit references, 25 bank checks, eight credit finance checks and one telephone subscriber check.

Is the House really asking us to pay for each and every one of those checks? If so, does it then become financially worthwhile pursuing fraud, in particular low-level fraud? Is the House asking our staff— recently trained—to seek two sets of authorisation where now they operate within—thanks to the Act— an integrated and robust structure?

Let me explain to your Lordships what would happen if the House took the amendment on board. We would have to return to Parliament to change the legislative framework of the Social Security Fraud Act, within which we operate. We would probably have to change and amend the statutory code of guidance, which was the result of extensive consultation and laid before Parliament. On the ground we would require more senior staff and our recent training of staff would be wasted. We would have to retrain and restructure our existing fraud teams. Essentially, we would have to run two parallel routes to seek authorisation for data requests instead of, as now, one integrated coherent structure.

In other words, to bring telecommunications used by the department into RIPA, we would have to fragment our integrated coherent structure, which allowed us to be so effective with Operation Utah. As a result I suspect—I have checked this information this morning—we would disrupt the use of our fraud powers for anything up to three months.

1.30 p.m.

Baroness Blatch

My Lords, I am grateful to the noble Baroness for giving way. She has made coming under the RIPA regulatory framework sound extremely laborious, very time-consuming, extremely expensive in staffing and very expensive in terms of paying the providers. Do not these arguments apply to all other bodies which operate under different statutes? All the arguments put to us about coming under the regulatory framework indicate that it will not make any difference to these bodies, and that the position will not be as the noble Baroness has just described. It seems extraordinary that it should apply only to DWP and not to any other body.

Baroness Hollis of Heigham

My Lords, that is precisely why, as I was trying to say, our legislation was introduced in 2001; it is ECHR-compliant; and it builds on existing practices of obtaining the information which protects all our interests at no public expense. The noble Baroness may not like the information I am giving. It is information from my department about the implications on the ground of the cost, the laboriousness, the expense to staff training and our effectiveness. I know that the noble Baroness will not feel comfortable with any—

The Earl of Erroll

My Lords, is not this a very good argument for using the DWP model for the code of practice under RIPA, to bring everything into the DWP-type framework, and call that RIPA? Then everything is under a united umbrella. I have been told that the DWP has better procedures for checking the identity of a person making a request than those under the code of practice proposed under RIPA. So I am not against it at all.

Baroness Hollis of Heigham

My Lords, as I understand the position, one of the powers under RIPA is to require payment for all requests for such information. I spent some time trying to explain that since 1948 we have not, for the most part, paid for such information, whether to employers for information about national insurance and earnings, to landlords for information about housing benefit or to banks and building societies and so on. That was thoroughly discussed in your Lordships' House. It was recognised that, in pursuing the protection of taxpayers' financial interests, we all had a public policy duty to persist in allowing the department to acquire the information it needs. To do as the noble Earl, Lord Erroll. suggests would add to public cost, add to delay, add to complexity and would actually reduce the capacity of the department to be effective on the ground.

The noble Earl's amendment would be wholly negative and disrupt the Department for Work and Pensions' capacity to pursue and eradicate fraud. We have a good coherent, integrated and robust structure in place. To disrupt it now would be to undermine the very thing that this House has called for on several occasions, which is the effective and proper pursuit of fraud at the taxpayers' expense.

The Earl of Northesk

My Lords, perhaps I may clarify one point with the noble Baroness. The purpose underpinning my amendment is to make sure that, where the DWP has a need for access to communications data, communications data alone are brought within the RIPA regime. That is the logic of it. The rest of the DWP's investigatory activity would not be in any way affected. So I do not see how the nightmare scenario painted by the noble Baroness can be generated.

Baroness Hollis of Heigham

My Lords, I tried to give the answer in the example called Operation Utah. I could have given any other example. Our staff have a single route to acquire a range of data which include bank credit references, credit checks, information from building societies, information about utility bills to get people's addresses and so on. What the noble Earl's proposal—

The Earl of Erroll

My Lords, they are not covered by RIPA. That is the point.

Baroness Hollis of Heigham

My Lords, as I understand the position, RIPA would require us to seek to establish separate routes of authorisation and payment for the information we seek. Both would be severely disruptive and entirely negative for the department.

Lord Davies of Oldham

My Lords, I beg to move that the debate on the amendment of the noble Baroness, Lady Blatch, be adjourned.

Moved accordingly, and, on Question, Motion agreed to.

Lord Davies of Oldham

My Lords, I beg to move that the House do now adjourn during pleasure.

Moved accordingly, and, on Question, Motion agreed to.

[The Sitting was suspended from 1.37 to 2 p.m. for Judicial Business and to 3 p.m. for Public Business.]