the SIAs. As argued by the Claimant, the claim concerns the
arrangements for and safeguards attaching to the acquisition, use,
retention, disclosure, storage and deletion of bulk data, whether
obtained under s.94 or by other means.
(ii) BPD may include communications data lawfully obtained by the
SIAs (as referred to in paragraph 64 below), but may also include data
lawfully obtained commercially or otherwise without the use of any
statutory power to procure or compel the acquisition of bulk data.
Agreed/Assumed Facts
18
The procedure which has been operated by this Tribunal in recent hearings has
been that issues are agreed so as to facilitate a public hearing in open court,
enabling full inter partes argument, based upon facts which are agreed or
assumed for the purposes of that hearing. In this case the Claimant served a
schedule of 41 proposed agreed facts (and a small number of assumed facts),
which the Respondents largely accepted, in almost every case with the rubric
that their acceptance was subject to the full context provided in their pleadings
and evidence. We were supplied with closed evidence by the Respondents
(much of which we decided should be disclosed in open, redacted as
necessary), but it played no part in our judgment.
19
The most material of the Agreed Facts are as follows (we do not repeat matters
already specifically mentioned above):(a) BCD
(i) GCHQ and MI5 collect and hold BCD, relying upon s.94 as the legal basis
for doing so. MI6 does not collect or hold BCD. GCHQ also acquires related
communications data pursuant to warrants issued pursuant to RIPA s.5 in
respect of external communications under the terms of s.8(4).
(ii) GCHQ requires any access to BCD to be justified on the same grounds and
to the same standards as access to related communications data obtained
pursuant to s.8(4) of RIPA.
(iii) GCHQ treats BCD acquired under s.94 Directions in the same way as it
treats related communications data obtained pursuant to s.8(4), storing data
obtained under those statutory regimes within the same databases.
(iv) MI5's procedures include a process under RIPA, Part 1, Chapter II for
accessing its BCD database, which is not followed by GCHQ.
(v) MI5 generally retains BCD for one year.
(vi) BCD contains communications data in the form of "traffic data" and
"service use information" (as defined in s.21(4) of RIPA), or the "who, where,
when and how of a communication." BCD may have contained subscriber
information and may include locational data from mobile and fixed telephone
lines and internet devices: GCHQ's BCD collection includes bulk internet
communications data, which may include the "who, where, when and how," of
a communication on the internet, including automated communications
between machines.
(vii) S.94 Directions have not been, and cannot be, used to authorise the
interception of the content of communications.
10