75
As for BCD, dealing with the successive I C Cs, Sir Swinton Thomas carried
out some oversight from 2006, and as from the appointment of his successor,
Sir Paul Kennedy, and then Sir Anthony May, there were six-monthly reviews
of the databases and of their use. They were provided with a list setting out
details of all s.94 Directions and any that had been cancelled, although in the
July Review the current I C C, Sir Stanley Burnton, criticises the lack of
codified procedures and a sufficiently accessible and particularised list.
76
The IS Commissioner, Sir Mark Waller, succeeding Sir Peter Gibson, also
included a review of BCD within his responsibility upon his six-monthly visits,
and he reviewed the use of the datasets and the case for their acquisition and
retention, including necessity, proportionality and the risk of collateral
intrusion. He included consideration of BCD in all his Reports between 2011
and 2015. Those Reports and the witness evidence from the SIAs show that he
was concerned to carry out a perceptive examination and analysis both of the
directions and the use of the data, but he did not carry out a detailed audit.
77
Both Commissioners approved and subsequently reviewed the (‘under the
waterline’) GCHQ Compliance Guide relating to s.94 Directions.
78
From March 2015 Sir Anthony May was asked to take over full responsibility
for oversight of BCD, and agreed to do so as from July 2015, provided that he
was given additional staff and enabled to carry out the work properly, and it was
only by December 2015 that his successor Sir Stanley Burnton was in a position
to do so. At this stage his inspectors were provided with full access to the MI5
electronic systems which processed authorisations for access to the database and
communications data requests made to the PECNs, and they undertook querybased searches and random sampling of the MI5 system for authorising access
to the database and reviewed requests for authorisations relating to the database,
and that process, as we have been informed by the I C C’s office, continues in
place.
79
Sir Stanley Burnton recorded his conclusion in paragraph 2.5 of the July Review
that, leaving aside the involvement of the I S Commissioner, oversight by the
I C C of BCD prior to 2015 was “limited because it was only concerned with the
authorisations to access the communications data obtained pursuant to the
directions. The oversight was not concerned with, for example, the giving of the
section 94 directions by the Secretary of State (including the necessity and
proportionality judgments by the agency or Secretary of State) or the
arrangements for the retention, storage and destruction of the data.”
80
There were internal audits pursuant to the internal Compliance Guidance, and
there was a regular review of the Directions by the Home Secretary (MI5) and
the Foreign Secretary (GCHQ). However, we are not satisfied that, particularly
given the fragmented nature of the responsibility apparently shared between the
Commissioners, there can be said to have been an adequate oversight of the
BCD system, until after July 2015. In the absence of the necessary oversight and
supervision by the I C C, the secondary roles of this Tribunal and the ISC were
no replacement.
30