abusive use of the s.94 power. The fact that the Commissioner has himself
identified administrative improvements that should be made is indicative of
the effective operation of oversight of the SIAs in this area.
91
The most significant of the points emerging from the July Review and from the
Claimant's submissions relating to it are these:
(i) There is no present limit on the duration of a s. 94 direction, i.e. to the
period during which the PECNs should continue to comply with it and
provide data. The Commissioner did not make a recommendation that
there should be a maximum duration imposed on directions made under
s.94, but advised at paragraph 4.14 its proposed inclusion in a code of
practice; such a requirement was not included in his recommendations in
section 12. However, we are satisfied that under the Handling
Arrangements (and as appears in the Agreed Facts, at paragraph
19(a)(v)) there are adequate restrictions imposed on the SIAs in relation
to the duration for which the data can be retained (thus protecting the
interests of the persons whose communications data has been obtained),
and there are also provisions for a review of the directions.
(ii) The Commissioner did recommend that there should be standardised
processes for the review of directions, and the reporting of errors. We
consider that the comprehensive Handling Arrangements, combined with
proper oversight by the Commissioners, do adequately provide effective
safeguards.
(iii) There are recommendations by the Commissioner as to what should
be included in a s.94 direction. A further specification may in due
course be introduced, but in our Judgment, given the adequacy of the
safeguards provided by the published Handling Arrangements, such is
not necessary for compliance with Article 8.
The I C C concluded (at paragraph 11.10) that the relevant agencies had
introduced comprehensive procedures, in accordance with the Handling
Arrangements, to ensure that they only acquired and retained bulk
communications data, and then accessed and undertook analysis of that data,
in order to pursue their functions under SSA 1989 or ISA 1994. The essential
protection against a potential abuse of power under s.94, namely a requirement
that the BCD may only be obtained and used for proper purposes, is thus
provided by law, and subject to effective oversight.
92
MI5 and GCHQ differ in the systems they operate so far as access to BCD is
concerned. Neither of them adopt the need for a warrant, as will be provided
by the new Bill, if enacted. The Claimant submits that there is inappropriate
reliance by GCHQ upon the RIPA safeguards relating to intercept, which they
operate, without appreciating the difference, namely the absence of the
specific safeguards effected by ss.15 and 16 of RIPA. MI5 adopt (as discussed
in paragraph 54 above) a system analogous to that under ss.21 and 22 of
RIPA, but did not, a matter of severe criticism by the I C C, have a system
with a sufficiently independent designated person such as would comply with
the Communications Data Code of Practice. This is a matter which, while not
accepting such criticism, the Respondents have met by agreeing, by a letter
34