dated 7th July 2016 written by MI5 to the Home Secretary, to introduce a new
procedure. While it is not yet known whether this will be satisfactory to the I
C C, this indicates the effectiveness of the I C C's oversight.
93
In considering acquisition of BCD, and access to such data held, the essential
requirement in this context is that the BCD is acquired only for proper
purposes, where the acquisition of the data is necessary and proportionate.
The Handling Arrangements are clear in this respect (see Appendix A at
paragraphs 35 and 39). As noted above, the I C C, having reviewed the
directions which have been made under s.94, was satisfied that they had all
been issued for proper purposes. In relation to BPD, the statutory duties
imposed on the SIAs govern the obtaining of all information, with or without a
warrant, so that information used to constitute BPDs can only be obtained for
proper purposes. If the data is required to be obtained by the exercise of any
statutory power (e.g. under RIPA or ISA) then the relevant statute will provide
the necessary protection. If no statutory power is required to be exercised, for
example if the information may be purchased commercially, then the relevant
issue is how such data is retained and used. The material potential intrusion
on privacy arises from the retention and use of such data, and it is at that point
that safeguards must be applied. As noted above, the Handling Arrangements
are clear as to the conditions under which any BPD may be obtained or
accessed, and the operation of those arrangements is subject to independent
oversight
94
Whatever the failings in the system of oversight obtaining prior to avowal of
these powers, the system now in operation does, in our judgment, operate
effectively. The I C C has conducted a review of the s. 94 powers. The lines
of demarcation between the two Commissioners in relation to the use of BCD
have been agreed. The I S Commissioner has, as referred to in paragraph 81
above, recently published his annual Report for 2015, which contains a review
of the BPD regime. The fact that these reviews are not uncritical, and,
particularly on the part of the I C C, contain recommendations for
improvement, indicates that the system of oversight is effective.
95
The only area in which we need to give further consideration relates to the
provisions for safeguards and limitations in the event of transfer by the SIAs
to other bodies, such as their foreign partners and UK Law Enforcement
Agencies. There are detailed provisions in the Handling Arrangements which
would appear to allow for the placing of restrictions in relation to such transfer
upon the subsequent use and retention of the data by those parties. It is
unclear to us whether such restrictions are in fact placed, and in paragraph
48.2 of their Note of 29 July 2016 the Respondents submit that the Tribunal is
not in a position to decide this issue. We would like to do so and invite further
submissions.
96
This leaves the question, in relation to BPD, of the period between Avowal in
March 2015 and 4 November 2015 when the Handling Arrangements were
published, given our conclusion that in relation to BPD, unlike BCD, the
independent oversight was and continued to be adequate, and in any event so
far as Avowal is concerned, the earlier date applied to BPD but not to BCD.
35