The question is whether during the period between March and November 2015
there was compliance with Article 8 in respect of the BPD regime, when there
was not publication of the Handling Arrangements until 4 November 2015.
97
A joint SIA Bulk Personal Data Policy came into force in February 2015,
which was to very similar effect as the subsequently published 4 November
joint Handling Arrangements, so far as concerned arrangements for
acquisition, use, sharing, retention and deletion/destruction; and in addition the
relevant provisions of GCHQ's Compliance Guide and the underlying forms
and guidance continued in effect, as did the MI5 Bulk Personal Data
Guidance, with new versions of various forms continuing to be issued
thereafter. MI6 also continued to be subject to similar Guidance. Of course
none of these were in the public domain, but formed the basis for the fully
considered open and closed handling arrangements once issued on
4 November 2015.
98
The issue for us is to decide whether the absence of publication of these
arrangements (‘below the waterline’), which were at all times subject to the
approval and supervision of the I S Commissioner, renders the BPD
non-compliant with Article 8 prior to 4 November 2015. We have referred to
the ISC, and quoted from its Report in some detail in paragraph 65 above,
from which it is plain that it contained considerable open description, not only
of the existence of the BPD process and system, but of the way it operated and
the controls to which it was subject.
99
The ISC had a concern, which it expressed, that the supervision was nonstatutory, and that of course was immediately resolved in March 2015, and
that there was no express legislation in respect of BPD. The only other
concern which it expressed (paragraph 163 of the Report) is that to which we
have referred in paragraph 95 above, namely that "while these controls apply
inside the [SIAs], they do not apply to overseas partners with whom the [SIAs]
may share the datasets.”
100
We are satisfied, in respect of the BPD regime, that as from 12 March 2015
(the date of the ISC Report) there was sufficient satisfaction of the principle of
foreseeability.
101
Accordingly, our conclusion is, in respect of Issues 2 and 3, that, subject to the
issue of transfer of data, and to resolution of Issue 4 below, the s.94 BCD
regime did not comply with Article 8 until November 4 2015 and thereafter
complies, and that the BPD regime did not comply with Article 8 until
12 March 2015 and thereafter complies. We so decide.
102
It does not follow that a complainant who establishes that his or her complaint
falls within the jurisdiction of this Tribunal, as explained in paragraphs 49 to
63 of our Judgment in Human Rights Watch & Ors v Secretary of State for
the Foreign & Commonwealth Office & Ors [2016] UKIP Trib 15_165-CH,
but who has no ground to believe that his or her data have been accessed and
examined, would have an actionable personal complaint on the grounds that
36