of the [SIAs] under the Intelligence Services Act 1994 [ISA 1994] and
the Security Service Act 1989 [SSA 1989] ...
159. While Ministers are not required to authorise the acquisition or
use of Bulk Personal Datasets in any way, the Home Secretary
explained that he had some involvement: "[MI5] do come to me and I
receive submissions on acquisition on bulk datasets and the holding of
bulk datasets." In relation to the Bulk Personal Datasets held by
GCHQ and [MI6], the Foreign Secretary explained to the Committee
that, "There is not a formal process by which we have looked [at those
datasets].”... He explained ... "... I have ... asked for twice yearly
reporting of the holdings of bulk personal data by the [SIAs]."
160. In terms of independent review, the Intelligence Services
Commissioner has non-statutory responsibility for overseeing the
[SIAs’] holdings of Bulk Personal Datasets (since 2010) ... The
Commissioner explained to the Committee that he retrospectively
reviews the [SIAs’] holdings of Bulk Personal Datasets as part of his
six-monthly inspection visits. This includes reviewing the intelligence
case for holding specific datasets, necessity and proportionality
considerations, the possible misuse of data and how that is prevented."
7
The MI5 witness explained in his evidence as follows:"44) MI5 acknowledges that it holds the following categories of BPD:
- [Law Enforcement Agencies]/Intelligence. These datasets primarily
contain operationally focussed information from law enforcement or
other intelligence agencies.
- Travel. These datasets contain information which enable the
identification of individuals' travel activity.
- Communications. These datasets allow the identification of
individuals where the basis of information held is primarily related to
communications data, e.g. a telephone directory.
- Finance. These datasets allow the identification of finance related
activity of individuals.
- Population. These datasets provide population data or other
information which could be used to help identify individuals, e.g.
passport details.
- Commercial. These datasets provide details of
corporations/individuals involved in commercial activities.
45) A number of these datasets will be available to the public at large.
Some of these publicly available datasets will be sourced from
commercial bodies, and we will pay for them (as another public body
or a member of the public could do). MI5 also acquires BPD from
Government departments, from [MI6] and GCHQ and from law
enforcement bodies.
46) MI5's holding of passport information is key to our ability to be
able to investigate travel activity. Holding that data in bulk, and being
able to cross-match this to other data and other BPD held, is what
enables us to find the connection and "join the dots." That would
5