Internal Section 94 Handling Arrangements
50. In addition to the published Section 94 Handling Arrangements, both GCHQ
and MI5 have their own internal Section 94 Handling Arrangements, which
were also in force from 4 November 2015. These reflect and supplement the
published Section 94 Handling Arrangements. They are not separately set out
in detail here.
GCHQ Compliance Guide
51. The relevant sections of the GCHQ Compliance Guide relating to the period
from June 2014, which have been disclosed by the Respondents in these
proceedings, continued after November 2015. In the October 2015 version of
the Compliance Guide, the section dealing with review and retention provided
that continued retention beyond the prescribed default periods must be subject
to formal approval. Although the previous version of the Compliance Guide
required that such retention should be reviewed and rejustified, in most cases
annually, it had not previously been subject to the requirement of formal
approval.
MI5 internal arrangements
52. MI5 continues to have internal guidance in addition to the Section 94
Handling Arrangements. In particular:
(a) From November 2015 the “Communications Data – Guidance on
Justifications and Priorities” guidance was amended so that:
(a) Specific attention was drawn (and a link provided to) the MI5 Section 94
Handling Arrangements which came into force on 4 November 2015; and
(b) Detailed guidance was provided in respect of communications data
applications relating to members of sensitive professions.
Acquisition and Disclosure of Communications Data Codes of Practice
53. The authorisation process for access to the Section 94 database was, from the
outset, the same as for requests to CSPs for CD under Part 1 Chapter II of
RIPA. As a matter of practice and policy, MI5 has applied the applicable
Codes of Conduct for the acquisition of communications data to the regime
that it has operated for the database. In particular, investigators would – when
completing requests for CD – be expected to comply with applicable parts of
the Code of Practice relating to the acquisition of CD.
Acquisition and Disclosure of Communications Data Code of Practice 2007
54. The Acquisition and Disclosure of Communications Data Code of Practice
2007 (“the 2007 CD Code”) related to the powers and duties conferred under
Part 1 Chapter II of RIPA.
51