Handling arrangements
From 4 November 2015 to the date of the hearing and as at the date of the
hearing
BPD Handling Arrangements
31. On 4 November 2015 the BPD Handling Arrangements were published. These
applied to each of GCHQ, MI5 and SIS.
32. The BPD Handling Arrangements apply to obtaining, use and disclosure of
“bulk personal datasets” (§1.2) as defined at §2.2:
“2.2 Among the range of information collected is data that contain personal
information about a wide range of individuals, the majority of whom are
unlikely to be of any intelligence interest. Typically these datasets are very
large, and of a size which means they cannot be processed manually. Such
datasets are referred to as bulk personal datasets. For the purposes of these
Handling Arrangements, a ‘bulk personal dataset’ means any collection of
information which:
(a) Comprises personal data;
(b) Relates to a wide range of individuals, the majority of whom are unlikely to
be of intelligence interest; and
(c) Is held, or acquired for the purpose of holding, on one or more analytical
systems within the Intelligence Services.”
33. “Personal data” is defined as having the meaning given to it in s.1(1) of the
Data Protection Act 1998 (§2.3), but additionally includes data related to the
deceased.
34. The purpose of the acquisition and use of BPD is explained at §§2.4-2.5:
“2.4 Bulk personal datasets may be acquired through overt and covert
channels. Such datasets provide information about subjects of intelligence
interest ("subjects of interest"), but inevitably also include information about
those who are of no direct relevance to Intelligence Service operations. It is
not possible to acquire the information that will be of direct value to these
operations without also acquiring this additional data; indeed, at the point of
acquisition it may not be known exactly which information will prove to be of
value.
2.5 The Intelligence Services draw on this data and use it in conjunction with
other data in order to perform their functions, for example, to identify subjects
of interest, validate intelligence or to ensure the security of operations or staff.
It may also be used to facilitate the exclusion of individuals from an
investigation or in pursuit of other intelligence requirements. This ensures that
the activities of the Intelligence Services are correctly and solely focused on
those individuals or organisations that are relevant to the performance of
their statutory functions.”
35. The requirement that acquisition, use, retention and disclosure of BPD have
“clear justification, accompanied by detailed and comprehensive safeguards
62