IPCO Annual Report 2017
10.25
The articulation of intrusion at the three intelligence agencies is based on somewhat
differing interpretations of the impact on individuals’ privacy of this activity. We have
recommended that the intelligence agencies adopt a common structure, based on the
following considerations:
• the intrusion into the privacy of members of the public as a result of holding the dataset
within the agency’s systems, prior to access to the data. This depends on the nature
of the data, the public expectation of privacy, and duration for which the data is held,
amongst other factors; and
• the intrusion resulting from access to the data by agency staff, which may include
collateral intrusion for those who are not subjects of interest. For example, a search for
a specific individual may also return details for people with similar names or addresses.
Ingestion delays
10.26
Ingestion is the process by which a BPD is processed so as to make it available for analysis.
In his 2015 and 2016 reports, Sir Mark Waller noted his disquiet at the delay in ingesting data
the intelligence agencies had acquired into the analytical systems. It is reassuring to note that
the 2017 inspections did not echo these concerns, largely because the intelligence agencies
have made changes to their ingestion processes on the basis of Sir Mark’s recommendations.
It is worth remarking in passing that the IPA introduces BPD warrants for any data retention
or use, but not its acquisition. Under ss.220-4 IPA, before obtaining a warrant an agency
may carry out a preliminary examination of the dataset to establish whether it is a BPD, and
whether it is of a nature that the agency wishes to retain, or retain and examine. This initial
examination period is up to three months if the information was created in the UK, and up
to six months if it was created outside the UK. This means the agency can begin to ingest
the data while obtaining an authorisation to retain and examine the set, but it will not be
possible to examine it for intelligence operations or investigations until the relevant warrant
is in place. However, data ingestion remains technically complicated and we will review both
compliance with the IPA deadlines and any ingestion delays for warranted datasets.
IPT Case 15/110/CH – Adequacy of ISComm oversight
10.27
BPDs have been the subject of significant public interest since they were publicly avowed
in March 2015, and were the subject of a case brought before the Investigatory Powers
Tribunal (IPT), along with the acquisition of communications data in bulk. At a hearing
in September 2017, the IPT considered evidence in relation to a challenge against the
lawfulness of sharing BPDs with foreign governments or industry partners. We co-operated
fully with the IPT on this case, providing both classified and unclassified evidence in relation
to oversight.
73