necessity and proportionality). The justification
must be recorded and available for audit.
Handling/disclosure/sharing of data obtained by CNE
operations
99ZQ. Pursuant to GCHQ’s Compliance Guide, the
position is that all operational material is
handled, disclosed and shared as though it had
been intercepted under a RIPA warrant. The
term “operational material” extends to all
information obtained via CNE, as well as
material obtained as a result of interception
under RIPA.
99ZR.
The general rules, as set out in the Compliance
Guide and the intelligence Sharing and Release
Policy which apply to the handling of
operational material include, inter alia, a
requirement for mandatory training on
operational legalities and detailed rules on the
disclosure of such material outside GCHQ and
the need to ensure that all reports are
disseminated only to those who need to see
them.
a) Operational data cannot be disclosed
outside of GCHQ other than in the form of an
intelligence report.
b) Insofar as operational data comprises or
contains
confidential
information
(e.g.
journalistic material) then any analysis or
reporting of such data must comply with the
“Communications Containing Confidential
Information” section of the Compliance Guide.
This requires GCHQ to have greater regard to
privacy issues where the subject of the
interception might reasonably assume a high
degree of privacy or where confidential
information is involved (e.g. legally privileged
material, confidential personal information,
confidential
journalistic
information,
communications with UK legislators) GCHQ
must accordingly demonstrate to a higher level
than normal that retention and dissemination of
such
information
is
necessary
and
proportionate.”
77.
This is a very full picture of the guidelines under which GCHQ is required to
operate, and we are satisfied that they would be adequate, in the context of the