9.21.
A similar emphasis on changing technology was expressed by Matt Tait, who
has had relevant experience both inside and outside the SIAs, when he told the
Review that:
“… for the overwhelming majority of the time that the IP Bill will be law, it will
be interpreted in secret by HMG lawyers, when seeking to authorise as-yet
unknown operations in support of not-yet decided policy objectives, needing
to relate the provisions of the IP Bill to technologies that do not exist yet,
where technological norms may be markedly different to how they are today
…”.
That passage underlines the importance of ensuring that authorising and
oversight bodies have the requisite technical knowledge not just of current
technologies but of present and emerging trends.257
9.22.
Such knowledge could be transmitted in part by ensuring that warrant
applications contain sufficient detail of the methods to be used, and by recourse
(should the Judicial Commissioners so choose) to standing counsel to advise
them on particularly novel or difficult applications. I would favour both these
developments. But it is not sufficient to rely on the necessary understanding
being picked up on a case-by-case basis, or through the medium of civil servants
and lawyers.
Reducing the privacy footprint
9.23.
Also in need of technological expertise are the IPC inspectors whose task it will
be to audit the disclosure, retention and use of material acquired pursuant to the
new law (clause 205). Are the SIAs’ systems equipped with “privacy by
design”,258 and if not what can be done about it? Could procedures be amended
in such a way as to reduce privacy intrusion (for example by greater use of
anonymised search results), without jeopardising operational efficiency? Such
issues need a practical understanding of how systems are engineered, how
powers are operated, and what could be done to minimise the privacy footprint of
the SIAs’ activities. The Bill already confers duties to audit, inspect and
investigate. What is needed in addition is the expertise to enable those duties to
be carried out in the most effective possible way.
257
258
It also points up the need to ensure that the IPC “proactively seeks out and brings to public
attention material legal interpretations on the basis of which powers are exercised or asserted”,
as the expert lawyer Graham Smith has rightly submitted: supplementary evidence of 22
December 2015 to the Joint Committee on the draft Bill, IPB0126 paras 64-75.
Privacy by design is an approach to protecting privacy by embedding it into the design
specifications of information technologies, accountable business practices and networked
infrastructures: see the “white paper” by Canadian Information and Privacy Commissioner A.
Cavoukian, Privacy by Design in Law, Policy and Practice, 2011.
126