How bulk acquisition works
2.35.
Secret directions under s94 have since at least 2001 (GCHQ) and from 2005
(MI5) enabled the SIAs to acquire communications data in bulk, including in
particular records of domestic communications, for the purposes there set out.
2.36.
The first detailed open review of this activity was published on 7 July 2016 by the
IOCC, who noted in his cover letter that a statutory requirement of secrecy:
“ severely limits what we can say publicly about the nature of the directions
and the conduct undertaken in pursuance of any direction”.
IOCCO also had to be mindful of the case which was then pending before the
IPT, judgment in which is likely to be handed down in the coming months. 83
2.37.
Some useful detail of existing practice is however provided in the IOCCO Report.
Each of the 15 extant s94 directions for bulk communications data were said (at
8.34) to require the disclosure of traffic data (which identifies e.g. the sender and
recipient of a communication, the location from which and time at which it was
sent and other related material).84 The report dealt with the preparation of
submissions for a s94 direction (8.37-8.44), the giving of a s94 direction (8.478.49), handling and storage arrangements (8.54-8.57), access to bulk
communications data (8.58-8.70) and acquisition and access errors (8.71-8.83).
83
84
2.38.
Looking forward to the implementation of the Bill, section 10 of the IOCCO report
welcomed what it described as the “clear requirements and safeguards” set out
in the Bill and in the 44-page Bulk Acquisition Draft Code of Practice.
2.39.
The draft Code of Practice summarises matters as follows:
“3.1
Bulk acquisition warrants authorise a two stage process. First, the
obtaining of BCD [bulk CD] from a CSP and second, the selection for
examination of the BCD obtained under the warrant.
3.2
A bulk acquisition warrant will be served on a CSP to require that CSP
to disclose the communications data specified in the warrant. This
may also require a CSP to obtain and disclose specified
communications data that is not in its possession but that it is capable
of obtaining.
3.3
A warrant will normally provide for the provision of communications
data as it is generated or processed by the CSP for business
purposes but may also relate to the provision in bulk of
communications data retained by a CSP for business purposes or
Privacy International v Secretary of State for Foreign and Commonwealth Affairs et al,
IPT/15/110/CH.
RIPA 2000 s21(4)(a).
31