IPCO Annual Report 2017
IPT Case 15/110/CH
9.36
During 2017 our inspectors assisted the Investigatory Powers Tribunal (IPT) with a request
made about case IPT/15/110/CH in relation to the acquisition and use by the intelligence
agencies of BCD (pursuant to s.94 directions) and the bulk personal data regime. The issue
before the IPT was the lawfulness of the BCD and BPD regimes in domestic and European
law. The existence of bulk personal data was first publicly avowed in March 2015 and bulk
communications data in November 2015.56
9.37
The IPT, in carrying out its functions, is empowered to request the IPC to provide all such
assistance, including giving an opinion on a matter before the tribunal, as the IPT requires.
The IPT requested assistance in verifying the results of numerous searches the claimants had
requested the agencies undertake as part of the ‘discovery process’, in order to determine
what data was held in relation to specific entities (for example, communication addresses
and travel information). This investigative work took our inspectors many days to complete
and resulted in a detailed report that was submitted to the IPT.
9.38
The IPT provided its final judgment in July 2018,57 finding that:
• many of directions made prior to October 2016 by the Foreign Secretary to Communications
Service Providers to provide BCD to GCHQ were not in accordance with law;
• (by a majority) the regime in respect of sharing of BCD/BPD with foreign agencies
complied with Article 8 of the ECHR;
• the regime in respect of sharing BCD/BPD with industry partners complied with Article 8
ECHR; and
• the steps taken by way of collection , retention and use of BCD or BPD by the authorities
complied with the requirements of proportionality pursuant to Article 8 ECHR and EU law.
9.39
Addressing the adequacy of the oversight of this power, the tribunal recognised that Sir Stanley
Burnton (IoCC) had identified many of the same issues as regards GCHQ’s submissions and
authorisations by the Foreign Secretary as the tribunal, and ‘did not conclude there was
any inadequacy of supervision by reference to the (IOCCO) July 2017 Review’.
9.40
Two specific questions concerning the oversight of access to, and sharing of BCD (and Bulk
Personal Datasets) were addressed:
“As to the Commissioner’s knowledge of the number of internal contractors with access,
the tribunal determined ‘‘the absence of such precise knowledge does not in our judgment
detract from the adequacy of their oversight, which in this regard was in place and, so far
as checking conduct by contractors as well as employees, was plainly exercised.”
56 There remains an outstanding reference to the CJEU in this case, on whether security and intelligence agencies use of the powers to
acquire BCD is in scope of EU law and, if so, would the requirements outlined by the CJEU in the Watson case apply to the BCD regime.
57 https://www.ipt-uk.com/judgments.asp
67