IPCO Annual Report 2018
12
11
10
10
8
8
7
6
4
3 3
4
4
3
2
0
11
CHIS
Directed
Surveillance
1
2
MI5 2018
GCHQ 2018
SIS 2018
MI5 2017
GCHQ 2017
SIS 2017
1
Property Bulk Personal
Interference
Data
Section 7
Figure 20: UKIC errors 2017 and 2018, excluding interception and
communications data
17.14
In our 2017 report, we set out that MI5 had identified an error, in the way one of their
systems was set up to handle data (as below). We have seen a growing understanding
towards data handling systems in 2018, which may result in the identification of further
errors in this area from MI5 and other bodies in the future.
17.15
In October 2017, MI5 reported an error relating to an intelligence platform. The system is
used by MI5 officers to analyse a range of information from a variety of sources, including
warranted data. An officer using the system might search data across a number of sources
and save targeted results. The error, which was investigated by IPCO in 2018, was that
there was no review, retention and deletion (RRD) policy in place for data saved by officers
working on the system. This means that material, derived from targeted searches of
warranted data, may have been unlawfully retained as there were no longer any authorised
grounds under the relevant legislation to retain it. MI5 have now put in place an RRD policy
for the platform and all data held in that area, that is assessed not to be necessary or
proportionate to retain, has been deleted.
17.16
After reporting the error, MI5 also identified that this saved material had not been included
in the search exercise that MI5 had previously carried out in relation to an ongoing IPT case.
MI5 then carried out searches of the saved material using selectors previously provided by
human rights charity, Privacy International. Material relating to Privacy International was
found as a result of those searches, but this data was subsequently deleted.
17.17
Privacy International expressed concern to the IPC that this prevented IPCO from
conducting an investigation into the issue. IPCO conducted an immediate inspection of
MI5 in order to respond to the complaint from Privacy International. This showed that,
whilst the data itself had been deleted, MI5 did hold a documentary record describing the
data that they had held. In investigating this, the Deputy IPC and an Inspector visited MI5
to review the record of the data and concluded that there were no concerns about the
necessity and proportionality of the actions taken by MI5.
107