CHAPTER 15: RECOMMENDATIONS
domestic disclosure, dissemination, copying, storage and retention of intercepted
material is limited to the minimum necessary for the authorised purposes.
73.
74.
75.
Equivalent statutory safeguards should be provided in relation to communications
data. In particular, the new law and a Code of Practice issued under it, with the
involvement of the Information Commissioner as appropriate, should make provision
for:
(a)
why, how and where data are retained within public authorities;
(b)
who may access them within the public authority;
(c)
with whom the data may be shared, and under what conditions;
(d)
the special rules needed as regards the treatment of data that appear to be
privileged or confidential (see Recommendations 67-69 above), and data
relating to a victim or a witness;
(e)
the processing of data for reasons going beyond their acquisition;
(f)
the use of data in conjunction with other datasets;
(g)
the processes for determining which data should be destroyed or further
retained; and
(h)
compliance with DPA 1998.
These safeguards should be enforced and backed up by ISIC audits (as currently
performed by IOCCO), examining:
(a)
how the material and/or data were used or analysed;
(b)
whether they were used for the stated or intended purpose;
(c)
what actual interference or intrusion resulted, and whether it was proportionate
to the aim set out in the original authorisation;
(d)
whether the conduct became disproportionate to what was foreseen at the point
of authorisation, and if so whether the operational team initiated the withdrawal
of the authorisation;
(e)
retention, storage and destruction arrangements; and
(f)
whether any errors or breaches resulted from the interference or intrusion.
On the basis that MI5, MI6 and GCHQ each apply the safeguards referred to in
Recommendations 72-73 above, they should be permitted to share intercepted
material and communications data between them for the purposes of their respective
functions.
298