Investigatory Powers Commissioner’s Annual Report 2019
Government (HMG).6 On 12 December 2018, Lord Anderson of Ipswich KBE QC hosted an
invitation-only event at Chatham House on behalf of the IPC for some of those who had
responded or had a particular interest in this area. The event enabled detailed exploration
of the central points raised in the responses.
2.27
Following this process, and extensive consultation with the relevant agencies on the
practical implications of proposed amendments, the IPC, Sir Adrian Fulford, submitted his
recommendations to the Prime Minister on 12 June 2019. These have now been accepted
in full.7 The new ‘Principles relating to the detention and interviewing of detainees overseas
and the passing and receipt of intelligence relating to detainees’ (The Principles) were
published by the Government on 18 July 2019.8 The Principles took effect from 1 January
2020. On 13 December 2019 the Prime Minister directed the IPC to keep under review
compliance with The Principles by the intelligence agencies, Her Majesty’s Armed Forces
and the Ministry of Defence, the Metropolitan Police and the NCA. We will provide a full
report on the first year of operation of The Principles in our 2020 Annual Report.
Third Party Data
2.28
In 2019, we discussed the scope of Part 7 of the IPA (bulk personal datasets) with UKIC
with particular reference to data held by third parties. In general, any access which UKIC
has to personal data held by third parties does not require authorisation under Part 7 of
the IPA, because UKIC is not “retaining” the data within the meaning of section 199 of
the IPA. The consequence of this is that, for a dataset which would otherwise meet the
definition of a BPD in section 199 of the Act were it to be retained by UKIC (i.e. it relates to
a large number of individuals, the majority of whom are not of intelligence interest, and it
is held electronically for analysis), Part 7 of the IPA does not apply if the dataset is in fact
retained by a third party within the meaning of section 199. Instead, UKIC rely on their
core statutory functions in the Security Service and Intelligence Services Acts respectively,
together with the statutory information gateway in section 19 of the Counter-Terrorism Act
2008, to access such datasets.
2.29
In light of the scope of Part 7 of the IPA, we conducted an extensive review of bulk datasets
held by third parties to which UKIC had access in order to provide assurance that BPD
warrants were being obtained where applicable. Given that the processing of data held
by third parties falls outside our oversight functions, we focused on whether UKIC was
compliant with the requirements of Part 7 of the IPA. We concluded, in the case of the
datasets examined by the review, that UKIC’s access was not in breach of the requirements
of Part 7. However, we will continue to keep under review UKIC’s compliance with Part 7
in this regard. Whilst UKIC access to data held by third parties is not currently subject to
oversight by IPCO, we have recommended that HMG consider bringing it within IPCO’s
oversight functions.
6
7
8
IPCO, “Consultations” (October 2018), <https://ipco.org.uk/default.aspx?mid=13.11>
Prime Minister, “Review of the Consolidated Guidance” (18 July 2019), https://www.parliament.uk/
business/publications/written-questions-answers-statements/written-statement/Commons/2019-07-18/
HCWS1738/
Her Majesty’s Government, “The Principles” (July 2019), https://assets.publishing.service.gov.uk/
government/uploads/system/uploads/attachment_data/file/818306/20190718_The_Principles_relating_
to_the_detention_and_interviewing_of_detainees_overseas.pdf
13