Investigatory Powers Commissioner’s Annual Report 2019
8.31
We discussed this with MI5 at our October inspection and, as a result, we will be seeking
further information in 2020 on a number of points. These questions are mainly in relation
to safeguards relating to the users of the testing devices and the storage and retention of
any material.
Bulk communications data (BCD)
8.32
MI5 holds a bulk acquisition warrant relating to several UK telecommunication operators.
8.33
Until 8 October 2018, the MI5 process for accessing BCD, which was acquired and
retained by the agency via directions under section 94 of the Telecommunication Act
1984, substantially mirrored that set out in Chapter 2 Part 1 RIPA and the Codes for the
Acquisition and Disclosure of Communications Data. That process required the investigator
or analyst to set out in an application why it was necessary and proportionate to access
the data. A designated person of appropriate seniority in the organisation then considered
whether to give authority for that access.
8.34
This process changed substantially once bulk acquisition warrants under the IPA were
introduced in October 2018. In accordance with the requirements in the IPA, the
investigator or analyst is now required to create a record prior to selecting the data for
examination, recording why the proposed examination is necessary and proportionate for a
specified operational purpose.
8.35
During inspections, we are given access to the system used by MI5’s investigators
and analysts to record why the examination of specific data is both necessary and
proportionate. This ensures we can examine the activities of specific members of staff
who are authorised to undertake the examination of BCD. During inspection we undertake
random sampling and run query-based searches on the system.
8.36
We scrutinise the majority of records that indicate the communications data (CD) sought
relates to a person who may work in an occupation regarded as a sensitive profession.
For example, we search for records which included the words ‘medical practitioner’ or
‘journalist’. We examine the analysts’ and investigators’ necessity and proportionality
considerations, examine particular operations and identify requests for more intrusive data
sets including multiple communication addresses or those requiring data over longer time
periods. We also interview members of staff to probe their considerations around these
complex operations or sensitive requests.
8.37
Overall, we concluded that MI5’s recorded justifications to undertake the examination of
BCD were of a good standard and satisfied the principles of necessity and proportionality.
The operational teams were interviewed and demonstrated the value of BCD to
recent operations.
Bulk personal datasets (BPD)
8.38
In MI5, a service-wide gate-keeping panel, called the Bulk Oversight Panel (BOP) acts as a
single point of contact for staff needing to obtain, retain and use bulk personal datasets.
Each dataset acquired and held by the agency will have an allocated data owner who is
responsible for considering the ongoing necessity of holding that data and assessing the
value of its use. Data owners apply to the panel with requests to acquire, retain, renew,
cancel or delete BPD and BPD warrants. The panel consists of senior managers and meets
45