Report of the Interception of Communications Commissioner - July 2016
•
although random sampling may only detect one error, this will lead to all error
instances of that type being investigated and reported;
the inspectors continue to examine applications until they reach the point that
they are satisfied that what they have examined is an accurate representation
of the public authority’s compliance.
7.45 Query based examinations.47 We engage directly the software companies that
supply secure auditable systems for administering communications data applications in
the majority of the police forces and law enforcement agencies (who between them
account for approximately 90% of the communications data requests). The software
companies have developed capabilities to enable IOCCO to retrieve data by means of
query based examinations relating to the applications so as to give better insight into all
of the activities undertaken by an authority. This enables specific areas to be tested for
compliance and trends and patterns to be identified from the extraction of information
from large volumes of applications, for example:
•
•
•
extraction of named DP and their recorded considerations for each application
to check they are discharging their statutory duties responsibly, i.e. that they
are not rubber stamping applications, that they are of the appropriate rank
or level to act in that capacity, that they are independent of the investigation
or operation;
requests where service use information or traffic data has been applied for
over lengthy time periods to check relevance and proportionality;
the acquisition of particularly intrusive data sets to examine the proportionality
and intrusion considerations balanced against the necessity.
7.46 We are able to examine, within the operational environment, the interference
actually being undertaken. In a scientific sense, we test the operational hypothesis set down
in the initial application that was authorised. When an application for communications
data is submitted the proportionality and collateral intrusion considerations in particular
are based at a certain point in time and, importantly, prior to any interference being
undertaken. In our view, in practice, an additional and appropriate test as to whether
something is, was or continues to be proportionate to the interference undertaken can
only be obtained by scrutinising the operational conduct carried out or, put another way,
the downstream use of the material acquired for example by examining:
•
•
•
•
•
how the material has been used / analysed;
whether the material was used for the stated or intended purpose;
what actual interference or intrusion resulted and whether it was proportionate
to the aim set out in the original authorisation;
whether the conduct become disproportionate to what was foreseen at the
point of authorisation and in instances where future data is being acquired
why the operational team did not initiate the withdrawal of the authority; and
whether any errors or breaches resulted from the interference or intrusion.
47 Query based examinations involve searches against defined criteria or subjects.
www.iocco-uk.info
57