BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM JUDGMENT
145
367. According to paragraph 7.5 of the IC Code, where intercepted
material is disclosed to the authorities of a country or territory outside the
United Kingdom, the agency must take reasonable steps to ensure that the
authorities in question have and will maintain the necessary procedures to
safeguard the intercepted material, and to ensure that it is disclosed, copied,
distributed and retained only to the minimum extent necessary. The
intercepted material must not be further disclosed to the authorities of a
third country or territory unless explicitly agreed with the issuing agency,
and must be returned to the issuing agency or securely destroyed when no
longer needed (see paragraph 90 above).
368. The Court considered very similar provisions in Kennedy; although
paragraph 7.5 is new, paragraphs 7.3, 7.4 and 7.6 in the 2016 IC Code are
identical to paragraphs 6.4, 6.5 and 6.6 of the previous version. It was
satisfied that the provisions on processing and communication of intercept
material provided adequate safeguards for the protection of data obtained
(see Kennedy, cited above, § 163). In the present case, however, the
applicants have expressed concern about an aspect of the procedure which
was not addressed in Kennedy; namely, the requirement that disclosure and
copying be “limited to the minimum necessary for the ‘authorised
purposes’”, when something might be considered “necessary” for an
“authorised purpose” if it was “likely to become necessary”. As “likely to
become necessary” is not further defined in RIPA or the IC Code, or indeed
anywhere else, it could in practice give the authorities a broad power to
disclose and copy intercept material. Nevertheless, it is clear that even if
disclosure or copying is “likely to become necessary” for an “authorised
purpose”, the material can still only be disclosed to a person with the
appropriate level of security clearance, who has a “need to know”.
Furthermore, only so much of the intercept material as the individual needs
to know is to be disclosed; where a summary of the material would suffice,
then only a summary should be disclosed.
369. Therefore, while it would be desirable for the term “likely to
become necessary” to be more clearly defined in either RIPA or the IC
Code, the Court considers that, taken as a whole, section 15 of RIPA and
Chapter 7 of the IC Code provide adequate safeguards for the protection of
data obtained.
- The circumstances in which intercept material must be erased or
destroyed
370. Section 15(3) of RIPA and paragraph 7.8 of the IC Code require
that every copy of intercepted material or data (together with any extracts
and summaries) be destroyed securely as soon as retention is no longer
necessary for any of the section 5(3) purposes (see paragraphs 74 and 90
above). In practice, this means that intercepted material which is filtered out
in near real-time is destroyed. Similarly, following the application of