Report of the Independent Surveillance Review
19
be monitored, or a new selector to be targeted). In other cases, it exposes previously unknown
individuals or plots that threaten our security which would not otherwise be detected.50
1.48
A number of the allegations in the Snowden disclosures related to GCHQ’s bulkinterception capabilities and tapping of submarine cables, including the TEMPORA
and MUSCULAR programmes. The ISC noted that the agency’s access to bearers is
relatively small, but given the scale of interception, and the number of citizens whose
communications are affected, it considered that bulk ‘remains an appropriate term to
use when describing this capability’.51
Bulk Personal Data Sets
1.49
Large data sets containing personal information about a wide range of people have long
been owned and operated by public-sector authorities (examples include the electoral
roll, land registry and telephone directory). Most databases containing citizens’ health,
social security, tax and vehicle records are now computerised. The majority of the public
would recognise that this is done for logical and sensible reasons of governance and
efficient delivery of services.
1.50
The Driver and Vehicle Licensing Agency (DVLA), for example, maintains a bulk data set
containing forty-seven different fields of information about a vehicle. It is primarily used
for checking a vehicle is genuine by comparing the make, model, Vehicle Registration
Number, and Vehicle Identification Number.52 More recently, new databases have been
created for the purposes of law enforcement. Automatic number plate recognition
systems (ANPR) track and store the details of vehicles passing by a camera on major
roads and through city centres.53
1.51
The legal basis for the acquisition of bulk personal data sets by the SIAs has been cited
as the Intelligence Services Act 1994 (ISA 1994) and the Security Service Act 1989 (SSA
1989).54 The Acts do not explicitly or implicitly address bulk data sets, but they do allow
the SIAs to conduct intelligence and security operations which, the SIAs have argued,
extends to examining data sets. In March 2015, the use of bulk personal data sets by the
intelligence agencies was avowed for the first time.
1.52
Such data sets may be acquired through overt and covert channels. They may be data
sets that only the government and its agencies have authorisation to access, such as
passport data. The SIAs can also find open-source, bulk personal data sets online, and
50. ISC, Privacy and Security, p. 33.
51. Ibid., p. 27.
52. Driver and Vehicle Licensing Agency, ‘Bulk Data’, V995/1, <https://www.gov.uk/
government/uploads/system/uploads/attachment_data/file/394766/V995X1_090115.
pdf>.
53. Home Office, ‘2010 to 2015 Government Policy: Policing’, Policy Paper, 8 May 2015.
54. ISC, Privacy and Security, p. 56.