MR JUSTICE BURTON
Approved Judgment
“. . . that there are arrangements for securing that no information is
obtained by GCHQ except so far as necessary for the proper discharge of
its functions and that no information is disclosed by it except so far as
necessary for that purpose or for the purpose of any criminal proceedings .
. .”
ix)
Thus, specific statutory limits are imposed on the information that each of the
Intelligence Services can obtain, and on the information that each can disclose.
Further, these statutory limits do not simply apply to the obtaining of
information from other persons in the United Kingdom or to the disclosing of
information to such persons: they apply equally to obtaining information from
or disclosing information to persons abroad, including foreign intelligence
agencies. In addition, the term “information” is a very broad one, and is
capable of covering e.g. communications and communications data (otherwise
referred to as ‘metadata’ or ‘traffic data’, to which we refer in paragraph 64(i)
below) that a foreign intelligence agency may have obtained and passed to the
Intelligence Services.
x)
By s. 19(2) of the Counter-Terrorism Act 2008 (“CTA”):
“Information obtained by any of the intelligence services in connection with
the exercise of any of its functions may be used by that service in
connection with the exercise of any of its other functions.”
xi)
19.
By s.19(3) and (4) of CTA it is provided that information obtained by,
respectively, MI5 and MI6 for the purposes of any of its functions “may be
disclosed by it – (a) for the purpose of the proper discharge of its functions (b)
in the interests of national security (c) for the purpose of the prevention or
detection of serious crime, or (d) for the purpose of any criminal
proceedings”: and there is a similar provision, but limited to (a) and (d),
relating to GCHQ in s.19(5).
Mr Eadie emphasises that there are thus significant statutory limits imposed on the
information that each of the Intelligence Services can obtain and disclose, which
apply both to obtaining and disclosing information in the United Kingdom and to
obtaining information from or disclosing it to persons abroad, including foreign
intelligence agencies: and he points to the breadth of the definition of the term
“information”, as referred to in paragraph 18(ix) above. Other relevant parts of the
statutory framework upon which Mr Eadie relies are:
i)
The Data Protection Act 1998 (“DPA”). Each of the Intelligence Services is a
“data controller”, and is required by s.4(4) of the DPA to comply with the
data protection principles in Part 1 of Schedule 1 to the DPA, subject to
exemption by ministerial certificate, and are in any event not exempted from
the obligation to comply with the fifth and seventh data protection principles,
which provide:
“(5) Personal data processed for any purpose or purposes
shall not be kept for longer than is necessary for that
purpose or those purposes . . .