Snoopers' Charter restrictions proposed by Government after EU court rules data collection powers illegal

Sweeping surveillance powers handed to police and other authorities by the controversial “Snoopers’ Charter” could be transferred to an independent body after the EU’s highest court ruled them illegal.

The Home Office is launching a seven-week consultation on proposed changes to the Investigatory Powers Act 2016, which had allowed police to authorise their own access to phone and internet records.

Alongside other public bodies, police may have to apply to the new Office for Communications Data Authorisations, which will be set up with its own headquarters and dedicated staff to consider applications from more than 600 authorities.

The internal authorisations previously carried out by senior officers and officials in the Border Force, Department for Work and Pensions and HM Revenues and Customs will only be permitted in cases of “validly established urgency”, the consultation document states.

It also proposes limiting the use of communications data to serious crimes that would be punished by prison sentences of at least six months, involve terrorism, violence, privacy breaches, significant financial gain, or are committed by a government body or company.

The changes aim to comply with a ruling the European Court of Justice that found the Data Retention and Investigatory Powers Act 2014 (DRIPA) violated EU law by allowing the “general and indiscriminate retention” of data without independent oversight.

But the Government claims the ruling did not apply to communications data requests “made for national security purposes” or the activities of MI5, MI6 and GCHQ.

Amber Rudd said proposed safeguards comply with the ECJ ruling “while still allowing the police to use communications data to solve crimes, catch paedophiles and protect the public”.

The Home Secretary said communications data is used in 95 per cent of cases handled by the Crown Prosecution Service’s organised crime division, and has been utilised in every major counter-terrorism investigation over the past decade.

Ms Rudd added that more than half of the data sought in child abuse cases is more than six months old and may not have been available “if the Government did not have the ability to ask providers to retain communications data”.

The National Police Chiefs Council said more than 700,000 items of communications data are required annually for investigations encompassing child abuse, hate crime, terrorism, cyber crime, gangs and fraud.

Assistant Chief Constable Richard Berry, the lead for communications data, said the current authorisation regime was already “highly professional and accountable” and was regulated by independent inspectorates.

“Communications data is an essential tool for prevention and investigation in an increasingly digitalised world,” he added.

“It is vital that our capacity access remains intact and fit for the future, while ensuring there is trust and confidence in what we do.”

The prosecution of Lostprophets singer Ian Watkins and cases that saw serial killers, grooming gangs and child abusers caught are among those cited by the Home Office to show the value of communications data.

The information in question shows who made a communication, when, where and how, but does not include what was written or said – that is separately covered by interception laws requiring ministerial authorisation.

Communications data is gained by handing “retention notices” to third-party service providers, who will be given a new code of practice laying out bolstered safeguards.

Restrictions could be imposed on the scope of applications, meaning investigators must stipulate individual services and particular types of data for a set amount of time – ending when the practice is “no longer necessary and proportionate”.

Opposition politicians and activists have long called for stronger safeguards in DRIPA, which was drawn up after a report by the Independent Reviewer of Terrorism Legislation recommended a new law to clarify investigatory powers.

A legal challenge was brought by then backbencher David Davis, now the Brexit Secretary, and Labour’s deputy leader Tom Watson, seeing them win a High Court victory before the case was referred to the ECJ following a government appeal.

Mr Watson welcomed “significant concessions” made by the Home Office but said its proposals were flawed and remained open to legal challenge.

“The current legislation fails to protect people’s fundamental rights or respect the rule of law,” he said.

“Ministers aren’t above the law – they don’t get to pick and choose which rights violations they address and they can’t haggle with the courts to avoid properly protecting people’s freedom.

“All of the fundamental safeguards demanded by the court must now be implemented.”

The ECJ said that obligations imposed in both the UK and Sweden for electronic communications providers to store traffic and location data violated EU law.

“Such national legislation exceeds the limits of what is strictly necessary and cannot be considered to be justified within a democratic society,” its ruling said, adding that new laws could be imposed allowing the targeted retention of data to fight serious crime, terror and defend national security.

The ECJ said the law must give precise circumstances to allow the measure and guard against its misuse, adding that access to data must be subject to prior review by a court or independent body.

“The fact that the data is retained without the users of electronic communications services being informed of the fact is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance,” the judges noted.

Following the ECJ ruling, DRIPA was repealed on 31 December and replaced by the Investigatory Powers Act 2016 after House of Commons debates that saw the Liberal Democrats, Labour and Scottish National Party call for amendments.

Liberty, which supported Mr Watson’s original case, said the Home Office’s changes still violated the ECJ’s demand for people to be notified when their data was accessed, and for it to be retained within the EU.

But the Government said routinely notifying those under investigation would “unnecessarily inform suspects” of the techniques used and damage probes, pointing out that people are already notified in court cases.

It said it was necessary to ask some companies based outside the EU to retain data, but that additional requirements in the code of practice would ensure “comparable [standards] to those required by EU data protection laws”.

Martha Spurrier, the director of Liberty, dismissed the plans announced on Thursday as “a cop-out” and called the definition of serious crime too broad.

“It fails to propose the robust system of independent oversight that is so vital to protect our rights and ignores other critical changes demanded by the court,” she added.

“People in the UK deserve a surveillance law that keeps our country free and democratic – that protects our privacy, our freedom of speech, our right to protest and our free press. This is window dressing for indiscriminate surveillance of the public.”

But Ben Wallace, the security minister, said the importance of communications data “cannot be overstated”.

“This is an issue of public importance,” he added. “All responses will be welcomed and carefully considered.”

View the consultation website here