The Investigatory Powers Tribunal, Bulk Data Collection and Despair

The case of Privacy
International v Secretary of State for Foreign and Commonwealth Affairs [2018]
UKIPTrib IPT_15_110_CH is another visit to bulk data collection and the use,
and alleged abuse, of the powers granted to the security services. The Investigatory
Powers Tribunal has spotted problems that happened in the past but is now satisfied
that everything now is going along nicely.

There was a great deal of material fed to the Tribunal that
we cannot see because of its secret and sensitive nature. There are conclusions
reached by the Tribunal that we cannot see because of their secret and
sensitive nature. That is accepted as inevitable – at least by me.

What I find harder to accept is a Tribunal stating that it
was misled a number of times by GCHQ staff:

 on a number of occasions in the evidence
before us, statements by those in a position of responsibility at GCHQ have had
to be subsequently corrected.  In each case such corrections have been
made as a result of re-thinking or double-checking by the witness and his team
of some of those issues. It is regrettable that mistakes were made to begin
with and not identified earlier, and particularly in relation to Issue 1 the
corrected errors have been influential in our conclusions (see paragraphs 12-15
and 40 below). We have identified in our accompanying CLOSED Judgment five
further serious such errors which had been picked up by the Respondents
themselves and corrected. To the extent that these errors were also present in
information provided to the Commissioners, this will have meant that the
Commissioners were not overseeing GCHQ on the basis of a complete and accurate
picture of what it was actually doing. We are satisfied that the giving of the
incorrect information constituted a breach of GCHQ’s duty to make disclosure to
the Tribunal under s 68(6) of RIPA, but the duty is a continuing one and we
accept that the breaches have now been remedied.

Moreover, the Tribunal has accepted that, whereas it
previously thought that unlawful bulk data collection ceased in October 2015,
it now considers that bulk data collection carried on unlawfully until November
2016. It also notes that there were failings in the past in that the
Commissioners may not have known how many in-house contractors were involved
and what they did or about the extent of industry sharing. But all of that is
fine now.

So, why the despair? After all it is not as if the EU
Commission will be looking for excuses to refuse a statement of adequacy for
data protection or will be in any way influenced by a history of breaches that,
we are assured, has now ceased.

Take no notice of my despair. I am probably just too hot.