The Investigatory Powers Tribunal, Bulk Data Collection and Despair

The IPT has given its latest judgment in the case of Privacy International v Secretary of State for Foreign and Commonwealth Affairs. Laurence Eastham thinks it is depressing.

The case of Privacy International v Secretary of State for Foreign and Commonwealth Affairs [2018] UKIPTrib IPT_15_110_CH is another visit to bulk data collection and the use, and alleged abuse, of the powers granted to the security services. The Investigatory Powers Tribunal has spotted problems that happened in the past but is now satisfied that everything now is going along nicely.

There was a great deal of material fed to the Tribunal that we cannot see because of its secret and sensitive nature. There are conclusions reached by the Tribunal that we cannot see because of their secret and sensitive nature. That is accepted as inevitable – at least by me.

What I find harder to accept is a Tribunal stating that it was misled a number of times by GCHQ staff:

 on a number of occasions in the evidence before us, statements by those in a position of responsibility at GCHQ have had to be subsequently corrected.  In each case such corrections have been made as a result of re-thinking or double-checking by the witness and his team of some of those issues. It is regrettable that mistakes were made to begin with and not identified earlier, and particularly in relation to Issue 1 the corrected errors have been influential in our conclusions (see paragraphs 12-15 and 40 below). We have identified in our accompanying CLOSED Judgment five further serious such errors which had been picked up by the Respondents themselves and corrected. To the extent that these errors were also present in information provided to the Commissioners, this will have meant that the Commissioners were not overseeing GCHQ on the basis of a complete and accurate picture of what it was actually doing. We are satisfied that the giving of the incorrect information constituted a breach of GCHQ’s duty to make disclosure to the Tribunal under s 68(6) of RIPA, but the duty is a continuing one and we accept that the breaches have now been remedied.

Moreover, the Tribunal has accepted that, whereas it previously thought that unlawful bulk data collection ceased in October 2015, it now considers that bulk data collection carried on unlawfully until November 2016. It also notes that there were failings in the past in that the Commissioners may not have known how many in-house contractors were involved and what they did or about the extent of industry sharing. But all of that is fine now.

So, why the despair? After all it is not as if the EU Commission will be looking for excuses to refuse a statement of adequacy for data protection or will be in any way influenced by a history of breaches that, we are assured, has now ceased.

Take no notice of my despair. I am probably just too hot.

Published: 2018-07-23T17:30:00


      This site uses cookies. By using the site you agree to our use of cookies as set out in our Privacy Policy.

      Please wait...