Joint Committee on Human Rights

Oral evidence: [Legislative Scrutiny: Investigatory Powers Bill], HC [954]
Wednesday 27 April 2016

Ordered by the House of Commons to be published on 27 April 2016.

Watch the meeting

Members present: [Ms Harriet Harman (Chair); Fiona Bruce; Ms Karen Buck; Baroness Hamwee; Lord Henley; Baroness Lawrence of Clarendon; Jeremy Lefroy; Mark Pritchard; Baroness Prosser; Amanda Solloway; and Lord Woolf

Questions 1–7

Witness[es]: Professor Iain Cameron, Faculty of Law, University of Uppsala, Professor Martin Scheinin, International Law and Human Rights, European University Institute, and Michael Drury CMG, Partner, BCL Burton Copeland

Q1   The Chair: Martin, Michael and Iain, welcome to this inquiry session of the Joint Committee on Human Rights. As you know, this is a Joint Committee of Lords and Commons Members. Our specific focus is to pick your brains and glean your wisdom on the Investigatory Powers Bill, where both the Commons and the Lords want to understand views about the human rights issues raised by the Bill. Thank you very much indeed for bringing your expertise to us.

Could I start by asking the first question? In a nutshell, could you imagine yourself as me at the Report stage of the Bill getting up and asking the House of Commons what human rights issues are addressed thoroughly in the Bill that we do not need to worry about, because all the checks, balances and accountability are in there; what are the ones that we do need to worry about, because there are issues that should be addressed but have yet to be addressed; or what are the issues that cannot be addressed and should not be in the Bill at all? If you could give us a brief summary, it would be helpful. If possible, could you avoid using initials and terms that we will not understand? I have noticed that the Bill creates a whole new language, some of it using ordinary words to apply to something they do not mean at all, and it sets up organisations with initials very like those of other organisations that do something completely different. We are very much on it, but we need your help to be as clear as possible. That is your biggest challenge.

Professor Scheinin: I am happy to give that list in a nutshell. There are issues to which I wish to return later with more substantive answers; they relate mainly to proportionality and necessity. That is already the conclusion: I see the biggest failures there.

Let us go through it systematically. A human rights assessment would start from the identification of which human rights are relevant. We see some of this in the Bill or in the Home Office memorandum on compatibility with the European Convention on Human Rights. We see references to privacy, and briefly to freedom of expression and the right to private property, but there is no comprehensive listing of what other human rights might be implicated. I think one should look into non-discrimination, which may be impacted through so-called profiling based on data sets. In relation to data, one should look into the distinction between the general right to privacy and the more specific right to the protection of personal data, which is now in Article 8 of the EU Charter of Fundamental Rights. Beyond freedom of expression, one should look into freedom of association, assembly and religion, plus freedom of movement specifically now that location data is so important in all kinds of metadata, including surveillance conducted through mobile phones. Freedom of movement would belong to the impacted rights. We would need a list of which rights are impacted.

Two things are addressed properly. The Bill is a great step forward in providing a basis prescribed in law, as many of the qualified rights require. Through the Bill there would be a legal basis for many of the interferences in human rights. The other point properly addressed is legitimate aim. The Bill operates mainly through the legitimate aim of national security, which is mentioned in Article 8 of the European Convention on Human Rights.

There are somewhat more fuzzy areas around national security that are not treated as systematically—the detection and prevention of serious crime and the economic well-being of the country when there is a link to national security—but, as such, these three are legitimate aims under Article 8, at least the right to privacy. That is the good news.

The worst part relates to the issues I briefly mentioned. Even if the Bill mentions proportionality more than 100 times and necessity at least 100 times, there is no proper proportionality or necessity assessment. The Bill is completely mistaken on that point. It requires a proportionality assessment between the conduct, the surveillance, and the aim of that surveillance, such as national security, but there is no human rights assessment. Any proper proportionality assessment would require one first to go through the human rights impact, and that would need to remain proportionate, not in relation to the aim of national security but to the benefit to national security produced through surveillance. One would compare the intrusion into privacy and other human rights with the security benefit obtained through surveillance, and that is not addressed at all. As a consequence, there is no necessity assessment either. The ultimate necessity assessment is that, when proportionality has been established, the European Court of Human Rights would say, “hence necessary in a democratic society”. I will stop there. That is my list in relation to your question.

The Chair: On the last one, you think it is not implicit and it should be explicit. If it were made explicit, it would satisfy your concerns.

Professor Scheinin: One would need to define the proportionality assessment required from the Secretary of State, or anybody else issuing the warrant, and from the Judicial Commissioner who reviews the decision to issue a warrant. Both of them should include a proper proportionality assessment and, on that basis, determine the necessity of the measure in a democratic society, once it has already been assessed that the intrusion into human rights is deemed proportionate compared with the benefit obtained.

You asked me a follow-up question, so I will finish with a follow-up answer. Unfortunately, that test would be very demanding for bulk powers. It is probably impossible to do a proper proportionality assessment when we deal with a warrant that relates to the authorisation of bulk powers, because the information is not granular enough to allow for an assessment of the impact on human rights, hence you would not have the data. That is where the bulk powers would be in deep trouble, and that is why it is legitimate to say that the European courts are very wary of any mass surveillance or bulk powers. When you are dealing with big groups of individuals situated in different situations in different scenarios, and using different technical methods for surveillance, you lose the required granularity of the information to conduct a proper proportionality assessment. This becomes a fundamental problem. It is very hard to fix simply by writing a proper proportionality clause in the bulk powers, but that would be the best we could try.

The Chair: You do not think that that can be addressed by safeguards further down the line, when it comes to the use of the material obtained under the bulk powers.

Professor Scheinin: I do not think so, because the law has to be necessary and proportionate, and then the decisions concerning warrants, which are the first step in implementation, also have to be necessary and proportionate in order to allow for actual implementation that remains within the limits of what is proportionate and necessary.

Lord Woolf: Does that mean that there should be no ability to exercise the bulk powers?

Professor Scheinin: I have great hopes concerning so-called targeted powers and their development towards addressing scenario-based situations where a particular method of surveillance is applied. Then it becomes controllable. We could still deal with a large group of individuals, but they would be so-called thematic or targeted powers instead of what are now named in the Bill as bulk powers.

Lord Woolf: I think that that means your answer to me is that there should not be any bulk power as such.

              Professor Scheinin: The short answer is: correct.

The Chair: But you think that the targeted and thematic could be bulked out.
 

Professor Scheinin: They are pretty bulked out already. Many countries are able to cope with them, which means that there need to be many more warrants. Instead of having a dozen warrants that would be the basis for intrusions that affect millions of situations on a daily basis, one would need to have, say, 2,000 warrants.

The Chair: I guess the question is whether you think it is an intrusion at that stage.

Q2   Baroness Hamwee: Thinking of the answers we tend to be given by Ministers when we raise criticisms like this, can I assume that you would also say that the Human Rights memorandum is inadequate on the points that you have raised?
 

Professor Cameron: On the whole idea of human rights compatibility, it is worth repeating again and again that the European Convention on Human Rights is a minimum level of protection. The first question we have to ask ourselves is: are we satisfied with that minimum level of protection?

The second question is that in this respect the United Kingdom has form, if I can put it that way. The United Kingdom has engaged repeatedly in minimalist interpretations of the requirements of the convention: the Interception of Communications Act 1985; the Intelligence Services Act 1994; and RIPA 2000. All that legislation was designed to go just over the threshold of acceptability. In RIPA, it probably did not succeed even then. There is every reason to study the Bill with considerable care, because of what the UK has done in the past.

Martin has already taken up the major omissions, but the crucial case law is Weber and Saravia, which deals with the German system of signals intelligence, and the more recent Grand Chamber case of Roman Zakharov. Admittedly, this came at quite a late stage, but the points made in Roman Zakharov are of crucial importance for the Bill and are not mentioned in the Explanatory Memorandum at all. That gives you an answer. There is crucial case law that has not been taken into account.

The Chair: But do you think it could be addressed?

Professor Cameron: Yes, even at this late stage, but there are several problems with the Bill. I agree with Martin that the biggest step forward is transparency, but on both authorisation and oversight the Bill is deficient. Martin began by talking about necessity and proportionality. The crucial point to remember is that David Anderson’s proposal was that only on issues of foreign policy connected to national security would the Secretary of State continue to authorise. In that area, the Judicial Commissioners, or in this case the Investigatory Powers Commissioner, would have the role of a kind of double-lock in checking the application of the standards of judicial review. In all the other areas, the Judicial Commissioners and Investigatory Powers Commissioner were to do the work of authorisation in the way Martin described.

We now have a system where, when it comes to authorisation, the Judicial Commissioners and Investigatory Powers Commissioner apply the standards of judicial review, which again is a very low threshold. They have to check that no reasonable Secretary of State would have done such a thing. They are asking themselves: has the Secretary of State gone barking mad? I do not think that is the right test. I do not think there is a risk of the Secretary of State going barking mad—although some people might argue that there is such a risk in relation to certain Secretaries of State. The test should be put on a different level. I have a lot of remarks about oversight, but we can come to those later.

Michael Drury: As the Committee will know, I was director of legal affairs at GCHQ for 15 years between 1996 and 2010, and I was one of the midwives to the present power under the Regulation of Investigatory Powers Act—RIPA. The situation described by Martin and Iain is, frankly, not one that I recognise and not one that I think the law at present encompasses. Iain is right to mention Weber and Saravia. That sets a standard in Strasbourg jurisprudence that interception in bulk—the phrase used in the Bill—should meet. It requires six elements, which I will not mention now because of time. In that case the German system, which in German parlance is called “strategic monitoring” and is in essence the same as we are considering in the relevant part of the Bill concerning bulk interception, was judged against those requirements: specificity about what is being intercepted, the class of people being intercepted, time limits, reviews and so on. There is a standard.

While the Bill is far from perfect and clearly there are things to change—I speak only for myself—on any sensible view it meets the standards set out in Weber and Saravia. In a sense, that is not surprising, for a couple of reasons. First, in relation to exhaustive scrutiny of the law as it is going to be, one cannot imagine a more exhaustive scrutiny than that performed by David Anderson in his review of terrorism legislation and by three Committees of Parliament concerning the Bill. The thinking behind the Bill is significant. I hold no brief for the Home Office, but it is fair to say that it has responded to the changes suggested by the various Committees.

As to the second reason, I very much disagree with Iain’s suggestion that RIPA does not comply with the law. The position is quite the contrary in numerous challenges before the Investigatory Powers Tribunal. With the greatest respect to Members of the Committee, if they have not read the judgments of the tribunal concerning bulk interception, I strongly recommend that they do so. A tribunal consisting of High Court judges and very eminent lawyers has carried out the most methodical and thorough investigation into bulk powers and has found that they are consistent with the Strasbourg and Human Rights Act requirements. To go back to Martin’s point, as a matter of fact they are in law both proportionate and necessary, and are exercised in that way.

I will come to the detail as we talk through the issues this afternoon, but the Committee ought to start from the premise that an enormous amount of legwork has been done by independent parties, parliamentarians and people such as the Royal United Services Institute. The way the Bill is drafted reflects what the law currently is, not some illusion of the law believed to be the case by the Home Office.

              Professor Scheinin: If I may address the question posed to me about the Home Office memorandum, I think it is very inadequate, above all because it does not include a proper human rights impact assessment either. One would expect that, in order to certify compatibility with the European Convention on Human Rights, the Home Secretary would require a memorandum that conducts a human rights assessment. That is missing. It is still based on repetition of the concept of proportionality, without conducting a proper proportionality assessment. Once again, proportionality assessment is comparing the human rights intrusion with the security benefit obtained through the measure; it is not about comparing the surveillance measure with its own aim. That is almost a tautology.

The Chair: Would they not say that is implicit, and that that is the state of mind in which they would approach it?

Professor Scheinin: It is far from implicit. There is a legal definition of what the proportionality assessment by the Secretary of State issuing the warrant is; it is comparing the conduct of the surveillance with the aim of the surveillance, and human rights have no place. Privacy is not even mentioned there.

              The point to be addressed to Michael is that the Germans have a very sophisticated understanding of what the proportionality test is under their own constitutional law. It has been the main inspiration for the understanding of proportionality in the European Convention on Human Rights and the European Court of Human Rights. It is about assessing the impact on German constitutional rights, and subsequently European human rights.

The Chair: Are you saying that if it was implicit it might be better, but it is explicit and wrong?

              Professor Scheinin: It is explicit and wrong.

The Chair: If it was implicit, it might be right.

Professor Scheinin: The Judicial Commissioner is limited to a narrow judicial review of factors that are explicit in the wrong definition of proportionality.

The Chair: Which is Iain’s point.

Professor Scheinin: Hence, the Judicial Commissioner cannot under this Bill conduct a proper proportionality assessment.

Professor Cameron: Michael and I could probably argue until the cows come home about whether or not RIPA was compliant with the convention. We will get the final word on that from the European Court of Human Rights. However, the Snowden revelations came as a terrific surprise to most people—I think it is fair to say that. Admittedly, there was perhaps a small group of lawyers who said, “Oh no, these powers were quite predictable under RIPA”, but almost everybody else did not think they were. You can see that plainly when RIPA’s two sections dealing with that are replaced by 74 clauses in the present Bill. That makes it pretty clear that there was a predictability and foreseeability problem with RIPA. However, we should be looking forward, and the issue before this Committee is whether the new Bill satisfies the requirements—and there Michael and I are in definite agreement that it is Weber and Saravia that we should be looking at.

You could make the argument that Weber and Saravia’s standards are not entirely applicable to the UK, which has a slightly different system. I am interested to hear that Michael considers that they are more or less applicable. I would say that there are at least two standards that are not satisfied and they are made very clear in Weber and Saravia. I refer to the nature of the offences that give rise to an interception. We still have this amorphous national security ground, which is a problem, and the definition of categories of people liable to have their communications intercepted. Even that is very unclear. Then we have the very clear statement made by the court in Weber and Saravia that there are three points at which rights are infringed by bulk interception.

I am not in agreement with Martin on that point. Maybe Michael and I are in a little more agreement. The European Court of Human Rights has accepted bulk interception in Weber and Saravia, but, as Martin points out, the European Court of Justice may not have accepted it. It is important to stress that. The European Court of Human Rights has accepted bulk interception under certain very tight conditions. The issue is: are we fulfilling these conditions in the present Bill? There are three points at which rights are infringed by bulk interception: first, issuing the selectors; secondly, the point of processing; and, thirdly, the point of destruction.

In other countries the first two issues are separated. In Sweden, the issuing of selectors is decided by a court or a quasi-judicial organ. The processing and oversight is monitored by another quasi-judicial organ, and then there is a complaints procedure at the point of destruction. In the British Bill there is a problem, because the same body engages in the first two functions. It is a classic accountability problem, in that the oversight body is overseeing itself to some extent, and that is problematic. To be fair to Britain, it is also problematic in the German system. I think you need to separate the two issues; you need separate bodies.

The Chair: Do you have in mind which separate body it would be, or do you want another body established?

             
Professor Cameron: The proposed British system is that the Judicial Commissioners are part of the authorisation process, but the second point—processing—is very important. Who monitors how the warrant has ended up, if I can put it that way, and the information you have obtained from the warrant? Who monitors that part of the interference? Who is looking at what information the human analysts in GCHQ wish to retain, and why? GCHQ will probably be behaving with a lot of professionalism in that regard, but the issue is: who is doing the monitoring of that?

The Chair: What is the answer to my question? Who do you think should be doing it?

Professor Cameron: You can have a separate system, and something is envisaged in the Bill, but it is unclear to me whether it is sufficient. It is the Information Commissioner. You need a body that is separate from the authorisation body, which follows up on what happened with the authorisation body’s warrant, if I am making myself clear—or clear-ish.

The Chair: You are. The point is that two separate functions should have two separate people doing them, because the second part is to some extent a check on the first part.

Professor Cameron: Yes.

The Chair: Although I am not sure that overall accountability would not be there to pick that up.

Q3   Mark Pritchard: I understand the point about process and functions, but is your wider concern or complaint that you do not like the fact that previously there were three commissioners and the proposal now is for one?
 

              Professor Cameron: No. I think that is a good proposal; it is a good idea. The commissioners were fragmented, so I agree with the idea of putting them all together. What I am getting at is that there are problems in giving the commissioners both an authorisation role and an oversight role because, as Harriet said, to some extent they are then watching themselves.

The Chair: Is it oversight, or is it two stages of authorisation?
 

              Professor Cameron: They are given a role in the selection.

The Chair: Which is authorisation.

Professor Cameron: Yes, on the selection of the bulk material. You are right; that is an authorisation process as well.

The Chair: There is another authorisation.

Professor Cameron: Yes. You need to know what GCHQ does with the material. Why does it keep some information and delete other information? To give an example, the Swedish oversight body has online access to the Swedish equivalent of GCHQ’s database—not all the databases, but the “keep” database, where they keep the information. That body has online access to that. If names come up in that database, it can ask, “Why have you kept information on this particular person?” and then follow the authorisation process all the way.

Mark Pritchard: It is always useful referencing Sweden—I did so in a speech on a separate matter yesterday—or Germany, but we are talking about the United Kingdom. As long as the United Kingdom is compliant with the convention and other European and UK legislation, that is all that matters. The fact is that the Swedish and the Germans have a completely different cultural and political perspective on such issues.

Professor Cameron: I agree that—

Mark Pritchard: If you are referencing Sweden and Germany as the defining point in pointing out a contravention of the convention in the proposed Bill, I accept that, but if you are making a wider cultural point about the social environment and how people view the intelligence services, bulk data and so on, that is entirely different.

              Professor Cameron: I agree with you that it is entirely different. That is not the point I am making. The German example is very interesting because the leading case is German, so you have to understand how Weber and Saravia works and how the German system works. The Swedish example is interesting because it shows that it is possible to split the authorisation issue from the oversight issue, which is the best way to do it. Other countries do that, too; the United States does it.

The Chair: I thought we had separate systems for authorisation and oversight. Are there not questions about whether the authorisation is sufficiently focused and at a high enough level, with the right criteria, and then whether the oversight is sufficient?

Michael Drury: I do not recognise the system described by Iain. It seems to me that the law is perfectly clear as it is at present, and it is also clear in the Bill. Do not get me wrong: there are issues with the Bill that I am happy to deal with in due course, but this part of the law is perfectly clear.

I also want to touch on Iain’s point about judicial review. Looking at the bulk warrants, there is in fact a series of controls. The first comes in the authorisation control, and that is to be agreed by the Secretary of State and the Judicial Commissioner. It seems to me that the logical position of where Iain goes is that we would be better off not having two people and having only one person who is a judge. You can have a debate about that, but on national security issues there are real matters of principle that require the Secretary of State’s involvement.

Let me read what Clause 123(1) says: “the Judicial Commissioner must review the Secretary of State’s conclusions as to the following matters … whether the warrant is necessary as mentioned … whether the conduct that would be authorised by the warrant is proportionate to what is sought to be achieved by that conduct”. It goes on to say that they will apply the judicial review test. The judicial review test is, of course, flexible. I think the Interception of Communications Commissioner and the Chief Surveillance Commissioner had a disagreement about that before the Committee considering the Bill in the House of Commons. Certainly the Interception of Communications Commissioner was happy to take the view that the judicial review test is flexible enough to allow proper consideration of the warrant, not the extreme of whether it is ultimately an assessment of whether or not the Secretary of State has gone mad. As to the idea that in some way in judicial review of national security cases there is complete judicial deference, that may have been the thinking way back in 2000, but it certainly is not the thinking now. Look at control orders and TPIMs; they apply the judicial review test, but there is real scrutiny of the Secretary of State’s decision. I suggest that you have the best of both worlds here: the political and the wider public interest decision, which is what the Secretary of State will be looking at, apart from being concerned with necessity and proportionality; and the legal scrutiny that lies on top of it.

The assessment of what then happens is, as you rightly say, Madam Chairman, a separate issue, and that is provided for in the Bill. There are clear obligations on a separate person—the Investigatory Powers Commissioner—who under Clause 196 has functions relating to the interception of communications, the acquisition or retention of communications data and so on. He is charged with making sure not only that the warrants are properly put in place and administered but, as is the present Interception of Communications Commissioner, that the principles being applied are the proper ones—that the proper guidance, below the water line, which you, as members of the public for these purposes, do not see, is being properly applied. It is there in the Bill.

On the suggestion that there is some obscuring of the roles, I go back to what I said originally. On the contrary, at present there is a very strong judgment by the Investigatory Powers Tribunal—subject to challenge in Strasbourg, but a very senior tribunal—that the present system is proportionate and meets the proportionality and necessity requirements, and there is an enhancement of that. Therefore, on that particular issue I simply do not recognise what my colleagues are saying.

              Professor Scheinin: It was good that Michael referred to necessity and proportionality, because the problems are exactly there. What is referred to as necessity is repetition of the notion of legitimate aim, and what is referred to as proportionality is the specificity of the measure. Is the surveillance fit for purpose? Does it produce the legitimate aim for which it is justified? There is no proportionality assessment in the text that was quoted in defence of human rights law.

The Chair: Martin, by way of devil’s advocate, it looks to me, from the clause Murray has helpfully drawn my attention to, that there is a very specific provision in Clause 21(1)(b), but that would not in any way preclude the overall proportionality that would have to be in the mind of everybody at all times. Just because they have used the “p” word, I do not read it as excluding the other. Am I wrong?

Professor Scheinin: Unfortunately, you are wrong, Madam Chairman. I am sorry to say it. That phrase is repeated as the definition of proportionality assessment over and over again.

The Chair: But you think it excludes it.

Professor Scheinin: Nowhere is there a reference to human rights together with the notion of proportionality.

The Chair: My point is that, because it is intrinsic, is it not implicit anyway in its own different terms, even if it is used differently here? If I was a judge, I would say that it was no good saying that we do not have to consider proportionality and accept it as the means and the end, in terms of its own mechanisms; you have to have wider proportionality as well.

Professor Scheinin: If I were the judge, I would say that I am constrained by the clause relating to the standard of judicial review, and my proportionality assessment is to compare the conduct with the aim of the surveillance.

Michael Drury: That is just not how the Human Rights Act works, and it is not what a judge would do. It seems to me that we are in a world in which form is taking precedence over substance.

Professor Scheinin: Now Michael is assuming that the Human Rights Act point is the clause about the proportionality assessment instead of the two dozen clauses in the Bill.

Q4   Ms Buck: To go back to something Martin said at the beginning, I need to have a picture painted of this, because we are talking conceptually, although very importantly. I need to understand in particular the relationship between bulk data and what I think you were saying about granularity. Show me what that looks like. You referred to the measure leading not to 100 but to 6,000 warrants. I cannot remember the exact figure. Why? What is the granularity that you think would be necessary to make it compatible? How would it break down? You are holding up something to show me a picture, but it is too far away. Paint the picture in words.
 

Professor Scheinin: I will leave copies of this publication. For three and a half years I was leader of a research consortium called SURVEILLE—Surveillance, Ethical issues, Legal Limitations and Efficiency—which sought to operationalise exactly this issue. How do we assess surveillance technologies and their human rights impact in order to determine the line between permissible and impermissible surveillance? We had a team of technologists— engineers, sociologists, philosophers and economists—who looked at what we called the usability of surveillance technology. That is what is here called necessity or proportionality.

We looked into the issue of whether a particular surveillance technology did what it was supposed to do. We gave points from zero to 10; we used 10 different dimensions—zero, half a point or one point—for each of those relating to specificity, cost efficiency, dependency on third parties and built-in privacy-by-design features of the technology. It is a fairly complex model. It is not exact mathematics, but the scoring is used to illustrate that some surveillance methods work better than others.

One of the conclusions was that, in order to work, the information must be granular. We must not look at vast bulk powers that through one warrant can address a million cases; we have to look at a scenario-based description. Here is a developing incident and we need to use a particular technology of surveillance to assess the usability of that particular method as compared with some others.

The other side of the equation was a human rights intrusion assessment done by a team of lawyers. We conceptually distinguished the importance or weight of a human right, typically privacy. How important is the dimension of privacy that is affected? One example is the metadata/content distinction—some issues are more important than others. The weight of the human right is multiplied by the depth of the intrusion. How deeply does the surveillance intrude into the dimension that is first quantified? We got an intrusion score and then we could say that the balancing of proportionality was about a comparison between the two. Which is higher: the usability score—the security benefit produced by surveillance—or the human rights intrusion resulting from the surveillance? That would be the framework for doing the so-called balancing.

We said we must know who are the individuals affected. Who are the individuals directly affected, the targets, and what is the collateral damage—the human rights impacts on third parties—because the scores would be different? But we could do it only in relation to a specific technology.

When you draft legislation, it is legitimate that you do not want to reveal all your technological secrets, but that is exactly why bulk powers become so problematic. There is insufficient granularity to do it at such an abstract level. You would need to do it at the operational level, and you would need to have clauses that compel the person who issues the warrant, the agency that performs the surveillance, the judicial commissioner authorising the surveillance and those who are conducting the oversight, to do all of it within the proper framework. This publication explains one model, which, by the way, was referred to in the follow-up resolution by the European Parliament of 29 October 2015, as a method to assess the necessity and proportionality of surveillance on multiple grounds.

The Chair: Is it a tool for authorisation or a tool for accountability?
 

              Professor Scheinin: It is a tool for drafting legislation, for authorisation, for judicial control of authorisation and for accountability afterwards. It is meant to be applicable at all stages.

The Chair: Although there are obviously a lot of thorny issues around bulk, we need to move to Sally’s questions.

Q5   Baroness Hamwee: They may be more of the same. I want to ask whether the Bill’s provisions for thematic targeted warrants are too broad. If they are, what should be done about them? Could you start by reminding us what we are talking about in terms of thematic targeted warrants?
 

              Professor Cameron: I can say a few words about them. The standards set in the Bill are rather vague. You can understand why they want the power of thematic gathering. There is a problem of transparency. The idea is that you do not necessarily need a common purpose, which is what you would normally think of as a requirement for a thematic approach, but you do not know how many people are involved so it is difficult to know how extensive the surveillance is. One of the big problems with RIPA was lack of foreseeability. It states that there is either a common purpose or a common pattern of activity, and it then requires the person seeking authorisation to be as clear as possible in the circumstances. There is such a requirement in the Bill. You are required to list the people as much as possible, or identify them as much as possible, but the major problem is one of transparency, which makes comparison and oversight more difficult. I do not think those are crippling problems for the Bill. That is not where the real problems lie. There are problems in making oversight more difficult, but those are not insurmountable.

The Chair: Harry, can we move to the point about reasonable suspicion? Martin, do you want to come in?

              Professor Scheinin: I will be very short. I repeat what Iain just said. I think targeted thematic powers are the way forward, because that is a step towards more granular information and a proper possibility of assessing proportionality between the human rights impact and the delivery of a security benefit. Of course, there are things to improve and one can ask whether the powers are too broad, but they are still a great step forward. I think that one should address GCHQ’s operational case, as well as David Anderson’s Annex 9 on his chosen cases, from the perspective of what could be done through thematic or targeted powers in relation to the cases described. That would lead to a much more informed discussion about proportionality.

Baroness Hamwee: Michael, you wanted to say something as well. You caught my eye.
 

              Michael Drury: Unless you want Lord Woolf to ask his question—I could pick up the two together.

The Chair: I am worried that we might get to a vote in the Commons before we have discussed reasonable suspicion, which is why I am being a bit snippy about the process.
 

Q6   Lord Woolf: I want to get your reaction. I can see that there may be a difference of opinion on this. I do not know whether you are already aware—you certainly will be—of the letter written to the Guardian that was meant to be signed by 200 lawyers saying that those who authorise interceptions should be able to verify a reasonable suspicion on the basis of a factual case. Do you disagree?

Michael Drury: I was asked to sign the letter and I would not do it, but perhaps that is neither here nor there. The answer is that I do not think that is the legal standard. It is not the legal standard that emerges from the Strasbourg cases as we have them at present. There are recent dicta in some of the Strasbourg cases that suggest a higher test. There is an argument about whether or not that suggests a higher test, so the answer is that I do not agree. It is certainly inimical to the nature of a bulk warrant, which, as Iain conceded this afternoon—or agrees with my view—is permissible in Strasbourg terms. The answer is that I do not agree, and I certainly do not think it is the legal test.

Professor Cameron: I have to come in on that. Earlier, I mentioned Roman Zakharov. This is the case where the “reasonable suspicion” point is made very clearly. I refer you to paragraphs 261 and 262 of that Grand Chamber judgment, the plenary judgment of the court. The Russian system for targeted surveillance—note well: targeted surveillance; Michael is right in that—makes it very plain that reasonable suspicion is necessary and that there is a factual basis. Michael and I can have an argument as to what extent the plenary judgment from Strasbourg is also applicable to bulk interception. The Strasbourg court has made it pretty clear that, broadly speaking, it considers the same type of test to apply to both types of activity. It says that in Weber and Saravia, which is, let us face it, an admissibility decision. Here we have a judgment from the Grand Chamber, the plenary of the court, setting out the standards.

The least that should be done is a proper analysis of the issue to determine whether reasonable suspicion can be made to work in the context of bulk interception. I would say that something similar could be made to work; the issue is the searching of the bulk material and how much you can expect reasonable suspicion to be built into that.

The Chair: It would not be bulk interception. Is not reasonable suspicion the second phase?

Professor Cameron: In searching.

The Chair: You have to be reasonable in the bulk interception you are going to do. For example, if you were looking at people’s shopping habits online—ordering paracetamol—that would not be reasonable. You have to be reasonable. Within the zone of reasonableness you do not have a suspicion, or you would be doing targeted. Is not what you are saying that you do not agree with bulk? You agree with targeted, but given the way data is at the moment in this world, you have to be reasonable. It is probably out there; you authorise yourself with the right standards and, if you think you are going to a next stage, you have a higher level.
 

              Professor Cameron: At the initial phase, when the material is being collected, GCHQalready attempts to limit the material it collects. It is not interested in taking absolutely everything at once to focus on bearers of interest or geographical areas of interest.

The Chair: But it has not yet crossed the threshold of suspicion.

Professor Cameron: No, but in the second phase you can build in something like reasonable suspicion. I am not saying that you necessarily build in reasonable suspicion as such, but you can build in something similar to it at the second phase of selecting the material gathered, going through it, dumping the stuff you do not need and keeping the stuff you need. That is why you then need a third phase, of oversight of the stuff that you have kept. Those stages are set out in the report of the Venice commission, and it is important that every signals intelligence operation has these types of stages and that there are safeguards at each of them.

Michael Drury: You have that “something similar”, which is necessity and proportionality at the selection stage, and you have the third leg of Iain’s stool, which is oversight by what will be the investigatory powers commission as to the way in which the data was processed, and strict rules as to destruction, handling and disclosure, all of which are on the face of the Bill.

Lord Woolf: To see whether I have it right, my understanding is that there are two overarching principles in what is proposed. The two overarching principles are that, irrespective of the factual situation, you have to guide yourself by asking, first, about necessity and, secondly, about proportionality. To do that, not only do you have to take into account what is being obtained but the purpose for which it is being obtained. If it is merely to identify people who may or may not be relevant for further investigation, the necessity and proportionality test works differently in that context.

Michael Drury: There is variable geometry.

Lord Woolf: That is different from a situation where you are going to look at sensitive information with regard to the individual. There are different stages, but the tests of necessity and proportionality are sufficiently flexible to cover the range.

Michael Drury: Absolutely, and subject to assessment ex post facto by the Investigatory Powers Commissioner as to the exercise of the test in any particular case.

Lord Woolf: How it is done.

Michael Drury: Yes.

Professor Scheinin: The question of reasonable suspicion can very well be built into the necessity and proportionality assessment. Basically, it means that when there is reasonable suspicion what otherwise would be disproportionate becomes proportionate. In the surveillance assessment scheme we referred to something called “effectiveness of surveillance”, which is a component of usability, and we gave it three out of 10 points for delivery, context and sensitivity. All those are met when there is reasonable suspicion, which means that you get a higher usability score, which then makes permissible intrusions into human rights that otherwise would not be proportionate. Now they become proportionate. Reasonable suspicion is not an all-or-nothing distinction, but it broadens the scope of permissible surveillance.

Lord Woolf: It is much more specific in its requirements.

Professor Scheinin: Yes.

Lord Woolf: If bulk is going to happen, it will do so in situations before you apply the reasonable suspicion test. It is for a later stage. Am I right on that?

Professor Scheinin: That is correct. Bulk is definitely about accessing, acquiring or storing data that relates to people who are not subject to reasonable suspicion at that stage. Therefore, one may need other parameters to narrow the scope of any bulk powers.

Now I take up Iain’s challenge to compare the two courts. The Court of Justice of the European Union has drawn a clear distinction between content and metadata, in the sense that in Digital Rights Ireland it quashed the data retention directive, saying that it was a particularly serious interference because of its mass nature and the lack of a proper legal basis, but it was done through a proportionality assessment. That is the key point; there was an issue of proportionality, whereas in Max Schrems we went into content data and the EU court said, “We do not need to do a proportionality assessment because we are crossing the red line”. It is by definition prohibited as a breach of privacy, because it goes into content on a mass level. That is an illustration that, if you want bulk powers, they need to be more restricted—for instance, as to what data is being collected.

The Chair: Mark, could we move swiftly to oversight? Obviously, we need the right level of restrictions but we also need the right oversight as to whether or not those restrictions are met.
 

Q7   Mark Pritchard: Related to that, perhaps I could pick up the last point. You mentioned the Court of Justice, Professor Scheinin, but the European Court of Human Rights has a different view on that, which you did not reference in your answer.
 

              Professor Scheinin: I will.

Mark Pritchard: Rather than predict my question, perhaps it would be helpful to put a question that may not be the one you thought I was going to ask. Do you think there is a resolvable or unresolvable dispute on this issue between the two courts?

Professor Scheinin: That raises multiple issues. One is that issues of national security do not easily get to the European Court of Justice, hence the primary court to address those questions will be the European Court of Human Rights in the future.

Of course, one needs to reconcile at European level the interpretation of privacy in the EU Charter on Fundamental Rights, or substantive rights, and the European convention right to privacy. Both are to be seen as a minimum standard, but they compete with each other; they do not want one to be lower than the other.

The issue of whether there is an inviolable core in privacy is an area where seemingly the two courts have taken different views, in the sense that in Max Schrems the EU court says content data is a red line that cannot be crossed and is not subject to proportionality, while so far in surveillance cases the European Court of Human Rights has addressed everything through a proportionality assessment. That said, I draw your attention to S and Marper v UK, which can be seen to reflect the position that biometric data is at the heart of privacy. That could be identified as an essential conduct issue. In the case of Delfi AS v Estonia—

Mark Pritchard: Given the time—there is a Division—if the courts are to compete, will they not always have a difference of opinion? By definition, they are competing with one another.
 

Professor Scheinin: They are competing as to who is in the vanguard on privacy in Europe, and they want to follow each other’s lead. That seems to be the case.

Delfi SA v Estonia is a freedom of expression case. It was about whether the state violated freedom of expression when protecting privacy. In that case, the European Court of Human Rights clearly subscribed to the position that there is an inviolable core of privacy as well, as it has said in the context of other rights. In surveillance cases, it has not yet addressed the issue.

The Chair: We thank all three of you very much indeed for joining us and engaging with us. We have two votes now, which means half an hour. If we have any follow-up questions—we have not looked at the question of oversight, although, helpfully, we have dealt quite a lot with authorisation—we might need to conclude them in writing. If you can engage with Murray on that, we would be very grateful. I for one feel massively more informed of the parameters of all this. Thank you for coming all this way and for your time in giving information to the Committee.

Professor Scheinin: Our pleasure.

              Oral evidence: [Legislative Scrutiny: Investigatory Powers Bill], HC [954]                            15