Investigatory Powers (Amendment) Bill [Lords]

Tom Tugendhat Excerpts

2nd reading
Monday 19th February 2024 Commons Chamber

[Stuart C. McDonald]

My hon. and learned Friend will not be surprised to hear that I completely agree with her.

In fact, that brings me to the next point I want to raise in relation to clause 2. As well as putting in place what I struggle to see as being a reasonably operated assessment, the clause raises concerns in relation to consistency with data protection legislation and with human rights obligations. The factors to be taken into account when undertaking that really difficult assessment do not even expressly include the sensitivity of the data in question, which surely should be central to any question of processing. That is an inconsistency with existing data protection principles and laws, and I agree that the compatibility of such provisions with our human rights obligations is also surely highly dubious. Just because someone has shared personal data does not mean that they automatically lose their right to further protection around how that data is shared and processed, especially when it is sensitive personal data, as my hon. and learned Friend has just said.

The role of judicial commissioners in this area is even further diluted, reduced to reviewing by judicial review standards whether datasets do indeed relate to data where there can be low or no expectation of privacy. Frankly, that is not a safeguard at all. At the very least, their role needs to be strengthened when the Bill is considered in Committee. We also need to seek assurances around how the Bill will impact on the reporting of the retention and use of bulk personal datasets. If large numbers are retained under category authorisations, we may not know how many datasets are actually being gathered.

Let me turn to various aspects of part 4, on notices. Again there are some controversial provisions, particularly in clause 21 and the requirement on selected telecommunications operators to inform the Secretary of State if they propose to make changes to their products or services that would negatively affect existing lawful access capabilities. That seems like an extraordinarily broad power, without anything remotely appropriate in terms of oversight and limitations. These powers are going to make the UK a real outlier. Essentially, the Secretary of State will be empowered to say to tech companies, “You are not allowed to improve your products without consulting us, so that we can still break in to access the data that we need and when we want it”. Despite what the Secretary of State says, taken together with other changes to review processes, such powers could easily be used to significantly delay, or de facto veto, updates to security, rendering everybody’s data more vulnerable to hacking by third-party actors.

[The Minister for Security (Tom Tugendhat)]

That is simply incorrect, and I know that the hon. Gentleman would not wish to continue down a road that he knows to be incorrect. Let me just be very clear: this is a continuation of a power that was granted in 2016. The notice does not extend that power; it merely enables a conversation to begin with companies before any action is taken, to maintain an existing standard and not in fact to change it.

[Stuart C. McDonald]

I am grateful for that clarification from the Minister, and we will of course engage further in this debate in Committee.

These concerns have been raised not just by me but by significant tech companies; this is not something that has come to me simply through perusing the Bill. The key question remains: why is there to be no proper oversight of these notices and notice powers by independent advance authorisation? Why is there not even the double lock that applies to other notices that can be served on communications providers under that Act? Surely that scrutiny should be carried out in advance. There are also lots of question marks around the expanded claims of international jurisdiction. How will potential conflicts of law be resolved, especially if a company subject to one of these notices that is contrary to its domestic laws cannot even say anything about it because it is bound to secrecy by this legislation? What are the prospects of other Governments copying what our Government are doing and seeking to replicate such provisions, and what would the impact of that be on UK companies?

Turning to internet connection records, the starting point is that we should remember that no other European Union or Five Eyes country permits the requiring of ICR generation or retention in relation to its own residents, so this was a hugely controversial development in the 2016 Act. As we have heard, ICRs can reveal huge amounts of deeply sensitive information about a person. For now, secret services can seek ICRs only when certain facts that are already known, such as the identity of a person connecting or the time and use of the connection, so that the retention is at least targeted in some way.

The risk in this Bill is that reasonable suspicion will no longer precede targeted surveillance. Instead, the Bill would seek to use ICRs for the discovery of new targets, which is a really significant jump and development. I can genuinely understand some of the reasons being offered for this change, and I am not unsympathetic to the case being made, but if these powers are not carefully circumscribed, they risk creating a big step towards mass surveillance and fishing exercises. We need to ask whether there are less invasive alternatives and whether these powers are therefore really necessary. Alternatively, we need to look again at the oversight mechanisms for the use of these powers.

We also have concerns about the Bill’s proposals in relation to the offence created by the 2016 Act, where relevant persons in a relevant public body knowingly or recklessly obtain communications data from a telecoms or postal operator without lawful authority. This Bill seeks to set out examples of what would amount to lawful authority, which is a laudable aim. However, there are real questions about whether some of the examples in clause 12 are not in fact redefining the concept of lawful authority. In particular, the assertion that there would be lawful authority simply because

“the communications data had been published before the relevant person obtained it”

is controversial. That is particularly so when

“‘published’ means make available to the public or a section of the public (whether or not on a commercial basis).”

As I said in relation to bulk personal datasets, limited publication is not authority for intrusive surveillance. Could a simple private message not amount to publication of comms data? The implications of this definition of lawful authority need very careful scrutiny indeed.

Finally, on the interception and hacking of parliamentarians, making provision for circumstances where the Prime Minister is unavailable to play his part in a triple lock seems sensible, but the fact that the issue of snooping on MPs and others is being revisited should trigger us all to rethink the whole scheme. Our role of representing our constituents, interrogating legislation and holding the Government to account should not be interfered with lightly. We should take the chance to consider post-surveillance notification of MPs who have been spied upon, by judicial commissioners, once investigations are completed. As matters stand at the moment, redress is almost impossible to obtain. We should also require that the investigatory power commissioners be informed every time these powers are used, so that there is transparency about how often this is happening. All other options should be on the table as well.

I started by thanking intelligence and law enforcement authorities and I am happy to do so again in closing, but our respect for them does not mean we should ever consider writing blank cheques or handing them whatever powers they ask for. They are not perfect. From time to time they exceed their powers and certain individuals abuse their lawful capabilities. The powers that they seek through this Bill are extremely invasive and broad in scope. There is a real danger that key provisions of the Bill will go beyond what is necessary and get the balance with privacy and human rights wrong. These provisions will need serious scrutiny and revision in Committee, and that is what we in the SNP will seek to secure.

--- Later in debate ---

[Mr Kevan Jones (North Durham) (Lab)]

Let me start by thanking our security services. I think I am now the longest-serving member of the ISC, and it is a privilege to work with them and scrutinise their work, as our Committee does. They do not get a great deal of publicity—for the right reasons—but when they do, it is sometimes not factual by any stretch of the imagination. They do an invaluable job, and in protecting our democracy, the threat that they face—that we all face—is changing, so the Investigatory Powers Act 2016 needs revising.

As my hon. Friend the Member for Wallasey (Dame Angela Eagle) said, the important point is that any new powers that we give the security services to act on our behalf should come with an equally balanced level of scrutiny and oversight. I see the scrutiny of our security as like a three-legged stool, with the Investigatory Powers Commissioner, the Investigatory Powers Tribunal, and the ISC. Well, actually, I would say that it is more like a two-and-a-half-legged stool, because the Home Secretary has done what most Ministers do; they say how wonderful the ISC is, how much they value our work, and that they want us fully involved—in passing this legislation, for example—but since 2017, when I first sat on the ISC, there has been a marked increase in lip service paid to it, as I think we see again in the Bill. As my right hon. Friend the Member for Normanton, Pontefract and Castleford (Yvette Cooper) said, we have not met the Prime Minister for 10 years—any of them; I think we had one who offered to come in the dying days of her Administration. We have taken evidence from the security services on the Bill, and I have to say that they are not the problem: it is the Government who are the problem all the time. That was the case with the National Security and Investment Act 2021. Frankly, it is an uphill struggle to get things changed in this Bill—changes that would not only improve the Bill, but make sense. One has just been highlighted by the Chairman of the ISC, the right hon. Member for New Forest East (Sir Julian Lewis).

On occasions, it is a bit like going round in circles. I will give an example. We have actually made one little advance in the other place, in terms of acceptance of the changes to do with the triple lock. Now, though, the sensible thing we are asking for—that it should be in the Bill that the Prime Minister should actually see those warrants—is being resisted as though it would somehow stop the world. I am sorry, but I do not think it would. I think the Government believe that they have to be seen to be resisting any changes. I like the Minister, but the passage of the National Security and Investment Act was a pretty dark day for the Government’s relationship with the ISC, because we had to fight tooth and nail to try to get anything changed in that Bill.

[Tom Tugendhat]

I was not in the Government then.

[Mr Jones]

I think the Minister was, actually. I think he picked up the tail end of that Bill.

The ISC has looked at this issue in detail. We have taken evidence from the heads of the security services, and we want to be supportive of change, but we also want that important role of scrutiny and ensuring the public are protected from the occasions when things might go wrong. The other thing that struck me today is that, although the Home Secretary can read a good speech, I am not sure he had a great grasp of some of the detail of the Bill. All I ask of the Minister is to please take on board some of the things we are saying, so that we can make progress in Committee. They are not radical things that are going to upturn the Bill; they are things that will improve it. I suspect that in certain parts of the Government there is a hatred of the ISC, and the belief that we have to be resisted at all costs. That will lead to a poorer Bill, because the amendments we will be tabling would actually improve the Bill. Lord West also did a great job in the other place.

I now turn to clause 2 of the Bill, which introduces the bulk personal data regime. There is a worrying gap: oversight of what are deemed low or no privacy datasets added to category authorisations. At the moment, the system does not work, because things like the electoral register have to get special permission. That is silly, frankly, but we need to ensure that these provisions are scrutinised.

New part 7A of the Investigatory Powers Act 2016, introduced by clause 2, provides for a light-touch regime for the retention and examination of bulk personal datasets by the intelligence services where the subject of that data is deemed to have low or no reasonable expectation of privacy. As the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) said, people are increasingly giving their personal data with little thought to how it is going to be used—not just by the intelligence services, but for commercial purposes. That needs looking at.

Approval of such a dataset will be sought either under a category authorisation, which encompasses a number of individual datasets that have a similar content and may be used for a similar purpose, or by individual authorisation, which covers a single dataset that does not fall neatly into a category authorisation or is subject to a complicating factor. For a category authorisation, a judicial commissioner will approve the overall description of the category authorisation before it can be used. A judicial commissioner will approve renewal of the authorisation after 12 months, and the relevant Secretary of State will receive retrospective annual reports on the use of category and individual authorisations.

However, as the Bill is currently drafted, this oversight is all retrospective. The problem is that what is missing is real-time or even near real-time oversight of changes. Under the present regime, once a category authorisation has been approved, the intelligence services have the ability to add individual datasets to that authorisation through internal processes alone. They examine the dataset without being subject to any political or judicial oversight, and they would be able to use those datasets for potentially a year without anybody being any the wiser.

We do not question why the security services need these powers, but there is potential for mission creep without any oversight of what is being authorised. We are not saying that these powers are not required; they are required. What we are really being asked to do is rely on the good faith of the intelligence services to use the powers in a certain way. I do not think that is strong enough, and no legislation should be solely dependent on good will. We also have to guard against—there are such occasions—situations when mistakes happen or people use powers for purposes that are not in the public interest.

It is important that we fill this 12-month gap, and the ISC thinks that the easiest and simplest way to change this process would be for the Investigatory Powers Commissioner to be notified when an individual bulk personal dataset is added by an agency to an existing authorisation. I understand that Lord Anderson of Ipswich, in his review of 2023, recommended a similar proposal. The argument from the Government—it is similar to what they have used throughout this Bill, as the Committee Chairman has remarked—is that that will be onerous in adding to the work of the intelligence services. Well, it would not, because it would simply mean sending a one-line email to the Investigatory Powers Commissioner containing the name and description of the bulk personal dataset as soon as reasonably practicable.

The decision would be approved internally and then sent to the Investigatory Powers Commissioner, so it is not actually asking for approval. It is just making sure that the Investigatory Powers Commissioner is aware of what is being added, and that the individuals taking such a decision realise that they must inform the Investigatory Powers Commissioner. That would obviously allow the Investigatory Powers Commissioner to look at trends in what is happening. Clearly, after the 12 months, they could look back, but they could also intervene if they thought something was not in touch.

An argument the Government use quite often about this Bill is that it is to have a light-touch approach, and I think this suggestion is for a light-touch approach. I do not know what is onerous about the security services sending an email to the Investigatory Powers Commissioner. I think it would ensure the oversight that is needed. Real-time oversight is what we are suggesting, and I do not think it would add to the administration of the security services, but it would lead to the Investigatory Powers Commissioner at least having some visibility on another layer at which decisions are taken.

The proposal would be a very simple thing to do, and I do not understand why the Government are resisting it. I suggest they are resisting it for the many reasons they have resisted some of the other sensible things we have put forward: just because they want to do that. I do not know how we go forward with the relationship between this present Government and the ISC. Dragging information out of them screaming and kicking is taking a long time, even though we have a legal duty to get information, and the critical point now is the starvation of resources from the Committee which is creating real problems in the way that it can operate.

I hope that things change and that when we table amendments we will not get the usual response that amendments to this type of legislation should only be done in the Lords. Are we here to cause trouble for the security services? No, we are not; we want to ensure we do our job, which is set out in statute, to supervise the security services and improve the powers, but to ensure that the public have the recognised safeguards we should expect in a democracy such as ours.

--- Later in debate ---

[The Minister for Security (Tom Tugendhat)]

I thank hon. and right hon. Members from across the House for their contributions not just today, but throughout the many different stages of the Bill. I pay huge tribute to the Members of the other place who have contributed enormously, in particular Lord Anderson, who has been an exceptional asset to the passage of the Bill and the condition it is in, and Lord West who, as a member of the Intelligence and Security Committee, not only shepherded some extremely important amendments into the Bill, but was kind enough to say that it was the first time in 14 years that he had ever had an amendment accepted by the Government. I am delighted to say that it was to this Bill. It was because we are so committed to working with all parts of both Houses and with the ISC that we got so much through in the other place. [Interruption.] That said, many comments will no doubt be raised in this House. I can assure hon. Members, especially the right hon. Member for North Durham (Mr Jones), that I will approach all suggestions in the way that I have done to date. Where we may not agree—it may not be that he is right, or that I am right—it will be for good reason and I will set out my reasons in the appropriate way.

The Bill is about one fundamental thing: the security of the British people. We rightly heard from my hon. Friend the Member for Broxbourne (Sir Charles Walker) about the nature of freedom, but the truth is that freedom without security is impossible. It is a chimera. The Bill is about ensuring that the British people have the security to enable that freedom. That is an absolutely vital responsibility not just of this Government, but of this House and the other place. I am grateful for the work that the hon. Member for Barnsley Central (Dan Jarvis) and the shadow Home Secretary, the right hon. Member for Normanton, Pontefract and Castleford (Yvette Cooper) have put in to ensure the co-operative, bipartisan and open approach to the Bill, as is merited by the work of our fantastic intelligence services to provide security for our whole country.

As the British public would expect, we keep our approach to national security under constant review. Where we identify the need for change or improvement, we will not hesitate to act. That is why we have brought forward the Bill, which acts on the findings of the Home Secretary’s report and Lord Anderson’s independent review into the Investigatory Powers Act 2016. Hon. and right hon. Members will not need me to rehearse the arguments, but we have seen an extraordinary, rapid evolution in the nature of the threats since the 2016 Act: Russia’s threat to the whole of Europe and not just to Ukraine; the violence that Iran is trying to bring not just in the middle east but even on to our own shores; and the way technology has enabled hostile states not only to steal our technology but to introduce intelligence-gathering platforms into our country through the guise of car sales.

We have seen a change in the way technology works and a change in the nature of the threats, and we must keep up to date with those changes. That is why this work is so important. It is essential that the United Kingdom’s investigatory powers framework remains fit for purpose to help our intelligence agencies detect and stop some of the most serious threats posed to the UK and its citizens, including threats from terrorism, state threats, and child sexual abuse and exploitation.

Because these are exceptional powers, Members have rightly pointed out that they require appropriate, robust and, in this case, world-leading safeguards, and that is what we have sought to set out. The changes in the Bill are relatively narrow in scope, but unless we make them now, the ability of our agencies to tackle evolving threats will be increasingly constrained in the face of global instability, technological advances and state hostility, so now is the time to act.

Let me now deal with some of the points that have been raised. The hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) raised a rather interesting point about the changes to “lawful authority” in clause 12 in respect of published data. The purpose of new subsection (3A) is for material that has already been published not to require additional authority for its disclosure by a telecommunications operator to a relevant public authority. The definition of “publish” and reference to “a section of the public” would not include private messages unless they had been made public in some other way—just as our sitting room could not be considered a public place unless we opened it up to the public. It would be our choice, and nothing to do with the nature of the building.

The hon. and learned Member for Edinburgh South West (Joanna Cherry), who has made important contributions through her chairmanship of the Joint Committee on Human Rights, raised questions about the transparency safeguards in the 2016 Act. Those extremely robust safeguards are centred on considerations relating to intrusion into privacy, and that will remain the case in the Bill. They include a requirement for investigatory powers to be used in a “necessary and proportionate” way, with independent oversight by the Investigatory Powers Commissioner and redress through the Investigatory Powers Tribunal.

My right hon. Friend the Member for South Holland and The Deepings (Sir John Hayes) contributed in his usual robust fashion to the debate—and, I should add, to the session that I was fortunate enough to have with the Intelligence and Security Committee, in which he was enormously helpful in assisting me with some changes to the Bill. He spoke about the five individuals who could be designated by the Prime Minister, and asked why we had not referred specifically to “those with warranting powers”. It is possible that a Minister with warranting powers who had that experience would then be moved to another Department, or indeed that the machinery of government change would alter the nature of the oversight. While we felt that it was right to limit the number to as few as possible, we also felt that it was right to have a relevant selection, which is why we left the number at five—after some very good consultation with the ISC, for which I am extremely grateful to my right hon. Friend the Member for New Forest East (Sir Julian Lewis) .

[Sir John Hayes]

My right hon. Friend has been immensely generous both in giving way and in his earlier comments about my role. Will he briefly deal with the issue of the other bodies with the regulatory function who can compel the release of communications data? As he will remember, the point I made was that the existing law obliges them to take further procedural steps before they do so. Why is that no longer deemed appropriate?

[Tom Tugendhat]

As my right hon. Friend will know, several powers in the earlier Bill—the one that he took through the House—were indeed overseen in various different ways. The Bill does not seek to undermine any of that oversight; what it seeks to do is clarify, in certain areas, where it is necessary. My right hon. Friend has highlighted individual agencies or bodies, and I should be happy to write to him to ensure he is aware of exactly where that is being covered.

The right hon. Member for North Durham spoke about prior judicial authorisation for ICRs. The purpose of the Bill is to try to streamline operations for the intelligence services in areas where the risk is of, as we are calling it, low or no expectation of privacy. He will have seen in the Bill what the expectation means, including areas where information has already been readily made public. I accept his commentary and I would be happy to enter into further conversations with him, but the reason we are not currently going down that route is simply that the existing law, the IPA 2016, allows the collection of bulk data with prior authorisation. This is intended to speed the process up. If we put in the measures he is referring to, we would effectively remain in the same place that we are now. That would make it harder for the volume of data that is now coming to be considered by the intelligence agencies. That is why we have made the provision for a subsequent approval rather than a prior approval. He is right to say that it involves a maximum of a year, although I think it unlikely that it would go to that maximum. That will be in cases where this is low or no expectation of privacy—after it has already been agreed by a judge to be in the correct category. I think the right hon. Gentleman might be looking at this through the other end of the telescope.

[Mr Kevan Jones]

What the Minister has to realise is that the big concern from the public—although let’s be honest, the public are not looking at the detail of this—is that somehow the security services will be getting access to huge amounts of bulk data and just having a free run at it. All that I and the Committee are suggesting is that an email should be sent when there are changes to the Investigatory Powers Commissioner. That would be a simple thing. It would not be onerous, and it would reinforce the point that there was at least some potential oversight of the process.

[Tom Tugendhat]

I think we may be conflating different aspects of the Bill. I do believe that this already has oversight.

Let me answer the point raised by my hon. Friend the Member for Broxbourne, which touches on a similar area. Where people have the right to and expectation of privacy and freedom, this provision does not remove that right. What it does is allow the intelligence agencies to use bulk data to target an individual at a particular point, and the excess collected information will not be able to be used for targeting an individual without the warrant process that would be expected for any initial search. In that sense, this is not undermining anybody’s privacy; it is allowing for the fact that information is now largely in bulk format. The hon. Member for Barnsley Central was talking about steaming open envelopes. It is impossible to steam open a single envelope today; one has to steam open thousands because that is how data comes. Without an amendment such as that set out in the Bill, we would simply be interrupting the work of the intelligence services to the degree that it would hold them back and make the process harder, but I would be happy to take this up with my hon. Friend the Member for Broxbourne later if he wishes.

I thank the hon. Member for Halifax (Holly Lynch), who was here earlier and made an interesting point about the various ways in which the memorandum of understanding should be looked at through the National Security Act 2023. Friends of mine will know my thoughts on that and know that I gave the Conservative party the chance to allow me to change that 10-year absence, but the Conservative party chose somebody else to make that decision so I have sadly lost the ability to have that influence.

My right hon. and learned Friend the Member for Kenilworth and Southam (Sir Jeremy Wright) made a typically insightful speech and typically sensible comments on the ways in which we must consider how the authorisation must not be used to mount general surveillance. Condition D will be used only when an applicant makes a clear and compelling case, based on tangible, reliable intelligence leads, information and analysis, that the resulting data will identify parties involved in a relevant serious crime or national security-related specified operation or investigation. The applicant must explain any anticipated collateral intrusion, and how this will be managed to ensure that the application is necessary and proportionate to the outcomes of the investigation.

[Sir Jeremy Wright]

I accept what my right hon. Friend says but, in the context I described, the case is being made to someone else within the intelligence agency. There are, of course, two types of authorisation—D1 and D2—and we are worried about D2, under which the application is made from inside the intelligence agency to inside the intelligence agency. That does not present the sort of external scrutiny that we suggest is necessary.

--- Later in debate ---

[Tom Tugendhat]

My right hon. and learned Friend is right, but he also knows that IPCO has retrospective oversight of these areas. Where it comes under a category allocation through “low or no”, there is an automatic review period within a year. Although he is correct that the application is made within the service, it is within the service subject to a pre-agreed condition and with follow-up oversight, so as to enable that speedy response.

[Sir Julian Lewis]

On a different but not unrelated point, the Minister will recall that I referred to the annual report given to the Secretary of State detailing the individual bulk personal datasets that had been retained and examined. There is no extra work involved in letting the ISC and IPCO see that report. The only possible justifiable exclusion would be something that, at the time of the report, was still current. Is there any reason at all why IPCO and the ISC should not be sent that report, rather than a severely watered-down version?

[Tom Tugendhat]

My right hon. Friend answers his own question. The reason for the difference is the currency element.

[Sir Julian Lewis]

In that case, we can reach agreement if the Minister would like to give us an assurance that the only difference between the two reports will be the exclusion of matters that are current at the time of drawing up the report, but I suspect that there will be many other differences between the two reports.

[Tom Tugendhat]

I will be very happy to talk to my right hon. Friend about that to make sure that he is satisfied. It is important that we make sure that the reports that go to the House—through the ISC, because of the nature of the reports—are relevant and allow appropriate scrutiny. I think we can all agree with that.

I have covered the points raised by my hon. Friend the Member for Broxbourne, so I will turn to the hon. Member for Strangford (Jim Shannon), who made an extremely important point: that his constituents, like any other citizens of the United Kingdom, should expect the right to privacy. He also made a compelling point about the need for security, and I think the Bill strikes that balance extremely carefully. He is right to say that people will be concerned, and he is not alone. I am also concerned that we maintain the right to privacy within our legislative framework, which is why we checked very carefully that the Bill is fully compliant with the ECHR right to a private life. It is also why we looked at the various exceptions.

The hon. Member for Barnsley Central mentioned the notices regime, and he is right that we will keep it under review. We maintain a regular conversation with companies that have an interest in this area, and he is right to say that there is an overseas element. I merely point out that it is the role of this House to legislate for the security of the British people and, in particular, for the safety of our children and families. Such security is not something we can outsource to tech firms on the west coast. We sometimes have a responsibility to pass extraterritorial laws—as he knows very well, we have done that in the past—so although this measure adds to that ability, it is not detrimental because it asks people to maintain their current position before making any changes and to talk to us during that period. There is no requirement to break any policies, change products or introduce new products; it is merely to maintain the status quo, so that we have the same ability to keep the British people safe until we have had a conversation about how that status quo should change.

Finally, the hon. Member for Barnsley Central raised a question about trades unions. He is right that there are many different professions where protected characteristics could come into play, including lawyers, doctors and psychiatrists, and where any such intrusive power should be used with exceptional caution. I would just say that, due to the nature of this place and Parliaments around the United Kingdom, the position of parliamentarian is particular, which is why it is set out specifically and separately in the Bill. That does not mean that any attitude against any other individual should be used cavalierly. It is not a question of the role or the post the person holds, but their rights as a British citizen. Those rights should be absolutely guarded from intrusion or aggression by the state without exceptionally good reason. This amendment, which the hon. Gentleman is kindly supporting, sets out that balance between British citizens’ right to privacy and their right to security. With that, I commend the Bill to the House.

Question put and agreed to.

Bill accordingly read a Second time.

Investigatory Powers (Amendment) Bill [Lords] (Programme)

Motion made, and Question put forthwith (Standing Order No. 83A(7)),That the following provisions shall apply to the Investigatory Powers (Amendment) Bill [Lords]:

Committal

(1) The Bill shall be committed to a Public Bill Committee. Proceedings in Public Bill Committee

(2) Proceedings in the Public Bill Committee shall (so far as not previously concluded) be brought to a conclusion on Tuesday 12 March 2024.

(3) The Public Bill Committee shall have leave to sit twice on the first day on which it meets.

Consideration and Third Reading

(4) Proceedings on Consideration shall (so far as not previously concluded) be brought to a conclusion one hour before the moment of interruption on the day on which those proceedings are commenced.

(5) Proceedings on Third Reading shall (so far as not previously concluded) be brought to a conclusion at the moment of interruption on that day.

(6) Standing Order No. 83B (Programming committees) shall not apply to proceedings on Consideration and Third Reading.

Other proceedings

(7)Any other proceedings on the Bill may be programmed.—(Mark Fletcher.)

Question agreed to.

Investigatory Powers (Amendment) Bill [Lords] (Money)

King’s recommendation signified.

Motion made, and Question put forthwith (Standing Order No. 52(1)(a)),

That, for the purposes of any Act resulting from the Investigatory Powers (Amendment) Bill [Lords], it is expedient to authorise the payment out of money provided by Parliament of:

(a) any expenditure incurred under or by virtue of the Act by the Secretary of State or a government department, and

(b) any increase attributable to the Act in the sums payable under or by virtue of any other Act out of money so provided.—(Mark Fletcher.)

Question agreed to.

Investigatory Powers (Amendment) Bill [ Lords ] (First sitting)

Tom Tugendhat Excerpts

Committee stage & Report stage
Thursday 7th March 2024 Public Bill Committees

[The Chair]

Copies of written evidence received by the Committee will be made available in the Committee Room, and will be circulated to Members by email.

We now begin line-by-line consideration of the Bill. The selection list for today’s sitting is available in the room; this shows how the selected amendments have been grouped together for debate. Amendments grouped together are generally on the same or a similar issue. Please note that decisions on amendments do not take place in the order they are debated, but in the order they appear on the amendment paper. The selection and grouping list shows the order of debates. Decisions on each amendment are taken when they come to the clause to which the amendment relates. Decisions on new clauses will be taken once we have completed consideration of the existing clauses of that Bill. Members wishing to press a grouped amendment or new clause to a Division should indicate when speaking to it that they wish to do so.

Clause 1

Requirement for authorisation

Question proposed, That the clause stand part of the Bill.

[The Minister for Security (Tom Tugendhat)]

It is a pleasure to be here under your chairship, Mrs Cummins. The exceptional growth in volume and types of data across society globally since 2016 has affected the intelligence services’ ability to work and collaborate at the necessary operational pace. The existing bulk personal dataset safeguards do not account for the way that data and its availability have evolved since the Investigatory Powers Act 2016 was passed. This creates a negative impact on operational agility, while making it increasingly difficult for the intelligence services to develop the necessary capabilities.

Clauses 1 and 2 introduce an alternative regime for bulk personal datasets where there is low or no reasonable expectation of privacy—the so-called low/no regime. Clause 1 specifically provides a mechanism for the intelligence agencies to determine whether bulk personal datasets should be authorised under part 7 of the 2016 Act for sensitive datasets, or proposed new part 7A for low/no datasets.

[Dan Jarvis (Barnsley Central) (Lab)]

It is a pleasure to serve under your chairship, Mrs Cummins. I rise to speak very briefly to clause 1, and to thank the Minister for his opening remarks.

At the outset of our consideration, we should all take the opportunity to pay tribute to the exceptional men and women who have served in our law enforcement and security services. We owe them a deep debt of gratitude. Let me say that the Opposition support the Bill, which updates aspects of the Investigatory Powers Act 2016. It is imperative that legal frameworks are updated to ensure that our security and law enforcement services keep up with the challenges to communications technology in an increasingly challenging and complex landscape of threats to our safety and national security. None the less, the important provisions proposed in this Bill need to be scrutinised carefully. The shadow Home Secretary and I made it clear on Second Reading that we will work with the Government to improve it in places, following the example of the constructive cross-party work that was done in the other place.

--- Later in debate ---

With that initial foray into this territory, I will conclude, except to say that in my career in Parliament, I regard taking the original legislation through as my greatest achievement. [Interruption.] My former Parliamentary Private Secretary, my hon. Friend the Member for North Cornwall, is saying it is one among many, but I regard it as the most important thing I have done in Parliament because it is an important matter, not a party political matter; it is important for the safety and security of all our people.

[Tom Tugendhat]

What can I say? We have got a little further on clause 1 than I anticipated. I am grateful to my right hon. Friend the Member for South Holland and The Deepings, the right hon. Member for North Durham and other hon. Members who have spoken. Bulk personal dataset authorisation is clearly an important change, as my shadow, the hon. Member for Barnsley Central, has set out; I was interested to hear the suggestion from my right hon. Friend the Member for South Holland and The Deepings that this was the shadow Minister’s first step on the path to greatness and to leading the Opposition. I am grateful for the points that hon. Members have made.

The type of data that may fall into part 7A is indeed covered—things like news articles, academic papers, public and official records, and the sort of bulk personal data that many people would have access to routinely. The changing nature of the need to hold data has meant that bulk personal data must be authorised in a different way than was previously thought. Paragraphs 4.14 and 4.20 of the draft code of practice set out further details of the datasets that would fall under the section 22A test, of which the hon. Member for Barnsley Central is no doubt aware.

The hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East touched on various aspects of data that might fall within this approach. He will remember that Lord Anderson noted in his independent review that MI5 and MI6 estimate that roughly 20% of their bulk personal data holdings would fall into the category of “low and no”; for GCHQ, the figure would be nearer to 8%. Clearly, these things will evolve. To answer the point made by the right hon. Member for North Durham, the simple fact is that our world is producing incomparably greater volumes of data than ever before. The need to understand, handle and triage that data is therefore essential.

It is worth making the point, right at the beginning, that creating and storing huge volumes of data is to nobody’s advantage, and particularly not that of the intelligence services. The only purpose of having or examining data is to enable investigatory operations to get to targets of interest. It is not about anything other than ensuring that investigations can be properly targeted against those who threaten the interests of the British people, under various existing laws. This measure does not change those laws; it merely assists the targeting.

Question put and agreed to.

Clause 1 accordingly ordered to stand part of the Bill.

Clause 2

Low or no reasonable expectation of privacy

[Dan Jarvis]

I beg to move amendment 14, in clause 2, page 3, line 18, at end insert—

“(1A) This section does not apply to a bulk personal dataset unless it has been published in accordance with the Data Protection Act 2018.”

This amendment would ensure bulk personal datasets with low or no expectation of privacy have been published lawfully and in accordance with General Data Protection Regulation (GDPR) set out in the Data Protection Act 2018.

--- Later in debate ---

[Owen Thompson (Midlothian) (SNP)]

I will be brief. I back up the comments of the right hon. Member for North Durham: much more needs to be done to define clearly what we mean by “low or no”. In many ways, separating the two out would make everything clearer. Everybody can tell what “no expectation of privacy” means. It is when we get to low expectation of privacy that we have debates: “Is it this or is it that?”

The factors considered in determining whether something qualifies as low or no include

“the extent to which…the data has been made public”.

If there is no expectation of privacy, that is obvious, so I do not understand why we cannot have more clarity and say, “This is what we mean by no expectation of privacy, and this is what we mean by low.” It might be fine for us in this room to have an understanding of what we mean, but there needs to be public understanding.

We all know that every time we go on any website, we are asked to click to accept the cookies, and sometimes we cannot progress any further unless we do. Data is being gathered left, right and centre. With the best will in the world, not everyone reads every single line of the terms and conditions. We need to be absolutely clear about exactly what we mean so that legal challenges do not occur down the line.

[Tom Tugendhat]

Before I address those points, I want to address the shadow Minister’s somewhat contentious argument that learning French is not a security issue —that was a bold innovation from him.

The points that have been raised are essential to understanding exactly why the Bill is so important. I will cover the “no” and “low” areas separately, for the reason that the hon. Member for Midlothian touched on. We all know what no expectation is; that has been largely covered, and the reality is that even the slightly more restricted version of the electoral register is shared with political parties, as the right hon. Member for North Durham knows.

[Mr Jones]

I agree with the Minister on party access— we get access to it, for example. However, does the person who ticks that box and takes their name out have a reasonable expectation? Do they know that it is being shared? No, they do not.

[Tom Tugendhat]

That is what I was going to say. Although the register is not publicly available and therefore would not fit in this category, that is where we get to the line. The “no” is for publicly available data, and that is relatively clear.

The “low” comes in areas such as the idea of leaked papers, which somebody raised—forgive me, I cannot remember who. That is where the Bill sets out terms under which datasets should be considered, because of course it is impossible for me to give an answer that applies to every single dataset into the future. One example that came up recently, as right hon. and hon. Members will remember, is the Panama papers. One would not argue for a second that the people listed in those papers had an expectation of openness initially. However, after those papers had been published and republished over many years, at what stage do we really think the expectation of privacy is maintained?

That is where the dataset becomes low expectation. We have set out the oversight regime in another area of the Bill, but I will touch on it. The Investigatory Powers Commissioner has a range of responsibilities, the judicial commissioners have other responsibilities for approving warrants and IPCO has responsibility for overseeing the regime. That is where that is addressed—in slightly ways at each moment of influence and each moment of power, but everything is covered.

[Kevin Foster (Torbay) (Con)]

I am interested in the Minister’s example of the Panama papers. As he rightly says, when those papers were originally held by a bank or a financial institution, there would be an expectation of privacy. However, he is alluding to where they are sourced from. Those papers have been freely circulating on the open internet and anyone can download them, and it is at that point that the low or no expectation would come in. Rather than the nature of the document itself, it is the fact that it is easily available online that matters.

[Tom Tugendhat]

My hon. Friend is absolutely right. The reality is that once papers are effectively public, the argument for privacy somewhat falls away. That is exactly where we are getting to in this area, which is why we have looked at how to oversee it and the different elements within it. Part 7A explains the oversight regime clearly and section 226A really gets to the nub of it.

It is important that we focus there, where the argument comes back to the essential element: when considering whether intelligence services have applied the test correctly, the judicial commissioner will apply the same principles that a court would apply on application for judicial review. We therefore have an internal legal process overseeing this before it would even get to any legal challenge. That is why it is more robust than some voices have gently suggested, and covers many of those internal challenges.

[Dan Jarvis]

I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

--- Later in debate ---

[Stuart C. McDonald]

First, unless I was distracted, I do not think I got a specific answer on the types of data mentioned in the amendment—for example a Facebook post, CCTV footage or anything else.

[Tom Tugendhat]

Those are covered under sensitive data areas; they would not be covered under bulk personal data. The hon. Gentleman also mentioned health data, and he is absolutely right that I did not answer that. I should be absolutely clear: it is hard to envision a case in which health data would be considered “low or no”, unless it was of very ancient historical standing, or there were other exceptional reasons.

--- Later in debate ---

[Tom Tugendhat]

I will just answer that directly, as the hon. Gentleman seems to be running away with this issue slightly. The test set out in proposed new section 226A still applies to all datasets. It is not removed; it goes through the whole thing.

[Stuart C. McDonald]

That is useful to know. I will pray in aid the fact that we did not have any witnesses; anything I say that is daft, and anywhere that I do not understand how the Bill operates, I will blame on the lack of witnesses.

That is useful to know. I will go away and look at that and make sure that that all makes sense to me. That just leaves me with my earlier request: can we have some examples of what a category authorisation looks like? I can imagine that they could be incredibly broadly drafted, but they could also be very narrow. It would be useful to get a better understanding of how they will operate.

My final point is that the Government’s case appears to centre quite largely on using the material for machine learning. We have heard about language, online encyclopaedias and whatever else. If nothing else, why not use this streamlined process on that category of information and keep the existing processes in place for everything else?

[Tom Tugendhat]

I welcome the spirit in which the hon. Gentleman approaches this issue. He is asking important questions, and I do not challenge at all the validity of the way he has approached the issue; in fact, I should put on record that I am grateful for the way the whole House, and this Committee in particular, have approached it. It is important that any questions that any Member has, particularly the questions honourably and reasonably raised by the hon. Gentleman, are addressed.

The hon. Gentleman’s question on category authorisation is important, because the individual authorisation authorises the retention or retention and examination of a bulk personal dataset, to which part 7A applies. In other words, for every individual dataset there will be an individual authorisation. The normal rule is that each individual authorisation must be approved in advance by a traditional commissioner, as my right hon. Friend the Member for South Holland and The Deepings quite rightly addressed.

A category authorisation does not itself authorise the retention or retention and examination of a dataset; rather, the category itself is the means by which the normal rule of prior judicial approval may be disapplied in respect of the individual authorisation of datasets that fall within the description approved by the category authorisation. As the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East knows, that allows for the internal authorisation of an individual dataset that falls within an existing category. By definition, those categories are narrow enough to be identifiable but large enough to be useful. The reality is that that must be done on a case-by-case basis, but under the watchful eye of not just the unit within the intelligence service that requests it, but a senior officer in that service and a judicial commissioner.

That oversight means that we have an effective way of ensuring that we are able to use bulk personal data as categorised in different areas in a speedy fashion to enable the detection and prevention of harm, but with the oversight regime that the hon. Gentleman quite rightly expects of any apparatus of the state. The intelligence services in particular, for reasons of operational necessity, operate in the shadows, and therefore require an extra guarantee of reliance.

[Stuart C. McDonald]

I will go away and consider what the Minister said. Our basic issue here is that a process is in place whereby every single individual dataset must be approved and have the approval and authorisation of a judicial commissioner. Under this scheme, if there is a category authorisation and then an individual authorisation under it, there will not necessarily be any involvement from a judicial commissioner. That is the bit that we have an issue with.

[Tom Tugendhat]

May I come back straightaway on that? To be clear, category authorisations are reviewed by IPCO at the very latest a year—12 months—after the authorisation, but they could actually be reviewed at any point. I am afraid the idea that a category authorisation stands forever just because it has been allowed is not accurate—I know that is not what the hon. Gentleman is suggesting. The judicial commissioner would have oversight of the wider category authorisation, and the IPCO review means that the whole thing is checked at the very latest every 12 months, and probably more frequently than that.

[Stuart C. McDonald]

Again, I get all that, and I do not think that we are really at cross-purposes. However, we are talking about 12 months of access to datasets without necessarily having them before a judicial commissioner.

I do not think that anyone disputes that this is a slightly weaker form of oversight, which is because the services want to access this material at scale and regard the existing oversight mechanisms as cumbersome, slow and whatever else. We still ask the question of whether there is another way to do that that would still involve judicial commissioners but happen much more randomly and at scale. However, we will go away and consider that. I repeat my request—I know it is not easy—for some examples to reassure members of the public on how exactly this will work. That would be useful. In the meantime, I do not intend to push the amendment to a vote. I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

--- Later in debate ---

[Stuart C. McDonald]

I will be very brief, because I fully support what the shadow Minister and the right hon. Member for North Durham have said. If we are going to go down the route of somewhat watering down the oversight of certain bulk personal datasets, we need greater transparency and accountability. Our amendment 38 has very similar motivations. It requires complete transparency with the ISC by listing all the bulk personal datasets that would be retained under a category authorisation in the report the Bill requires to be sent to the ISC. It answers the question of how we are supposed to know how these new powers will be and are being used unless we have one of these methods of transparency.

[Tom Tugendhat]

If I may, I will come to the last point first. The information going to the ISC on this basis would be, as far as possible, the same as that going to the Secretary of State. Obviously, the operational data may not be included, depending on the relevant operational case. I hope that will reassure this Committee and, indeed, the ISC that the intention is to make sure that the ISC is as fully informed as possible.

On the point made by the right hon. Member for North Durham, he will know that the Bill, in many ways, has been a joint project between the Government and the ISC. I have spent many hours with members of the ISC, including the Chair, my right hon. Friend the Member for New Forest East (Sir Julian Lewis), and with various members of the Committee. Their input has been exceptionally important to me and has been included in many areas of drafting on this.

Turning to amendment 15, the right hon. Member for North Durham and the hon. Member for Barnsley Central, in many ways, have both been the Occam’s razor of the Bill process, not just here, but in other areas. They have been rightly keen that we should not include powers or requirements that would otherwise constrain or block processes or confuse the law. I understand the argument that hon. Members are making about a one-line email, but the reason that I am not convinced—though I am very happy to have the conversation suggested—is that the reality is that it is possible for IPCO to investigate at any point, and it must investigate at 12 months. Therefore, if we ask for a legal requirement on the services, that would force an extra legal duty into the various elements and it will be an extra change.

[Mr Jones]

I disagree with the Minister. Yes, IPCO can look back and can go in at any time to look at things, but if it does not know where the needle in the haystack is, how is it going to actually find it in the first place? This is not an onerous proposal, and I do not understand why the Minister is resisting it, to be honest. This measure would just send another reassurance to the public that, again, the extra powers being given to the security services, which I fully support, at least have some oversight. We need to address the Bill in detail and in such a way that we cannot be accused of handing over powers without also providing very light-touch reassurance that there is outside oversight. I accept that, in most cases, IPCO would not actually look at any of these.

[Tom Tugendhat]

In the spirit with which the right hon. Gentleman has approached this, may I commit to meeting him and the hon. Member for Barnsley Central to discuss this?

[Mr Jones]

We might do it in the wash-up anyway.

[Tom Tugendhat]

Well, the right hon. Gentleman could make a virtue of a necessity if he wishes. I certainly will. I shall enjoy meeting him to discuss this, and I hope that he will take that commitment in the spirit with which it is made.

[Dan Jarvis]

I think that this has been a useful debate. There have been a number of sensible and constructive contributions from both sides of the Committee. The Minister has made a commitment to sit down and discuss this further, and I am grateful for that undertaking. As I have said, we do not intend to push this amendment to a vote.

--- Later in debate ---

[Dan Jarvis]

I am grateful to my hon. Friend the Member for Bootle. I am happy to give way to the Minister if he wants to respond directly to that point.

[Tom Tugendhat]

The point about these powers is indeed to make better use of resources. One challenge is that many intelligence officers are tied up doing things that are no longer genuinely necessary for the protection of personal privacy, but they are following processes that, were they to be working for a private organisation —a company or whatever—would no longer be necessary because bulk personal data could simply be bought. Therefore, what we are actually looking at doing is using resources much more efficiently and therefore helping the protection of the British people, from a better financial position. However, the point made by the hon. Member for Bootle on resources is always one that I welcome.

[Dan Jarvis]

I have nothing further to add, other than to beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 2 ordered to stand part of the Bill.

Clause 3

Duration of bulk personal dataset warrants

Question proposed, That the clause stand part of the Bill.

[The Chair]

With this it will be convenient to discuss clause 4 stand part.

[Tom Tugendhat]

Clause 3—

[Sir John Hayes]

We are making sufficient progress, which perhaps permits me to say a word about why, as we have now dealt with those publicly contentious matters around bulk powers, we can move to the next part of the Bill with greater confidence. The Minister has been crystal clear that he—like me, the right hon. Member for North Durham and other members of this Committee—understands fully the important role of oversight and checks and balances. Those checks and balances are multidimensional because of the role of both those elected to this House and the judiciary. I know he will want to expand on that a little as we come to the next part of the Bill.

--- Later in debate ---

[Tom Tugendhat]

I thank my right hon. Friend. Clause 3 amends the duration of bulk personal dataset warrants under section 213 of the IPA from six to 12 months. BPDs tend to be used to support long-term strategic intelligence activities, and a longer warrant duration will enable the value of the BPD to be better demonstrated, which will provide the relevant Secretary of State with a more accurate picture of the necessity and proportionality when an application for renewal is made. The existing part 7 safeguards will remain in place, including the double lock by the judicial commissioner.

Question put and agreed to.

Clause 3 accordingly ordered to stand part of the Bill.

Clause 4 ordered to stand part of the Bill.

Clause 5

Third party bulk personal datasets

[Dan Jarvis]

I beg to move amendment 16, in clause 5, page 14, line 34, at end insert—

“(4) A third party BPD warrant may not authorise the examination of a dataset consisting of the contents of the marked electoral register.”

This amendment would prevent a third-party bulk personal dataset consisting of the electoral register, which sets out whether people have voted, from being examined by the intelligence services.

--- Later in debate ---

[Tom Tugendhat]

I thank hon. Members for their points. The examination of third-party bulk personal datasets by the intelligence services is vital to their role of protecting the national security and economic wellbeing of the United Kingdom and preventing and detecting serious crime.

Clause 5 places an explicit statutory regime around the intelligence services’ examination, in situ, of bulk datasets held by third parties. The regime would apply only to the intelligence services, in line with the wider part 7 BPD powers in the IPA. The clause puts in place robust oversight and safeguards. For example, third-part dataset warrants are to be subject to a double lock, and the decision to authorise the warrant will need to be approved by both the Secretary of State and an independent judicial commissioner. The Investigatory Powers Commissioner and his office will oversee the regime to ensure the intelligence services’ examination of third-party datasets is both necessary and proportionate. That relates to the point made by the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East about proportionality and need.

To answer the point made by the hon. Member for Barnsley Central, we do not consider it appropriate to exclude specific types of dataset from those for which a third-party dataset warrant can be sought. The reason is, as he knows, that we can begin to go down very tricky routes on this area, as the intelligence services have a requirement to keep safe not just our democracy but our wider nation. Therefore, limiting those different arguments can be problematic. What we are aiming to do is ensure the proportionality requirement is the test applied by both judicial commissioners and the Investigatory Powers Commissioner.

The Secretary of State may issue a warrant authorising the examination of a third-party dataset only where it is necessary and proportionate—that is going to be quite a high bar in some of the areas asked about—for the intelligence service to examine the dataset to which the warrant relates. That decision will be double-locked by an independent judicial commissioner who, among other things, is required expressly to review the Secretary of State’s conclusions in respect of necessity and proportionality when deciding whether to approve the decision to issue a warrant. That is already in the Bill. Each decision will be made on a case-by-case basis and will be subject to prior judicial approval.

[Dan Jarvis]

I am grateful for the Minister’s response. I have to say, I am struggling to think of a scenario in which it might be necessary and proportionate to examine the marked electoral register. This is something we will reflect on.

--- Later in debate ---

[Dan Jarvis]

That is a helpful and useful suggestion. I am happy to proceed on that basis, if the Minister is.

[Tom Tugendhat]

I am happy to write to the hon. Member.

[Dan Jarvis]

On that basis, I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 5 ordered to stand part of the Bill.

Clause 6

Minor and consequential amendments

Question proposed, That the clause stand part of the Bill.

[Tom Tugendhat]

Clause 6 makes minor amendments to the 2016 Act to reflect the introduction of parts 7A and 7B, including making it clear that the Investigatory Powers Commissioner is responsible for oversight of the part 7B regime.

Question put and agreed to.

Clause 6 accordingly ordered to stand part of the Bill.

Ordered, That further consideration be now adjourned. —(Scott Mann.)

Investigatory Powers (Amendment) Bill [ Lords ] (Second sitting)

Tom Tugendhat Excerpts

Committee stage & Report stage
Thursday 7th March 2024 Public Bill Committees

[The Chair]

With this it will be convenient to discuss clauses 8 to 10 stand part.

[The Minister for Security (Tom Tugendhat)]

The Investigatory Powers Act 2016 contains world-leading oversight arrangements, which have strengthened the safeguards that apply to the use of investigatory powers. The clauses will enhance this oversight regime, including the role of the Investigatory Powers Commissioner, to ensure it is resilient and that the IPC can continue to effectively carry out their functions. This includes creating a statutory basis for appointing deputy IPCs to whom certain functions can be delegated and, in exceptional circumstances, the appointment of temporary judicial commissioners. The clauses also place certain existing oversight functions on a statutory footing and provide clarity to public authorities in their error reporting obligations. These are important and targeted amendments to ensure the oversight regime remains robust and the IPC can continue to carry out their role effectively.

Question put and agreed to.

Clause 7 accordingly ordered to stand part of the Bill.

Clauses 8 to 10 ordered to stand part of the Bill.

Clause 11

Personal data breaches

[Tom Tugendhat]

I beg to move amendment 1, in clause 11, page 31, line 36, leave out “a court or tribunal” and insert “the Investigatory Powers Tribunal”.

This amendment is consequential on amendment 2.

[The Chair]

With this it will be convenient to discuss the following:

Government amendment 2.

Clause stand part.

[Tom Tugendhat]

Clause 11 will ensure that there is clarity for telecommunications operators operating within the IPA framework about which regulatory body certain personal data breaches should be notified to. It also provides a statutory basis for the Investigatory Powers Commissioner being notified of such breaches. Without this change, there will be confusion about personal data reporting obligations and a regulatory gap in respect of certain personal data breaches by telecommunications operators not being dealt with by the appropriate regulatory body. The clause also ensures that an individual affected by a personal data breach can be notified of the breach by the Investigatory Powers Commissioner, if the IPC deems to it to be in the public interest to do so. This will enable them to seek remedy from the Investigatory Powers Tribunal.

Government amendments 1 and 2 build upon the provisions already contained in clause 11 by providing a clear route to redress for those affected by personal data breaches committed by telecommunications operators. They ensure that the Investigatory Powers Tribunal has the jurisdiction to consider and determine complaints about personal data breaches committed by TOs and grant a remedy. The IPT already has significant experience of considering complaints from individuals who believe they have been the victim of unlawful interference by public authorities. It is therefore the appropriate forum to consider complaints regarding certain personal data breaches.

Amendment 1 agreed to.

Amendment made: 2, in clause 11, page 32, line 19, at end insert—

‘(1A) In section 65 of the Regulation of Investigatory Powers Act 2000 (the Tribunal)—

(a) in subsection (2), after paragraph (b) insert—

“(ba) to consider and determine any complaints made to them which, in accordance with subsection (4AA), are complaints for which the Tribunal is the appropriate forum;”

(b) after subsection (4) insert—

“(4AA) The Tribunal is the appropriate forum for a complaint if it is a complaint by an individual about a relevant personal data breach.

(4AB) In subsection (4AA) “relevant personal data breach” means a personal data breach that the individual is informed of under section 235A(5) of the Investigatory Powers Act 2016 (serious personal data breaches).”

(1B) In section 67 of the Regulation of Investigatory Powers Act 2000 (exercise of the Tribunal’s jurisdiction)—

(a) in subsection (1)(b), after “65(2)(b)” insert “, (ba)”;

(b) in subsection (5)—

(i) the words from “section” to the end become paragraph (a), and

(ii) after that paragraph insert “, or

(b) section 65(2)(ba) if it is made more than one year after the personal data breach to which it relates.”

(c) in subsection (6), for “reference” substitute “complaint or reference has been”.

(1C) In section 68 of the Regulation of Investigatory Powers Act 2000 (Tribunal procedure), for subsection (8) substitute—

“(8) In this section “relevant Commissioner” means—

(a) the Investigatory Powers Commissioner or any other Judicial Commissioner,

(b) the Investigatory Powers Commissioner for Northern Ireland, or

(c) the Information Commissioner.”’—(Tom Tugendhat.)

This amendment provides for the Investigatory Powers Tribunal to be the appropriate forum for complaints by individuals about certain personal data breaches reported to the Investigatory Powers Commissioner under section 235A of the Investigatory Powers Act 2016 (personal data breaches).

Clause 11, as amended, ordered to stand part of the Bill.

Clause 12

Offence of unlawfully obtaining communications data

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

I beg to move amendment 39, clause 12, page 33, leave out lines 16 and 17.

This amendment would remove one of the examples cases where a relevant person has lawful authority to obtain communications data from a telecommunications operator or postal operator, being where the data has been “published”.

[Stuart C. McDonald]

The clause relates to section 11 of the Investigatory Powers Act 2016, which created an offence where a relevant public authority knowingly or recklessly obtained communications data from a telecoms or postal operator without lawful authority. That is an extra protection against unlawful invasions of privacy by public authorities. Comms data can of course be vital to prevent serious crime or to assist in missing persons investigations, but it can also be seriously invasive if not monitored, as such data can reveal all sorts of details about our lives and the people that we are linked with. The clause makes changes to that offence.

It is said that there is a lack of clarity around the concept of lawful authority, so the clause includes some examples of what lawful authority is. Most are uncontroversial—for example, where there is a statutory basis for gathering the data, where there is a relevant court order or an authorisation, or where it is obtained to respond to a call to the emergency services. However, we contest the assertion that new subsection (3A)(e) is a proper example of lawful authority, referring to:

“where the communications data had been published before the relevant person obtained it”.

We are concerned that that is not a correct expression of the law as it stands.

The simple fact of data being published is not in and of itself lawful authority for it to be obtained and subject to surveillance. The fact that I publish a Facebook post at such and such a time in such and such a place does not give public authorities the right to seek it from Facebook. In fact, on a Zoom meeting about a controversial political campaign, it cannot be the case that Zoom can then be ordered by the police to obtain the relevant communications data simply because the data was published and available to those who attended the meeting.

We need a very careful explanation from the Minister about what precisely is intended by the example in paragraph (e) because as drafted—again, it depends on how we interpret these things—it seems to be open to an interpretation that anything even semi-publicly available can be obtained by public authorities without anything more.

[Tom Tugendhat]

I will speak more widely to clause 12 before addressing the amendment. The clause does not create new routes to obtain communications data outside the Investigatory Powers Act. Rather, it provides examples of existing routes to acquire communications data in order to put the existing position, as set out in the communications data code of practice, on to a statutory footing. This will provide clarity that acquiring communications data in this way will amount to lawful authority for the purposes of the offence in section 11 of the IPA. It makes it clear that sharing of communications data between public bodies is lawful. It is not the intention of section 11 to discourage public sector sharing of data when administering public services for purposes such as fraud prevention. Clause 12 puts that beyond doubt.

While discussing clause 12, I will take the opportunity to set out that a communications data authorisation can amount to lawful authority to require a telecommunications operator to carry out any necessary activity on their systems to enable or facilitate the obtaining of the relevant communications data. The list of examples of what will amount to lawful authority in clause 12 will provide additional clarity to the existing drafting of section 60A(5) in the Investigatory Powers Act, which sets out what can be authorised under part 3 for the purposes of acquiring communications data.

I would also like to address an inconsistency with paragraph 176 of the explanatory notes for the 2016 Act and the conduct that the Act permits. To be clear, a communications data authorisation may authorise interference with equipment by a person where that is done to enable or facilitate the acquisition of communications data for the purposes of identifying an entity as well as information about their previous or current location.

The Government do not support amendment 39, moved by the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East. Additional authority for published material should not be required for its disclosure by a telecommunications operator to a public authority when that data has been disclosed with the consent of that operator. The consent of the operator provides the lawful authority for the obtaining of the previously published communications data, which public authorities can rely on. It places the existing position, set out in paragraph 15.11 of the communications data code of practice, on a primary legislative footing. It does not create new acquisition routes.

Clause 13 amends the definition of communications data to include subscriber and account data, ensuring that this communications data is available to investigators with an IPA part 3, even if it is transmitted as the content of the message. That is not a broadening of the definition but a clarification of scope. “Subscriber data”, or “account data”, includes the details provided when someone completes an online registration form for a telecommunications service or system. This change overcomes the current uncertainty for investigators about the data types that will be “communications data” and therefore available to them.

Clause 14 restores the general information gathering powers to regulatory or supervisory bodies, which were repealed by section 12 of the 2016 Act. It will ensure that public authorities will be able to utilise their own pre-existing statutory powers to acquire communications data for civil purposes. These are existing statutory powers that have been conferred on public authorities by Parliament—for example, in the regulation of the financial markets to ensure market stability.

Since 2016, the data sought has increasingly moved online and is now being caught by the definition of “communications data” in the 2016 Act. For example, His Majesty’s Treasury is responsible for the civil enforcement of financial sanctions regulations. Some information that is essential in carrying out its civil enforcement functions, such as the timestamp of an online banking transaction, is now communications data, and His Majesty’s Treasury cannot currently use its powers to compel that information to be provided by a telecommunications operator. Communications data is available under the IPA only if the matter under investigation is a serious crime, and so is out of reach for public authorities exercising civil enforcement functions.

[Stuart C. McDonald]

I thank the Minister for his response and his explanation. We will of course take that away and give it consideration again. He has referred to codes of practice being put into statute, so we will go away and look at those codes of practice. Of course, codes of practice can sometimes be inconsistent with various laws as well, so this is not necessarily the end of the matter. It would be helpful if the Minister could perhaps—in writing, or perhaps we will have to revisit it on Report—look at the specific examples that I gave and just explain whether or not those amount to prior publications of comms data.

[Tom Tugendhat]

I am very happy to write to the hon. Gentleman.

[Stuart C. McDonald]

I very much appreciate that, and that will hopefully help to clear things up before we get to the next stage of proceedings. I will withdraw the amendment.

--- Later in debate ---

My anxiety is that we should be very clear about what the limits are on the public bodies concerned, who those public bodies are, and in what circumstances they might exercise the powers that the Bill confers. It will be very much in the Government’s and the Minister’s interests to be very clear and certain about that as we make this case publicly. If I were to be for a moment—but only a moment—fanciful, it might well be that a member of the public will say, “Why should a local authority have similar powers to MI5?” I am not sure that it is quite like that, and I know the Minister will be able to reassure, through me, the wider public, but that is the kind of argument one can see possibly being presented in the media and elsewhere. I speak merely to test the Minister on this and ask him to let us know when he will make this list available—perhaps during the course of our consideration. I know that the Intelligence and Security Committee of Parliament has asked for this. Will the Minister fulfil the promise he gave without delay?

[Tom Tugendhat]

As always, my right hon. Friend asks a pertinent question. I hope he will forgive me for saying that I very much hope that the letter I asked to be sent arrived in his inbox this morning. He may not have seen it, which I completely understand, as there are many pressing issues on his time. I have also attached it into the packet for the Bill and indeed copied it to the ISC secretariat, which has done such an important job in ensuring that we are all as one on this. I hope very much that that will answer my right hon. Friend’s questions. If it does not, he knows where I am—I would be delighted to clarify it further. As my right hon. Friend has very kindly asked, I shall give that list now, for the record: HM Revenue and Customs, the Financial Conduct Authority, the Department for Work and Pensions, the Treasury, the National Crime Agency, the Department for Business and Trade, and the Competition and Markets Authority.

My right hon. Friend reminds me of that famous scene in “Yes, Prime Minister”—thank God defence is held at central authority, or we would not have to worry about the Russians; we would have a civil war in two weeks. His point about local authorities having intelligence powers is valid. They do not have the same intelligence powers as MI5—let us be absolutely clear about that. That is not what we are offering.

[Sir John Hayes]

It does the Minister great credit that he has made that list available during the course of our consideration. That is very important. What I had feared might happen was that we might not get it while we were in Committee. In fact, I have not actually seen it, but I am grateful to him for making it available, at least, during our consideration.

[Mr Kevan Jones (North Durham) (Lab)]

This is an area that concerns me. I am quite certain the security services have protocols on how to deal with such things, but it worries me that the DWP is on that list. Having been involved in work on the Horizon Post Office scandal for many years, I know the DWP did not cover itself in glory on some of those cases. Can the Minister reassure the Committee that there are protocols governing when and how it will use those powers? That, I think, would give the public some assurance that there is a standard for how they will be used.

[Tom Tugendhat]

The right hon. Gentleman tempts me towards an area that the Bill does not cover, so I hope he will forgive me for focusing on what it does cover, such as the safeguards. Clause 14 will limit communications data acquisition to the purpose of a body required to meet its civil functions and duties, such as a regulatory body providing oversight of financial markets, or indeed the DWP overseeing different elements of its responsibilities. Where disclosure is in support of a criminal prosecution and IPA part 3 authorisations for communications data must continue to be sought, using the existing safeguards and oversight provided for by the Investigatory Powers Commissioner’s office, the courts will oversee the use of those powers by public authorities in the same way as the acquisition of non-communications data under the existing powers. He has asked me specifically about a connected area, so—I hope he will forgive me—I will have a look at it and write to him very specifically about that.

[Mr Jones]

May I suggest that the Minister does write to the Committee? I accept the safeguards in place, but for organisations other than the security services, I want to know what internal mechanisms they have to ensure that use of those powers is proportionate in terms of investigations and so on, and what training and protocols they are using. If the Minister could write to us on that, that would be helpful.

[Tom Tugendhat]

Forgive me, but the right hon. Gentleman is asking for a very large piece of work there. I am setting out the legal authority under which those organisations can act. Their internal processes may be different in different circumstances and be answerable to different Ministers.

[Mr Jones]

I am sorry, but I do not agree with the Minister. He is giving those other public bodies additional powers, and I think it is quite reasonable for this Committee and the public to be assured of how those powers are actually going to be used. As I say, I have no problem with the security services, because I am well aware that they have very clear, strong protocols and safeguards governing the use of their powers internally, with authorisations and so on. I think he just needs to ask those other Departments how they are going to do this, and what the internal mechanisms are.

[Tom Tugendhat]

I am very happy to ask them; I am just stating clearly that they are not under the responsibility that I have as a Minister. The legal powers that they are given are not additional powers; they are repetitions of the IPA 2016, so they are not additional powers—[Interruption.] Forgive me, but they are not additional powers. Their existing codes of practice under the different organisations have their own responsibilities within them.

[Mr Jones]

I beg to differ. In the next clause, we will come on to the breadth and depth of the new powers, but that is a different argument—I will save that until then. However, he is the Minister and, in my experience, the Minister leads the Bill. I would have thought it would be quite simple to ask those other Departments what those protocols are. If he does not ask, he does not get.

[Tom Tugendhat]

I will happily ask. The right hon. Gentleman is asking for internal management structures, though.

[Sir John Hayes]

I am grateful to the Minister for offering me a second bite of the cherry. Perhaps I can offer a Hegelian synthesis between him and the right hon. Member for North Durham. We talked earlier about operational purposes, but we have to be careful about that: in the case of the agents of the police, one cannot publish purposes in fine detail, because that would be unhelpful. However, in broad terms, perhaps the way forward on this is to illustrate the kind of purposes that the bodies the Minister described might employ, within the legal constraints that he just set out. Perhaps that is the way forward; it would certainly satisfy me, and I cannot think that would not help to satisfy the right hon. Member for North Durham, who is a reasonable man—not my right hon. Friend, but a right hon. Gentleman and a personal friend, which is better than being a right hon. Friend.

[Tom Tugendhat]

As always, I welcome my right hon. Friend’s contribution. That is covered in many areas in the letter I wrote to him.

[Dan Jarvis (Barnsley Central) (Lab)]

In an earlier response to comments by the right hon. Member for South Holland and The Deepings, the Minister helpfully mentioned the letter that I think has been sent to the right hon. Member and possibly other members of the Committee. Can the Minister confirm that that letter will also be sent to the Opposition?

[Tom Tugendhat]

To be absolutely clear, the letter was in response to my right hon. Friend the Member for South Holland and The Deepings, so it was sent to him, it was copied to the secretariat of the ISC and it is in the Bill pack. The hon. Member for Barnsley Central therefore has access to it.

[Mr Jones]

May I ask the Minister to look at his internal process again? We also had this problem with the National Security Bill. I do not know whether he should change the pigeon post he is using to ensure people have it. May I also point out that the ISC is not constantly in session? Therefore, if he has to send it to the ISC, we do not automatically get it until our next meeting or when we do the next reading.

[Tom Tugendhat]

I am delighted to clarify that the letter was emailed to my right hon. Friend the Member for South Holland and The Deepings. He is a traditionalist in many ways, but I believe he has entered the electronic age.

[Sir John Hayes]

I had it printed out on parchment.

[Stuart C. McDonald]

I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 12 ordered to stand part of the Bill.

Clauses 13 and 14 ordered to stand part of the Bill.

Schedule agreed to.

Clause 15

Internet connection records

Question proposed, That the clause stand part of the Bill.

[Tom Tugendhat]

The changes made by clause 15 should transform the intelligence services and the National Crime Agency’s ability to detect serious criminals and those seeking to undermine national security. Current internet connection record conditions only enable identification of individuals involved in known events. That means an investigator must know the date, time and service being used, preventing identification of offenders where they cannot be linked to a specific time of access. For example, where analysis of a seized device identifies a site serving images of child sexual exploitation, it would not currently be possible to search ICRs for subjects accessing that site beyond a specific known event. New condition D would help to identify other subjects accessing those sites. This will not be a fishing exercise. As with all investigatory powers, the case for requesting ICR data must be necessary, proportionate and intelligence-led. As Committee members will have heard this week, the benefit to the agencies is in being more, not less, specific.

The new condition will be subject to robust safeguards, including limiting the statutory purposes available, stringent necessity and proportionality requirements and independent oversight, including regular inspections by the Investigatory Powers Commissioner’s Office. Where internal authorisation takes place for urgent and national security-related applications, authorising officers must be independent of the operation and not in the line management chain of the applicant. If an investigator knowingly or recklessly obtained ICRs—for example, if the request was clearly not proportionate—they would be at risk of having committed a section 11 offence of unlawfully obtaining communications data, which can result in a fine or imprisonment.

--- Later in debate ---

[Sir John Hayes]

Exactly. That point was made when we debated the original Act, and I think that I committed at the time to those kinds of things being detailed in the annual report. To clarify a point that was made earlier, David Anderson was clear at the time, and has been since, that we cannot detail the operational purposes of the agencies if doing so would compromise them. The techniques and approaches that they necessarily use in the performance of their duties could be compromised if we were to talk in detailed terms about the character of their operational activities. However, we can speak in broader terms about the kinds of circumstances in which powers might be used—and all the more so for the other public bodies, in a sense, because even if a serious criminal investigation is taking place, those investigations are not typically as secret as they might necessarily be in respect of the security and intelligence community.

Perhaps those two grounds—greater sight of the processes in those bodies and clarity about the circumstances in which the powers can be used; in other words, exceptionally and for very serious matters—would be helpful ways of dealing with some of the points raised by my colleague on the ISC, the right hon. Member for North Durham.

[Tom Tugendhat]

As usual, right hon. and hon. Members have raised some excellent points. Let me be clear: it is not true to say that there is no judicial oversight. To say that there is no judicial oversight would be correct if the IPC were not in place. I know what the right hon. Member for North Durham is going to say, but that is a form of judicial oversight.

As to the way in which the authorisations work, I hope that I have been clear—I will repeat it to ensure that I am—that an investigating officer would have to make an application to use the powers. That would have to go to a senior officer in their service who is not in their chain of command: someone who is not overseeing the operation or in their management chain—a separate element. Any abuse of that system could mean that that individual, or those individuals, are in violation of section 11. I know that the right hon. Member for North Durham takes his responsibilities on the ISC exceptionally seriously and is fully aware that sometimes there can be a pressing need for operational action at pace. That is what this is also designed to help. It is important that officers have the ability to act under a regulatory framework that means that abuses are, at worst, extremely limited due to various constraints.

[Mr Jones]

I accept that and I have confidence in the internal protocols—do not get me wrong on that—but the Minister does not have to convince me or members of this Committee; it is about the public perception. What is the problem? If we are not going to have judicial oversight in terms of judicial authorisation, what is to stop us having another system whereby, when it is used, the IPC is informed? We could send a simple email so that it would at least have ongoing oversight when these powers are being used.

[Tom Tugendhat]

The right hon. Gentleman is creating his own haystack here. Although I hope as ever that this power will be used only exceptionally rarely, sadly the nature of serious and organised crime and terror in this country means that it will be used more often. There is a slight misunderstanding as to how this will be used. Targeting a train website or a single authority would not be proportionate or meet the necessity provisions within the Bill. It would be neither necessary nor proportionate. In fact, it would be unnecessary and would be vastly disproportionate, because it would be a mass collection exercise that would neither be targeted in a way that would satisfy the proportionality requirement, and nor would it give a useful answer—it would give such bulk data as to be useless—and therefore it would not be necessary.

The whole point of this is that it sets out a series of conditions in which these powers could be used—perhaps against a certain website, that is true—but on the basis of intelligence. It would have to have a particular cause and a particular time. This is not a Venn diagram with a single circle, but a Venn diagram with four or five circles; it must be in the centre of those for it to be necessary and proportionate.

[Stuart C. McDonald]

I would be reassured if there was independent advanced judicial oversight. The Minister has said a couple of times that the powers will be used “exceptionally”. What is the difficulty in making sure that there is an exception for urgent cases of advanced judicial authorisation for use of these powers?

[Tom Tugendhat]

“Exceptional” does not mean that there is necessarily huge amounts of time to act; exceptional means that the seriousness of the offence is extremely grave. These powers are for things such as child sexual exploitation. I wish it were not so, but even in this country, the police very often have to act extremely speedily to prevent harm to a child and sometimes, very sadly, multiple children. They have also to act extremely speedily to prevent terrorist plots or other forms of very serious organised violence or criminal activity.

That is why “exceptional” does not necessarily mean that it can be dealt with in a procedural way over a number of weeks; exceptional may mean absolutely pressing as well, and that is what this is designed for. The right hon. Member for North Durham may have been aware from briefings that I believe he has received that, in some circumstances, this Bill will reduce the time taken to interrupt serious abuse of children, from months and occasionally years down to days and weeks. That is surely an absolutely essential thing to do, but that will not work unless these powers are used according to the Act, with the important words being “proportionate” and “necessary”. The reason I repeat those words is that were the intelligence services to go on some sort of fishing expedition—and I know that the right hon. Gentleman is not suggesting that they would—that would not be legally permissible under this Act and nor would it achieve the required results, because it would turn up so much data that it would simply be an unusable, vast collection of fluff. Effectively, instead of targeting the needle, they would have merely collected another haystack.

[Mr Jones]

It is not about a fishing expedition, but they will get into a fishing expedition anyway. He says that train lines would not be affected, but they would. If someone wants to see an individual’s travel pattern, that is what they may do. Therefore, a lot of people’s data will be dragged in, not because it has been looked for but because it will come in anyway.

The problem is that if the argument is about speed—which I do not necessarily think is the case in some cases—the Minister has to do two things to reassure people that the powers are going to be used in the right way. First, he must provide pre-authorisation judicial oversight, and secondly, the IPC should be told, perhaps via a simple email, when the powers are used. That would at least allow it to look at the trends and uncover any concerns. I accept the protocols in place and am 100% sure that they are being followed, but it is possible that some people will not follow them and that is what we have to guard against.

[Tom Tugendhat]

This is a somewhat odd argument, because the right hon. Gentleman and I are slightly together but also arguing at cross purposes. Both of us have a very high regard for the intelligence services and are confident in their integrity, but we are slightly at cross purposes because he believes that we are not satisfying the oversight element, but I believe we are.

Let me be clear. I am not being a stick in the mud about this for any political reason. I actually happen to believe that this is the right way to approach this. There is a constant balance in all forms of oversight between the ability to act quickly and the ability to be controlled from outside. I believe that this sets in place a very significant, burdensome requirement on those who are taking these responsibilities to act according to certain principles. To repeat, the principles are necessity and proportionality. I do not think anybody in here would argue against those. What this requires them to do is make sure that the principles are met by effectively targeting in advance.

The right hon. Gentleman’s comment about train line use would, I am afraid, not satisfy that proportional need. The individual would have to be specifically identified in advance. The pattern of use of the website from the single point and to the point of contact—from a phone to an internet server or whatever it might happen to be—would have to be clarified. These ICRs are Venn diagram circles that are getting narrower and narrower. The idea that this would end up with some sort of week-long or month-long trawl of a train line website is, I am afraid, not permissible under the 2016 Act. Were any intelligence officers to do it—though I do not believe that they would—they would fall foul of section 11 and would not be acting necessarily and proportionately. Therefore, it would not be permissible.

It is pretty clear that existing conditions B and C already enable public authorities to make an application for a known individual’s internet connections. New condition D only enables a request for details to identify individuals who have used one or more specified internet services in a specified time.

[Owen Thompson (Midlothian) (SNP)]

I think that is the point. I do not think anyone is arguing against the fact that there will sometimes be exceptional circumstances that require haste. Everybody accepts that, but the issue with condition D is that it is explicit in removing the targeted nature of the other conditions. It is where they do not know the time or person and do not have the data available that they are using condition D. There is nothing in the Bill to make clear that it can only be used in exceptional circumstances. How can we square that circle? I do not think that anyone would disagree with the fact that there needs to be an ability to move at pace at times, but there is nothing here that says that power could only be used in those sorts of circumstances. Condition D creates a situation where we are going to hoover up data on a huge number of people, but there is nothing to say how long we are going to hold on to that data for, or what would be done with it.

[Tom Tugendhat]

To answer the last part of the question first, the holding on to data and what is to be done with it is the same as under the IPA generally. Information can be held or not held according to those provisions. This Bill does not change any of that, which is why that is not covered here, and I know the hon. Gentleman would not expect it to be.

It is worth pointing out that condition D is not only no more intrusive than conditions A, B or C, in terms of data—

[Owen Thompson]

rose—

[Tom Tugendhat]

Let me just finish the point; I know the hon. Member will come back to me.

Condition D is no more intrusive, and it does require the serious crime threshold, which does add an extra layer before it can be used. I hear the hon. Member’s point; the condition still requires proportionality and necessity, so it could not be simply anybody who is using Facebook, because clearly that is not proportionate. It still requires that targeting; it still requires those Venn diagrams, if he likes, to close over a target; and, even then, it requires the serious crime threshold.

[Sir John Hayes]

The key thing to understand here is that the agencies have always had the ability to intercept communications data. Communications data is one’s letters. Communications data is one’s phone calls. We speak about communications data now, mindful of the way that people communicate now, and we think of the internet and telephones, but the process of intercepting communications has been a core part of the work of the agencies since the agencies began, so we need to put this in context.

The difference here is the nature of how people communicate. It is right to say that—I rise to be helpful to the Minister—the character of encryption, in particular, is making it harder, even in the kind of serious cases that have been described, for those who are missioned to keep us safe to do so by accessing the information they need. So it is right that the law needs to be updated. The critical thing for me, therefore, is this matter of the threshold, which was debated when we debated the original Act.

As far as I understand, this Bill does not change the threshold; it reinforces the threshold. If that is the case and, as has been said, exceptionality is a measure of significance and not complexity—some cases will be complicated, but it is about significance—then the only outstanding difference, as the Minister has said, is oversight. I think the reporting in the annual report matters—the right hon. Member for North Durham made that point—and that would be a small concession to make, if I can describe it as such. I take the point about alacrity, too. What we cannot do is slow down the process by making it bureaucratic.

I think there is an easy way out of this. Being very clear about thresholds, as the Minister very helpfully has been today, is perhaps the way out of it. To clarify that in writing might be helpful.

[Tom Tugendhat]

I will give way to the right hon. Member for North Durham.

[Mr Jones]

I do not think anyone could describe the right hon. Member for South Holland and The Deepings or myself as woolly liberals, but I do have a concern with this. Where we are giving an extra power—which is what this is, although the Minister disagrees about the breadth—I want to ensure somehow that, in a democracy, we have oversight of it. I do not want to make it difficult for the agencies to implement their powers, but there are simple ways of doing so. That could mean telling the IPC when it occurs.

I have faith in the internal mechanisms that the Minister refers to, but I was also on the Intelligence and Security Committee in 2017, when we did our rendition and detention inquiry. All the safeguards were in there then, and they were ignored. That led to some fundamental changes, including the Fulford principles. There are occasions when the best things in legislation are not followed through, and that can lead to some very serious consequences.

[Tom Tugendhat]

I take the right hon. Gentleman’s point and the spirit in which it was made. I reiterate that requests for communications data must be approved by the Investigatory Powers Commissioner’s Office, as he knows, unless they are urgent or for the purposes of national security. That is where this is being focused. Condition D, which we have spoken about, will be restricted to only the intelligence services and the National Crime Agency when it is pursuing a national security element within its remit—that is a separate area, as he knows. Those organisations have the necessary expertise to raise compliant and proportionate restrictions.

Again and again, the principle in the Bill is that the least intrusive power must be used. The oversight starts internally, but very rapidly goes externally, whether it is to IPCO or a judicial commissioner. The ability to review is always there, and the penalties under section 11 of the 2016 Act, which we all hope will never be needed or used, are pretty onerous on anybody who abuses their power or in any way exploits their ability in order to conduct themselves in a way that we would all agree is unsatisfactory in a democracy. It is really important to say that.

Going back to the question raised by the hon. Member for Midlothian, the reality is that condition D applications will limit collateral intrusion as much as is reasonably practical. The returned data may only provide an indication of involvement in an investigation, and further analysis will likely be necessary to allow fuller determination. That is the nature of handling intelligence data and then conducting an analysis on the back of it. In all cases, that activity will have to be justified, and will be no more than is necessary to achieve the desired outcome.

To be absolutely clear, that has to be targeted. This is a series of circles in a Venn diagram to target as narrowly as possible. Were others to be captured in that narrowest possible target, that data could not be held, or a separate application would have to be made in order to hold it. For example, one can imagine a circumstance in which an intelligence agency is targeting a paedophile on a particular street. Using different forms of communication technique, it narrows it down from a handset to an operator, a particular website, a particular time, and so on, so the Venn diagram narrows—it is very focused. If it turns out that there is another paedophile operating in exactly the same area at that time, that would require a separate application, because it is a separate target. The data could not just be held. Nor would it be ignored—I am sure the hon. Gentleman would not suggest it should be. But the judicial oversight needs to be gone through and the application needs to be made. It is a separate warrant, and so on.

[Mr Jones]

In the example the Minister gives, at the same time the agency targets that individual, it will have a lot of other people who communicated with that individual. How long will that information be kept? That is the concern people have. It is not the depth, but this is broad. Most of those people would be completely innocent of anything. There is then the issue of how long that information is kept and who makes the decision about how long to keep it.

[Tom Tugendhat]

Forgive me, but I disagree with the right hon. Member on this. It is unlikely that there would be a large number of people at a specific geographic location, using a specific cell site, from a specific handset, viewing a specific website at a specific time. Once it is narrowed down like that, the numbers are very small. That does not mean that any intrusion that is not legally authorised is acceptable—that is absolutely not what I am saying. But we are getting down to very small numbers of people, and quite deliberately so, in order to achieve an intelligence outcome.

[Stuart C. McDonald]

As I understand it, the Minister is describing the powers that already exist under the 2016 Act. If we are down to that level of knowledge of where, when and who, then what in the Bill goes beyond that? I do not follow.

[Tom Tugendhat]

In the existing Act, one would have to be entirely specific about a particular time. It could not be 5.30 pm to 6.30 pm; an internet connection record could be done only at 5.30 pm exactly. The Bill extends that a bit, but it still has to be very targeted. This is a proportionate change in the law to allow the intelligence services to collect information that would enable the targeting of serious and organised crime.

[Mr Jones]

Let me go back to the Trainline example. Suppose it is not child exploitation—the Minister is possibly right that it is specific, and hopefully there are not many people in one street—and someone is trying to look for a person’s travel plans, so they want to know how many people in an area have contacted Trainline. It will be more than one person, so there will be a lot of other people they are not looking for in there. That is the problem, and that is all that the ISC, the hon. Members for Midlothian and for Glasgow South and the Labour Front Benchers are saying.

Earlier the Minister used the words “control from outside”. I am sorry if he sees oversight as control, but I certainly do not. It is about giving confidence to the public that there is independent oversight over these powers, whether that is informing the IPCO when they are used or having pre-authorisation, as was suggested earlier. I do not see the problem with keeping people informed. The Minister is hiding behind IPCO, but it was introduced in the first place to give the public confidence.

[Tom Tugendhat]

I suspect we are not going to come to an agreement on this, so I will probably leave it after this point. The IPCO oversight means that IPCO can look at a request at any point. The maximum period it can go without looking at it is 12 months, but it can look at any point. We have said that requests for communications data must be approved by the Investigatory Powers Commissioner’s Office

“except where they are urgent or are for the purpose of national security”.

That interaction, which the right hon. Gentleman rightly supports, is already there, so I do not accept it is lacking.

On the question of proportionality, the amount of information that one may need to investigate a paedophile network, for example, may mean being slightly vaguer about the specific time, whereas following a known individual may require different forms of flexibility and proportionality. I am afraid I am going to be very cautious about setting out what each one means, because these principles will have to adapt and be applied as appropriate.

[Sir John Hayes]

We are going to have to close this down and move on because we have other things to do. Perhaps the way through is, as was suggested a few moments ago, that this be reviewed over time. If in the annual report we have a really thorough examination of how the measure has been applied and in what circumstances—in broad terms, of course, because we do not need the details of the crimes—that would give us the assurance we need. Our Committee has made that point emphatically. That would be a terribly good way out of this and it would not be a huge step. If the Minister agrees to that, I would certainly be satisfied.

[Tom Tugendhat]

It is not for me to tell the ISC what it should look into, but I would be surprised if it did not want to look into this in great depth.

[Sir John Hayes]

I think the Minister might have misunderstood. Forgive me; I did not mean that. I meant that this could be reviewed in the IPCO annual report. That would obviously be considered by the ISC in the way he describes. I think we need a summary of how this will work in practice and a commitment that we do that now. He sort of talked about a retrospective review. Rather than debate this further now, that would be a very good way forward.

[Tom Tugendhat]

I am entirely supportive of the idea that IPCO should update the ISC and the Secretary of State about how it is working and provide information so that a proper view can be taken. I think that is entirely appropriate.

[Mr Jones]

Well, that would be fine if the Government did not redact things in IPCO reports and try to stop us getting access to—[Interruption.] I am sorry, but the Government are doing that. They have done it over the past few years. That is the problem. The Government are paying lip service to the ISC. We are not trying to thwart the work of our security services; we are an important part of the democratic oversight of them. That is why we were set up under the Justice and Security Act 2013. I am sorry to say that the Government are trying to drive a coach and horses through it, including by preventing information from IPCO from being given to us.

[Tom Tugendhat]

I think we have covered the area, and I have said all I am going to about the matter.

Question put and agreed to.

Clause 15 accordingly ordered to stand part of the Bill.

Clause 16

Powers to require retention of certain data

Question proposed, That the clause stand part of the Bill.

[The Chair]

With this it will be convenient to discuss clause 17 stand part.

[Tom Tugendhat]

Section 87(4) of the IPA provides that a data retention notice cannot require the operator to retain so-called “third party data”. There is no intention to revisit the principle of this important provision, but technological advancements have highlighted some discrete and unintended consequences. For example, the Secretary of State is prevented from placing communications data retention obligations on a UK telecommunications operator in relation to data associated with users of a foreign SIM card within the UK.

Clause 16 addresses those unintended consequences and makes an exception for that data within Section 87(4), so that data in relation to roamers using a foreign SIM in the UK would be treated in an equivalent way to the data that could be retained in relation to users of UK SIM cards. Clause 16 also clarifies that communication data required for an internet connection record can be subject to a data retention notice. All existing safeguards will continue to apply.

Continuing to clause 17, the IPA already has extraterritorial effect. Data retention notices—or DRNs—and interception technical capability notices—or TCNs—can be given to a person overseas where there is an operational requirement, and it is necessary and proportionate to do so. However, only TCNs are currently enforceable in relation to a person overseas.

Clause 17 amends section 95 and 97 of the IPA to allow extraterritorial enforcement of DRNs, if required, for UK security purposes when addressing emerging technology and the increasing volume of data being held overseas, bringing them in line with interception TCNs. It is vital to have this further legal lever, if needed, to maintain the capabilities that the intelligence and law enforcement agencies need to access the communications data that they need to in the interests of national security and to tackle serious crime.

[Stuart C. McDonald]

I have some comments to make about extraterritoriality, but I will do so in the next debate.

Question put and agreed to.

Clause 16 accordingly ordered to stand part of the Bill.

Clause 17 ordered to stand part of the Bill.

Clause 18

Review of notices by the Secretary of State

Question proposed, That the clause stand part of the Bill.

[The Chair]

With this it will be convenient to discuss clause 19 stand part.

[Tom Tugendhat]

The notice review mechanism is an important safeguard. If operators are dissatisfied with a notice that they are given, or with any part of it, they have a statutory right to refer it to the Secretary of State for a review. Clause 18 is essential to ensure that operators do not make any technical changes during the review period that would have a negative impact on existing lawful access capabilities.

Operators will not be required to make changes to specifically comply with the notice. However, they will be required to maintain the status quo. If there was lawful access at the point at which a notice was given, access to data must be maintained by the operator while the notice is being comprehensively reviewed. This will ensure that law enforcement and intelligence agencies continue to have access to vital data during that period in order to keep people safe.

To be clear, companies can continue to make technical changes or roll out new services during the review period, so long as lawful access remains unaffected. The status quo will apply only to services or systems specified within the notice; anything outside the scope of the notice will be unaffected. If, at the conclusion of a review, the Secretary of State confirms the effect or varies the notice, maintaining the status quo will be vital to ensure that law enforcement and intelligence communities do not lose access to data during the review period that they would otherwise have been able lawfully to obtain. In the Lords, the Government amended the Bill to introduce a timeline for the review of a notice.

[Dan Jarvis]

I will be very brief. I am grateful for the Minister’s remarks, but I want to raise the concerns of some telecommunications operators and of organisations representing the sector about clauses 18 and 19. These include a view that the role of the proposed new notices regime would hinder and even veto product development.

I know that the Minister and his Department have engaged with stakeholders about those concerns, as have Labour Members. I would be grateful if the Minister briefly set out whether recent engagement has taken place with stakeholders with regard to these matters, and whether he has any further plans to address the concerns that they have expressed about clauses 18 and 19.

[Stuart C. McDonald]

I want to make a similar case. We are now getting into territory where I struggle to understand exactly what is going on, because I am not a tech geek. We are speeding past this measure almost as if it were inconsequential, but the language in some of the briefings that we have received about it is pretty dramatic.

The bundle that was emailed to Committee members this morning includes evidence from Apple that I think needs to be addressed:

“At present, the SoS must navigate important oversight mechanisms before they can block the offering of a new product or service they believe will impact…ability to access private user data.”

Apple summarises the suite of clauses that the Committee is considering, including the requirement in clause 18 to maintain the status quo during the review process, as allowing the Secretary of State

“to block, in secret, the release of a product or service even before the legality of a Technical Capability Notice can be reviewed by independent oversight bodies. The effect of this amendment will be to, extraordinarily, hand the SoS the power to block new products or services prior to their legality being ascertained. This result upends the balance of authority and independent oversight Parliament struck in the IPA.”

Given the new definition of “telecommunications operator” in clause 19, Apple has also warned that there will be serious implications for conflicts with other laws, including the EU GDPR and with US legislation.

As well as Apple, we have heard from various other organisations. TechUK has highlighted problems with broadening the definition of “telecommunications provider” before control of provision of a telecoms service, including to UK users, is established overseas. It also highlights the potential conflict of laws. What if the domestic law in the country in which a company is based does not allow for compliance with the notice that the Home Secretary has delivered? That company might not even be able to raise the issue of a conflict of laws, because it would be sworn to secrecy under the Bill.

According to TechUK, the proposed changes mark a departure in the way that the UK approaches the extraterritorial reach of the UK or UK laws and the consequential conflicts of laws. That was all recognised in the 2016 Act, in which a partial solution was found in the form of a UK-US agreement. Currently, however, the Government have not set out any plans to work towards equivalent solutions.

In relation to clause 21, I will raise similar concerns from other experts, but it is clear that some very serious companies and organisations have significant concerns about what the combination of these notices may end up delivering. Those concerns need addressed.

[Tom Tugendhat]

I thank hon. Members for the spirit in which they have engaged. To be clear, it is absolutely right that we listen to representations from companies around the world, as I am absolutely sure all Members across the House would expect. We are still engaged in conversations: the Home Secretary was on the west coast of the United States only last week, I think, and I maintain regular communication with many different companies, including many of the same companies to which the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East referred.

Let me be quite clear about one aspect. There is a real challenge here, and it is absolutely worth getting to the heart of it. The way in which communications data has evolved means that there are now jurisdictions in which the UK cannot protect its citizens without the co-operation of certain companies overseas. That was always bound to happen to a certain degree, but it is now very much the case: I do not know whether the hon. Gentleman has children, but he will know that many children use tablets and internet-connected devices in their bedroom.

The reach of these companies into the personal life of children in our country has to be a matter of concern to the British Government—it just has to be. The question is who governs these spaces. Are they governed by the association agreements and terms and conditions of the companies, or are they governed by the laws of the United Kingdom passed by Members of this House, of whichever party? That is the fundamental question.

The jurisdiction of this House must be sovereign. If sovereignty is to mean anything, it must mean the ability to protect our children from serious harm. That is basic. Under the IPA and previous legislation going back to the 1980s, this House has always exercised a certain element of influence. Yes, the Bill is extraterritorial, but so are many other Bills that this House passes in relation to the protection of our citizens and our interests. We can have operational reach further than the UK border in order to protect our citizens. That is what we are doing here, and that is what makes it proportional.

It is true that there are conflicts of interest that we have to resolve. I must be honest with the hon. Gentleman: this has come up before. It has even come up in my time. It is something that we have to look at in order to ensure that we address those conflicts and see where the balance of proportionality lies.

It is our very good fortune that many of the conflicts arise between jurisdictions with which we are extremely close. The United States, for example, is an extremely close ally. We regularly—in fact, I regularly—have conversations with the US Justice Department and others to make sure that we manage those conflicts of interest in the best interests of all our citizens. It is unusual for us not to find a resolution, but there are means of dispute resolution when we do not. Although I take the hon. Gentleman’s point, it is not exceptional for companies rightly and understandably to defend their interests where they feel that they have a commercial advantage. That is, of course, reasonable.

The reality is that we are not stopping companies doing anything; we are asking them not to change our ability to protect our citizens, until we have found a fix. If they want to introduce a new product or service or change the way they operate, that is fine: it is nothing to do with us. All we ask is that they maintain our ability to protect our citizens during that translation and into the future.

[Stuart C. McDonald]

I will come on later to another line of argument that relates to the unintended consequences of these permissions, but for now I have a specific question. The Minister has spoken about how conflicts of law can be resolved. Is there not an added complication? If we put a notification notice—if we are calling it that—on a company, it cannot share the fact of that notification with anybody at all. Does that not make it well-nigh impossible to resolve the issue with conflicts of law?

[Tom Tugendhat]

Without going into details that it would be inappropriate to share: no, it does not. I can assure the hon. Member that this is a long-standing practice that has been tested, and it does operate.

On clause 19, I wish to put one further point on the record. The clause will amend the definition of a telecommunications operator, out of an abundance of caution, to ensure that the IPA continues to apply to those to whom it was intended to apply, building on the work that my right hon. Friend the Member for South Holland and The Deepings has laid out. There are circumstances in which a telecommunications system that is used to provide a telecommunications service to persons in the United Kingdom is not itself controlled from the United Kingdom; we have talked about some of those services. The clause will ensure that multinational companies are covered in their totality in the context of the IPA, rather than just specific entities.

Clause 19 does not seek to bring additional companies within the scope of the definition, nor does it seek to constrain how a company structures itself. It is a clarificatory amendment that will improve the effectiveness and efficiency of the regime and the process of giving notices.

Question put and agreed to.

Clause 18 accordingly ordered to stand part of the Bill.

Clause 19 ordered to stand part of the Bill.

Clause 20

Renewal of notices

Question proposed, That the clause stand part of the Bill.

[Tom Tugendhat]

Currently, a notice must be kept under regular review by the Secretary of State, but it does not cease to have effect unless the Secretary of State revokes it. The clause will introduce a notices renewal process such that if two years have passed since a notice was given, varied or renewed, it must go through the double lock process to obtain the approval of a judicial commissioner, in addition to a full necessity and proportionality assessment by the Secretary of State. This change will provide reassurance to operators that their notice remains necessary and proportionate.

Question put and agreed to.

Clause 20 accordingly ordered to stand part of the Bill.

Clause 21

Notification of proposed changes to telecommunications services etc

[Tom Tugendhat]

I beg to move amendment 6, in clause 21, page 45, line 7, leave out first “person” and insert “relevant operator”.

This amendment and amendments 7, 8, 10, 11, 12 and 13 provide that the expression “relevant operator” is used consistently in inserted sections 258A and 258B of the Investigatory Powers Act 2016.

[The Chair]

With this it will be convenient to discuss the following:

Government amendments 7 to 13.

Clause stand part.

[Tom Tugendhat]

Clause 21 is required to safeguard lawful access to critical data, which is needed by law enforcement and intelligence agencies to keep the public safe from serious threats such as terrorism and child sexual exploitation.

Technology has advanced rapidly since 2016, presenting a risk to lawful access capabilities. Notification notices have been introduced in response to technological advancements and will require relevant operators who provide, or are expected to provide, lawful access to data of significant operational value to inform the Secretary of State of any technical changes that they intend to make that will have an impact on existing lawful access capabilities.

The requirement will apply only to relevant services or systems specified within the notice, which will be agreed in consultation with the operator, prior to the notice being given, and will not necessarily apply to all elements of their business. It should be noted that technical capability notices already contain a notification requirement; this is not a new concept to the IPA. The clause replicates the power as a standalone obligation within notification notices.

To be clear, there is no ability within the notification process for the Secretary of State to delay, prevent or alter the roll-out of the operator’s intended change. The requirement is needed to provide the Secretary of State—and, by extension, operational partners—with time to identify and evaluate any potential impact that the change may have on lawful access capabilities. It will also be important in giving operational partners time to adjust their ways of working to ensure that lawful access is maintained. The primary objective of the obligation is to create an opportunity for collaborative working between operators and Government to protect the crucial capabilities required to keep people safe.

Amendments 6 to 13 are minor and technical amendments to ensure consistency of language throughout the clause and the IPA.

[Stuart C. McDonald]

I want to pursue another line of argument that has been put to members of the Committee. I spoke earlier about the principles of the notification regime; I now want to probe the Government on the extent to which they have considered the possible unintended consequences of setting it up.

The evidence circulated this morning includes a letter from academics and experts from the United Kingdom and across North America, who express considerable concern about the outcome of the proposal. During the last debate, the Minister explained that the justification is that companies from across the world have a reach into children’s homes in the United Kingdom, and it is the duty of this Parliament and legislators to keep them safe. I do not think anyone would dispute that at all.

The experts argue that an unintended consequence of being as radical as the proposal in the Bill is that citizens in the United Kingdom could be less safe. Although the Government are trying to restrict the scope of the regime to what happens in the United Kingdom, in reality it will mean that certain updates and security features will not be rolled out to the United Kingdom. In fact, certain organisations may think twice about developing products for the UK market at all.

I am way outside my comfort zone, so I will go straight to what the experts argue in their evidence:

“If enacted, these proposals would have disastrous consequences for the security of users of services operating in the UK, by introducing bureaucratic hurdles that slow the development and deployment of security updates. They would orchestrate a situation in which the UK Government effectively directs how technology is built and maintained, significantly undermining user trust in the safety and security of services and products.”

They argue that this contains a significant risk of increased cyber-crime, as well as of endangering the encryption of important services. They conclude that

“these proposals are anathema to the best interests of UK citizens and businesses and internet users everywhere, and contradict universally accepted security best practices.”

I want to probe the Government on the extent to which they have considered the possible unintended consequences of how these companies may react to their proposals.

[Tom Tugendhat]

I thank the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East for the way in which he has approached the issue, and I am grateful to him for raising it, but I simply disagree. I disagree on the basis of advice that I have received from intelligence services, from UK-based companies, from the National Cyber Security Centre and indeed from many others.

Let us be quite clear. A notification notice does not create any conflicts of law, prevent any updates or prevent the application of any security patches. The only thing that it does is ask a company to keep the UK Government informed if it is going to change the way the UK Government will be able to protect British people. That has led to somewhat more caution in the reading than is necessary in reality; I have had many conversations with companies about that.

[Stuart C. McDonald]

This is a difficult area, but as I understand it, the argument is not that the notification notices themselves have that issue, but that the combination of notices, together with the technical capability notice, the new provisions in relation to review and the status quo, could give the Government that sort of power. That is the argument.

[Tom Tugendhat]

I hear the hon. Gentleman’s point. I will just say that many of these powers have been in place for a significant period. The situation that he describes is not one that we have found or noticed in any way at all. I believe that this is a case of people gilding a lily to turn it into lead.

Amendment 6 agreed to.

Amendments made: 7, in clause 21, page 45, line 8, leave out “person’s” and insert “relevant operator’s”.

See amendment 6.

Amendment 8, in clause 21, page 45, line 29, at end insert—

“‘relevant operator’ has the same meaning as in that section.”

See amendment 6.

Amendment 9, in clause 21, page 45, line 35, leave out “notice, as varied,” and insert “variation”.

This amendment provides that references to the variation of a notice are used consistently in Chapter 1 of Part 9 of the Investigatory Powers Act 2016.

Amendment 10, in clause 21, page 46, line 2, leave out first “person” and insert “relevant operator”.

See amendment 6.

Amendment 11, in clause 21, page 46, line 2, leave out second “person” and insert “relevant operator”.

See amendment 6.

Amendment 12, in clause 21, page 46, line 5, leave out “person” and insert “relevant operator”.

See amendment 6.

Amendment 13, in clause 21, page 46, line 6, leave out “person” and insert “relevant operator”—(Tom Tugendhat.)

See amendment 6.

Clause 21, as amended, ordered to stand part of the Bill.

Clause 22

Interception and examination of communications: Members of Parliament etc

[Tom Tugendhat]

I beg to move amendment 3, in clause 22, page 47, line 17, leave out from “and” to end of line 19 and insert—

“(b) has the necessary operational awareness to decide whether to give approvals under subsection (2).”

This amendment replaces the reference to an individual being required in their routine duties to issue warrants under the Investigatory Powers Act 2016 with a reference to an individual being required to have the necessary operational awareness to decide whether to give approvals under section 26 of that Act.

[The Chair]

With this it will be convenient to discuss Government amendment 4.

[Tom Tugendhat]

Government amendments 3 and 4 require that any Secretary of State to be designated by the Prime Minister as an alternative approver must have the necessary operational awareness of the warrantry process to undertake the role. This change will replace the current drafting inserted in the House of Lords relating to “routine duties”, which is over-restrictive and will undermine the resilience of the triple-lock process that the clauses seek to safeguard.

Requiring relevant operational awareness will ensure the necessary flexibility and resilience while maintaining a proportionate scope for delegation. It will allow scope to include those who may be new to their role and do not yet carry out such duties routinely, or who no longer carry them out routinely due to machinery-of-government changes but have valuable pre-existing knowledge that makes them a suitable alternative approver.

[Sir John Hayes]

I am grateful to the Minister for the fact that his amendment goes some way to dealing with the issues that I and others raised in relation to the change from existing practice. At the moment, the Prime Minister provides the element of what has been described as the triple lock. The Government proposal is that other Secretaries of State should perform the role when the Prime Minister is unable to for a number of reasons. My anxiety, reflected by the Intelligence and Security Committee, is that those Secretaries of State who act for the Prime Minister in such circumstances should be people with operational experience. Typically, that would mean people with warranting powers—people accustomed to the business of issuing warrants, with all that that suggests.

The Government amendment speaks of operational awareness. I think “operational experience” is a better turn of phrase, although I accept the Government’s point that if there was a new Secretary of State—a new Home Secretary would be a good example—they would not necessarily have experience. By definition, they would be new in the job, whether that was the Home Secretary or Foreign Secretary and so on. It might be possible to speak of experience and responsibilities, so it could be either responsibilities or experience. Of course, the Government rightly say that a former Home Secretary, Foreign Secretary or Northern Ireland Secretary who was then doing a different job in Government could be one of the people designated, so I take that point.

The issue here is ensuring that the people who perform the role are competent to do so, and I know that is something on which we agree. It is really a matter of the semantics, but semantics are not always insignificant. I am aware of bolshevism and liberalism, but I would not want anything to do with either of them. I am aware of the separatist case on the United Kingdom, but awareness is as far as I want to go with that—I say that without contention or, indeed, acrimony of any kind. I am not sure that “awareness” is quite the right word, and I simply offer that semantic but not insignificant point to the Minister for his consideration.

--- Later in debate ---

[Mr Jones]

I thought we had had a victory—one of those rare things we get with this Government—from the ISC in the House of Lords, but clearly the Minister has found a way of clawing that back.

[Tom Tugendhat]

I don’t think so!

[Mr Jones]

I think so, because the original wording talked about being able to nominate basically anybody. It was then defined, but the amendment widens it again. It says, “necessary operational awareness”; is that, for example, that any Secretary of State is aware that it is a voluntary process? For example, the Foreign Secretary and the Home Secretary sign warrants, and another Secretary of State could say, “Yes, I’m aware of that.” As the right hon. Member for South Holland and The Deepings said, “operational experience” would be better wording, because “necessary operational awareness” is too broad. What does it actually mean in practice? For example, must they have any experience of having signed a warrant before? Or do they just need to know that the warrantry system exists?

--- Later in debate ---

[Tom Tugendhat]

First, I place on the record my gratitude to the ISC, to which I have listened extremely carefully on this matter; indeed, the Bill has been changed because of it. Let me be clear that although many people are aware of things, to be operationally aware is not the same as to be just aware. Many people were aware of the conflict in Helmand, but I argue that only the hon. Member for Barnsley Central and I were operationally aware of the conflict in Helmand. It is rather a different requirement. It does not mean that one knows about the operation; it means one is aware in an operational sense of it. It is not just an observation of the challenge.

[Mr Jones]

I have to say that from my experience as a former Minister in the Ministry of Defence—I said I was never a Secretary of State—I was not only aware of what was going on but operationally aware. Could an Under-Secretary of State at the Ministry of Defence therefore be designated as one of these people? On Tuesday mornings every week, I was very operationally aware of what was going on in Helmand, for example.

[Tom Tugendhat]

First, this goes alongside the code of practice, which challenges the right hon. Gentleman’s point. It would need to be people who were briefed into the warrantry process. It needs to be somebody who understands what a warrant is, so it is not somebody who is merely observing it, such as a Secretary of State for Culture, Media and Sport.

On the point that my right hon. Friend the Member for South Holland and The Deepings made about experience, I understand the debate. There is a possibility—I know that he and I will do everything we can to prevent it—that there will be a change of Government soon. In that case, there will be an awful lot of people who have absolutely no experience at all of these matters. It would therefore be wise not to set up a provision that would immediately require amendment. Disappointed though we would be at that outcome, my right hon. Friend would agree that he would not want a law to be amended in its first year, if we could possibly avoid it.

To be clear, the Government view the four alternative approvers as being likely to be the Home Secretary, the Foreign Secretary, the Defence Secretary and the Northern Ireland Secretary. Only three would be able to act as the triple-locking Secretaries of State, because of course we would have already used up two of them to do the first two functions. That is why the numbers are required, and why I am incredibly grateful to the ISC for pointing it out and being very cautious on it.

[Mr Jones]

If what the Minister has just said is the case, why do the Government push back on a suggestion that I think they actually made earlier on? The Minister is now pushing back on it. Although I understand the need for the code of practice, if there was a change in it—because there might be sometime—would that come back to Parliament to be approved? We are dancing on the head of a pin here. I do not know why, but that is quite common with the Home Office. The Minister says that it will be mainly four people, but I would love to know what he means by “necessary operational awareness”, which is clunky language.

--- Later in debate ---

[Tom Tugendhat]

Codes of practice will be brought forward through regulations in the usual way, as the right hon. Gentleman is aware, and the House will scrutinise them in the usual way. This is a very legalistic process, as I recognise from the inside as much as he does from the outside. It is true that if, for example, the Northern Ireland Secretary became the Education Secretary, they could then be included. The idea is to ensure that it is somebody who is appropriate to the task, which is why the measure is worded as it is. I always listen to right hon. and hon. Members across the House. I believe that the amendment is the best version that we have come to so far. I will continue to listen to the right hon. Gentleman, as always.

[Mr Jones]

May I make a simple suggestion, then? “Necessary operational awareness” is clunky language; surely what is meant is operational experience. That would cover it, would it not?

[Sir John Hayes]

Given what the Minister said about a change in Government—I do not expect one, but I suppose it is a remote possibility—perhaps the words “operational responsibility or experience” would cover the point made and be slightly tighter than “awareness”. Also, there is the matter of notifying the PM. The Committee made the good suggestion that the PM should be notified as soon as practicable, which may be something with which the Minister agrees. If the Prime Minister were indisposed because of illness or whatever, they would be notified as soon as is practicable that a warrant had been issued.

[Tom Tugendhat]

On the second point, I am sure that, like me, my right hon. Friend finds it absolutely inconceivable that that PM would not be notified. I am not convinced that that must be in primary legislation. I find it genuinely inconceivable that the Prime Minister would not be notified at the earliest opportunity. Obviously, if they could be notified immediately, the provision would not be required.

[Mr Jones]

I made that point to the Home Secretary on Second Reading. Yes, I think that is logical—

[Tom Tugendhat]

Thank you—I am astonished. [Laughter.]

[Mr Jones]

But, Minister, let us be honest: a lot of things that we would have taken for granted were ignored in Downing Street over the last few years. Until Boris Johnson became Prime Minister, it had been a great part of our constitution that convention was followed. Surely it would therefore be better to have the point about notification in the Bill; otherwise, we are leaving it to the free will of convention. I would have trusted convention, but we have had Boris Johnson as Prime Minister.

[Sir John Hayes]

I want to help the Minister, because I do not necessarily agree with the right hon. Member for North Durham; occasionally, he and I do disagree, despite the impression that we have created in this Committee. Notification could be covered in a piece of statutory guidance that supports the Bill. It could state that the Prime Minister should be notified as soon as reasonable practicable, exactly in the terms just described. How’s that?

[Tom Tugendhat]

As is so often the case, I absolutely agree with my right hon. Friend.

[Mr Jones]

Will the Minister put it in the guidance, then?

[Tom Tugendhat]

I will look at putting it in the guidance, as suggested by the right hon. Member.

[Mr Jones]

Just say it. If the Minister says it to the Committee, his civil servants will not have to do it. It is easier doing it that way than having negotiations in the office later on.

[Tom Tugendhat]

I have said what I am going to say on the matter.

Amendment 3 agreed to.

[Dan Jarvis]

I beg to move amendment 17, in clause 22, page 47, line 26, at end insert—

“(2G) If a warrant is issued by an individual designated by the Prime Minister, the Prime Minister must be informed of that decision as soon as it is reasonably practical to do so.”

This amendment would require the Prime Minister to be notified of a decision of a designated Secretary of State to authorise the interception of certain elected representatives’ communications as soon as is reasonably practicable.

[Dan Jarvis]

I am conscious of the debate that has just taken place, so I anticipate what the Minister may say in response. Let us give him another go anyway.

Amendments 17 and 18 relate to the decision of a designated Secretary of State to authorise the interception of elected representatives’ communications and interference with equipment relating to elected representatives. As the Minister will know, two similar amendments were proposed by Lord West in Committee in the other place. The reason for tabling the amendments in Committee in the Commons is that the Opposition believe that the Prime Minister’s overall involvement in the warrants must be retained, even if, in designated cases, it could be retrospective. As I said, I am mindful of the debate that has just taken place.

In the other place, Lord Sharpe rejected Lord West’s amendment on the basis that the oversight arrangements for warrant decisions taken by a designated Secretary of State, which include review by the judicial commissioner, are sufficient scrutiny. I understand that argument, but I wonder why it should not be the case that a Prime Minister is at least notified about decisions to issue warrants that they have had to delegate due to their being unable to do so. Furthermore, would a Prime Minister not being notified of a decision unnecessarily diminish their operational awareness in making future decisions to issue warrants?

My amendment would require the Prime Minister to be informed of a decision taken by a designated Secretary of State on their behalf as soon as the circumstances that have prevented the Prime Minister from approving a warrant in the first place have passed. I hope the Minister and the Committee will understand the emphasis on the important nuance in the difference between review and notification. Mindful of the earlier debate, I hope that the Minister will consider accepting the amendments.

[Tom Tugendhat]

For want of repeating myself, I will probably leave that to stand.

[Mr Tobias Ellwood (Bournemouth East) (Con)]

We are speaking about elected representatives who are then appointed into Government and make decisions, and we have rightly had an important debate, to which the Minister has responded. If possible, it would be helpful if he could confirm who from the agencies would also be involved in the decision making. That would add some faith as to the robustness of the decision making that takes place when such actions are taken.

[Tom Tugendhat]

I am cautious about answering that question, for the simple reason that it depends on where and how the information was gathered, whether it was gathered deliberately or accidentally as part of an existing operation, and whether it was tangential. It is absolutely inconceivable that the chief of whichever agency it was would not be aware and therefore not part of that conversation.

[Mr Ellwood]

That is the confirmation I was seeking.

[The Chair]

With this it will be convenient to discuss the following:

Clause stand part.

Clause 23 stand part.

New clause 1—Requirement for the Prime Minister to appear before the Intelligence and Security Committee—

“After section 26 of the Investigatory Powers Act 2016, insert—

‘26A Requirement for the Prime Minister to appear before the Intelligence and Security Committee

(1) The Prime Minister must appear before the Intelligence and Security Committee of Parliament to provide oral evidence on the matter set out in subsection (2).

(2) The matter is decisions made by the Prime Minister or an individual designated under section 26 to—

(a) give approval to issue warrants to intercept and examine communications of Members of Parliament;

(b) interfere with equipment belonging to Members of Parliament;

(c) other relevant decisions relating to Members of Parliament in the interests of national security

(3) The duty in subsection (1) applies once every session of Parliament.

(4) Subsection (1) does not apply if the Intelligence and Security Committee does not require the Prime Minister to attend.’”

This new clause would require the Prime Minister to appear before the Intelligence and Security Committee to provide oral evidence on decisions made to approve warrants to intercept and examine communications of MPs or to interfere with equipment belonging to MPs, and other relevant decisions relating to MPs.

New clause 4—Interception notification for Members of Parliament etc.—

“After section 26 of the Investigatory Powers Act 2016 (Members of Parliament etc.) insert—

‘26A Interception notification for Members of Parliament etc.

(1) Upon completion of conduct authorised by a warrant under section 26, or the cancellation of a warrant issued under that section, a Judicial Commissioner must notify the subject of the warrant, in writing, of—

(a) the conduct that has taken place, and

(b) the provisions under which the conduct has taken place.

(2) The notification under subsection (1) must be sent within thirty days of the completion of the conduct or cancellation of the warrant.

(3) A Judicial Commissioner may postpone the notification under subsection (1) beyond the time limit under subsection (2) if the Judicial Commissioner assesses that notification may defeat the purposes of an ongoing serious crime or national security investigation relating to the subject of the warrant.

(4) A Judicial Commissioner must consult the person who applied for the warrant in order to fulfil an assessment under subsection (3).’”

This new clause would require members of a relevant legislation who are targets of interception to be notified after the fact, as long as it does not compromise any ongoing investigation.

[Tom Tugendhat]

Clauses 22 and 23 will increase the resilience and flexibility of the warrant system. They will ensure the effective processing of warrants that authorise the interception of, or the use of equipment interference to obtain, the communications of a Member of a relevant legislature when the Prime Minister cannot fulfil their duties due to medical incapacitation or a lack of access to secure communications. The changes will enable the authorisation process to function in an agile manner, thereby enabling the important work of the intelligence agencies to continue while maintaining a high bar for the authorisation of some of the most sensitive warrants.

[Dan Jarvis]

I rise to speak to new clause 1, which relates to oversight by the Intelligence and Security Committee of warrants to intersect and examine the communications of Members or the interference with equipment relating to Members. The context of the new clause will be clear to those who followed the debates in the other place about the role of the ISC. To be absolutely clear, I am not seeking to debate the Wilson doctrine—I know that Members will be relieved to hear that.

The purpose of the new clause is to probe and seek further safeguards for the ISC to provide essential oversight of this extremely sensitive matter, codified by the 2016 Act as part of a wider context of decisions made by the Prime Minister in the interests of national security. Members of this Bill Committee who also serve on the ISC will know that successive Prime Ministers have, unfortunately, not appeared in front of that Committee since, I believe, 2014. As a result, there has been no opportunity for direct accountability over prime ministerial decision making on warrants to intercept and examine Members’ communications, or on interference with equipment relating to Members.

--- Later in debate ---

[Stuart C. McDonald]

I shall speak to new clause 4. We are discussing our very important role as legislators—people who have to scrutinise the Government to represent our constituents. Any interference with that role, and any surveillance of us, is a matter of great significance and some controversy, so there should be as much oversight and transparency as possible. I am not a member of the ISC, and I do not know whether this is something the Minister will be able to tell us, but I would be interested to know how often powers have been used to institute surveillance on MPs in each and every of the past few years.

New clause 4 allows us to debate the possibility of post-surveillance notification. That proposal was debated in the House of Lords, but I think it is something that MPs should be alive to as well. Post-surveillance notification would give judicial commissioners a mandatory duty to notify parliamentarians subject to surveillance once a particular operation or investigation had ended. That would typically introduce a further safeguard to protect democracy and our role as legislators, and would ensure the Government are complying with their obligations under article 8 of the European convention on human rights.

Various objections were made to that line of argument in the House of Lords. For example, it was argued that notification would risk revealing sources or methods. That does not have to be the case; post-surveillance notification can inform an individual of the fact of past surveillance without having to disclose such information. Such a post-surveillance notification regime works in Germany, for example.

In particular, there would be no risk—this was alleged by the Government in the House of Lords—of affording judicial commissioners any operational decision-making power. That is because notification would occur only when a surveillance operation was no longer active and, secondly, any such notification regime could allow the judicial commissioner to consult whomever applied for the warrant in the first place. I am absolutely open to a discussion with the Government about the safeguards that would needed to allow such a measure to be implemented.

The other line of argument pursued by the Government in the House of Lords was that redress is already available to parliamentarians thorough the Investigatory Powers Tribunal. As we all know, however, if someone does not know that they have been subject to surveillance, they have no reason to go to the tribunal in the first place.

This proposal is not without some difficultly, but it is worthy of discussion. The Government’s resistance to it has not always stacked up so far, so I look forward with interest to hearing what the Minister will say.

[Tom Tugendhat]

On the point about notification: forgive me, but it is inconceivable that it should be required in law to inform somebody that they have been subject to an investigation by the intelligence services in such a way. I would be delighted to discuss with the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East in a more secure environment why, for a whole series of reasons, that may not be such a good idea. On the question of the Prime Minister appearing before the ISC, my friend the hon. Member for Barnsley Central knows my views—I have expressed them on many occasions—but that is way above my pay grade.

[Dan Jarvis]

For now!

Question put and agreed to.

Clause 22 accordingly ordered to stand part of the Bill.

Clause 23

Equipment interference: Members of Parliament etc

Amendment made: 4, in clause 23, page 48, line 15, leave out from “and” to end of line 17 and insert—

“(b) has the necessary operational awareness to decide whether to give approvals under subsection (3) or (6).”—(Tom Tugendhat.)

This amendment replaces the reference to an individual being required in their routine duties to issue warrants under the Investigatory Powers Act 2016 with a reference to an individual being required to have the necessary operational awareness to decide whether to give approvals under section 111 of that Act.

Clause 23, as amended, ordered to stand part of the Bill.

Clause 24

Issue of equipment interference warrants

Question proposed, That the clause stand part of the Bill.

--- Later in debate ---

[The Chair]

With this it will be convenient to discuss clauses 25 and 26 stand part.

[Tom Tugendhat]

The Bill makes minor changes to the equipment interference regime, specifically in relation to the warrantry processes associated with its authorisation. The purposes behind those changes are to correct minor drafting errors in the IPA to provide greater clarity, and to improve the efficiency of the warrantry process for equipment interference.

Question put and agreed to.

Clause 24 accordingly ordered to stand part of the Bill.

Clauses 25 and 26 ordered to stand part of the Bill.

Clause 27

Bulk equipment interference: safeguards for confidential journalistic material etc

[Dan Jarvis]

I beg to move amendment 19, in clause 27, page 50, line 9, at end insert—

“(2A) Where a senior official acts on behalf of the Secretary of State under subsection (2), they must inform the Investigatory Powers Commissioner of the selection for examination of BEI material as soon as reasonably practicable.”

This amendment would require a senior official acting on behalf of the Secretary of State who has selected BEI material for examination when there has been an urgent need to do so to inform the Investigatory Powers Commissioner as soon as reasonably practicable.

[Dan Jarvis]

Amendment 19 would require a senior official acting on behalf of the Secretary of State who has selected bulk equipment interference material for examination, when there has been an urgent need to do so, to inform the Investigatory Powers Commissioner as soon as is reasonably practical. It would ensure that every reasonable oversight arrangement was in place concerning the Bill’s investigatory powers provisions.

The amendment does not suggest that the Investigatory Powers Commissioner retrospectively reviews the approval, but instead proposes that they be informed to ensure that there are the most comprehensive and effective oversight arrangements on investigatory powers. We intend not to burden the police and the security services with additional duties, but to ensure that there is the maximum possible oversight with the minimum possible additional work. I hope that the Minister will at least agree with the intentions of the amendment and consider its merits in further strengthening the Bill’s oversight arrangements.

[Tom Tugendhat]

I welcome the amendment, and not only do I agree with it, but I feel that we have already done it. My understanding is that the provision duplicates what already occurs in practice under the current regime, as well as the changes made by clause 27. Currently, the Investigatory Powers Commissioner is already effectively notified when a senior official acting on behalf of the Secretary of State, in urgent circumstances, approves the selection for examination of journalistic material derived from bulk equipment interference. Clause 27 already inserts into the IPA new section 195A(2), which will ensure that the Investigatory Powers Commissioner is notified as soon as is reasonably practical by the Secretary of State when a senior official approves the use of criteria to select for examination journalistic material in reliance on an urgent approval. Effectively, the senior official is informing on behalf of the Secretary of State, or indeed the Secretary of State is informing on behalf of the senior official. We all very much hope it is the former of the two.

Clause 27 enhances the safeguards already afforded to journalistic material within the IPA, and the Government recognise the importance of journalistic freedom within free and democratic societies, which is why we are introducing this measure. Under the current regime, the Investigatory Powers Commissioner must be informed when a communication that contains confidential journalistic material or sources of journalistic material is retained following its examination for purposes other than its destruction. The clause introduces a requirement for prior independent approval by the IPC before any search criteria are used to select such material. Prior independent approval is also required before it is removed.

[Dan Jarvis]

I am grateful to the Minister for that clarification. On that basis, I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 27 ordered to stand part of the Bill.

Clause 28

Exclusion of matters from legal proceedings etc: exceptions

Question proposed, That the clause stand part of the Bill.

[Tom Tugendhat]

Clause 28 will amend schedule 3 to the Investigatory Powers Act 2016 to provide exceptions for disclosures of intercepted materials to inquiries or inquests in Northern Ireland or Scotland into a person’s death. The clause will create parity with existing provisions for coroners in England and Wales. It also adds an exception to enable panel members of the Parole Board in England and Wales to access intercepted materials when considering parole applications and any subsequent appeals. It will also enable relevant coroners in Northern Ireland and sheriffs investigating deaths in Scotland to access intercepted material in connection with their inquiry or inquest.

Question put and agreed to.

Clause 28 accordingly ordered to stand part of the Bill.

Clause 29

Freedom of information: bodies dealing with security matters

Question proposed, That the clause stand part of the Bill.

[Tom Tugendhat]

Under the Freedom of Information Act 2000, the Investigatory Powers Commissioner’s Office is not, and never has been, a public authority within the scope of the Act. The lack of control over the onward disclosure of information related to the functions of the judicial commissioners raises security concerns and has the potential to compromise the IPC’s inspections, which are often, by their very nature, intrinsically sensitive. The clause would prevent sensitive intelligence being further disclosed under the FOIA once such information is supplied by IPCO to a public body.

Question put and agreed to.

Clause 29 accordingly ordered to stand part of the Bill.

Clause 30

Power to make consequential provision

Question proposed, That the clause stand part of the Bill.

[The Chair]

With this it will be convenient to discuss the following:

Clauses 31 and 32 stand part.

Government amendment 5.

Clause 33 stand part.

[Tom Tugendhat]

Clauses 30 to 33 are typical clauses that are included in the vast majority of legislation. Clause 30 allows the Secretary of State, by regulations made by statutory instrument, to make provision that is consequential on this Act. Clause 31 details the extent of the Bill. The Bill extends and applies to the whole of the United Kingdom, with the exception of measures contained in clause 28, in which subsection (2) applies to England and Wales only and subsection (3) applies to Northern Ireland and Scotland only.

As national security is a reserved matter, a legislative consent motion is required from Scotland only in relation to a small number of clauses in part 2—the oversight aspect—of the Bill. I am pleased that the Scottish Government have recommended that legislative consent be given.

Clause 32 details when the Bill commences. Part 6 comes into force on the day on which the Bill is passed; the other provisions come into force on such day as is appointed by regulations made by the Secretary of State.

Question put and agreed to.

Clause 30 accordingly ordered to stand part of the Bill.

Clauses 31 and 32 ordered to stand part of the Bill.

Clause 33

Short title

Amendment made: 5, in clause 33, page 56, line 1, leave out subsection (2).—(Tom Tugendhat.)

This amendment removes the privilege amendment inserted by the Lords.

Clause 33, as amended, ordered to stand part of the Bill.

New Clause 2

Report on the Prime Minister’s engagement with the Intelligence and Security Committee

“After section 240 of the Investigatory Powers Act 2016 insert—

“240A Report on the Prime Minister’s engagement with the Intelligence and Security Committee

(1) The Secretary of State must publish a report about the Prime Minister’s engagement with the Intelligence and Security Committee in relation to the investigatory powers regime and lay the report before Parliament.

(2) The report must be published within six months of the passage of the Investigatory Powers (Amendment) Act 2024, and annually thereafter.””—(Dan Jarvis.)

This new clause would ensure the Secretary of State publishes a report on the engagement, including any meeting held, between the Prime Minister and the Intelligence and Security Committee in relation to the investigatory powers regime.

Brought up.

[Dan Jarvis]

I recognise that we have already had an extensive debate on this matter. I do not intend to detain the Committee any longer, and there is therefore nothing further I wish to say about new clause 2, so I do not wish to move it.

New Clause 3

Impact of Act on EU data adequacy decisions

“Within six months of the passage of this Act, the Secretary of State must publish a report assessing the potential impact of this Act on EU data adequacy decisions relating to the United Kingdom.”—(Dan Jarvis.)

This new clause would require the Secretary of State to publish a report on potential impact of the provisions within this Bill on the requirements necessary to maintain a data adequacy decision by the EU.

Brought up, and read the First time.

[Dan Jarvis]

I beg to move, That the clause be read a Second time.

New clause 3 relates to the impact of the Act on EU data adequacy decisions. When a similar measure to this new clause was proposed by my noble Friend Lord Coaker during the Bill’s passage through the other place, the response from the Minister, Lord Sharpe, confirmed the UK Government’s regular contact with the European Commission about the Bill to ensure that any changes are understood. We welcome that but, as I hope the Minister will understand, such engagement is a continuous process, not a single event or even a series of events. As part of this continuous process, we believe that the Secretary of State should publish a report assessing the potential impact of the Act on EU adequacy decisions.

As Lord Coaker said in the other place:

“The adequacy agreement is dependent on the overall landscape of UK data protections”.—[Official Report, House of Lords, 23 January 2024; Vol. 835, c. 688.]

That is even though the UK protections require some further work. However, given the time pressures, Mrs Cummins, that is all I will say about new clause 3.

[Tom Tugendhat]

First, I welcome the interactions we have had on this point, as well as the work of Lord Coaker and Lord Sharpe to ensure that this is widely understood. The work that has been done is important. We face the challenge that although we obviously commit to fulfilling our side of the TCA and the various agreements we have struck, this is really a matter for the European Commission to determine, so it is not one that we can pass into UK law. It is really a matter for them.

[Dan Jarvis]

I have nothing further to add. I beg to ask leave to withdraw the motion.

Clause, by leave, withdrawn.

[Tom Tugendhat]

On a point of order, Mrs Cummins. I would like to express my extreme personal thanks to Tom Ball and the Bill team, Phoebe, the Lucys, and the many others who have contributed brilliantly to ensure that this Bill has proceeded with speed and professionalism. I thank not only the members of the Committee, but all Members of many parties, and particularly the ISC, which has contributed so much to this Bill, despite what the right hon. Member for North Durham claims. May I say a particular thanks to my very good friend and shadow, the hon. Member for Barnsley Central? It is an enormous pleasure to think that we have gone from fighting the Queen’s enemies to passing the King’s laws together.

[Dan Jarvis]

Further to that point of order, Mrs Cummins. I join the Minister in warmly extending my thanks on behalf of Labour to all members of the Public Bill Committee and all the officials, both in the Department and in the House, who have done a sterling job in getting us to this point. I am grateful to the Minister for his collegiate approach, which I very much hope we will be able to maintain during the further passage of the Bill. Thank you, Mrs Cummins.

Investigatory Powers (Amendment)Bill [Lords]

Tom Tugendhat Excerpts

Report stage
Monday 25th March 2024 Commons Chamber

[Dan Jarvis]

I know that the hon. Member takes these matters incredibly seriously, and he has raised an important point. To be absolutely fair to the Minister and to his Department, I know that this is a matter that the Government have considered very carefully, and that there has been an extensive process of consultation with a range of tech companies—I have met a number of them myself—but I think it only fair to conclude that while of course there are important contributions to be made by tech companies to this debate, these are ultimately matters for the Government and the House to determine. Having said that, new clause 2 would provide a helpful and constructive mechanism for the Government, and we have tabled it in a genuine attempt to be helpful and to monitor very closely the significant challenges that our national security faces from serious and organised crime as a consequence of rapid developments in technology.

[The Minister for Security (Tom Tugendhat)]

I thank the hon. Gentleman for the spirit in which he has addressed this issue, and he deserves a proper response. There is a valid concern that this is a process of engagement with tech companies, and there needs to be a partnership. I will be frank with him: I do not support new clause 2, for the very simple reason that the way in which this interaction takes place has evolved a lot, even in the two years that I have been in post. I suspect that during the four or five years that this House will supervise the Bill, under the next Government and in the five years beyond that, the interaction will evolve again.

What concerns me is that we could write into law a system of oversight and regulation that does not properly address the way in which tech companies are involved in this area. Therefore, the best answer is to have a more iterative process, which I have no doubt the fantastic civil servants with whom I have the privilege to work will adapt. Whoever takes over from me in 20 or 30 years’ time will no doubt want to iterate that as well.

[Dan Jarvis]

I am grateful to the Minister for clarification on the response to new clause 2. He understands that we have tabled it because we genuinely think that it is a mechanism that—let us be honest about it—would not be particularly onerous for the Government, and would be helpful in focusing minds across Government. I completely agree with the point he made about his civil servants, who have been excellent throughout the passage of the Bill. We just happen to differ on this issue, because the Opposition think that the new clause would provide a useful forum for the Government to consider the challenges. He is absolutely right about the rapid evolution of technology, and we think it would be no bad thing to condense Government thinking into a report that would be issued on an annual basis.

[Dan Jarvis]

That is a very important point, and I completely agree. These are complex and difficult matters of public policy, and I completely understand that none of this is easy from the Minister’s perspective. However, if the right hon. Gentleman does not mind my saying so, his point strengthens the case for new clause 2, because we think it would provide a useful mechanism for the Government to track the development of these important matters, but also provide a mechanism for Members of this House to hold the Government to account on them. I am very grateful for the points he has made.

Before turning to amendment 24 on BPDs, which stands in my name, I would be very grateful if the Minister could say whether any progress has been made on arrangements to notify the Investigatory Powers Commissioner when adding new BPDs to existing category authorisations. It might not be in the Bill, but we think that even a reference to it in the IPC’s annual inspection would be helpful progress on this matter. The Minister, my right hon. Friend the Member for North Durham and I have discussed that, and I would be grateful if the Minister could said something about it.

I acknowledge the amendments on BPDs that were tabled by the hon. Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald). Both of our parties have concerns about the definition of “low or no expectation of privacy” for BPDs, which we debated in a pretty constructive fashion on Second Reading and in Committee. However, Labour does not oppose the concept of “low or no expectation of privacy” for BPDs, which is why we will not support amendment 7, which was tabled by the SNP spokesman. Instead, amendment 24, which stands in my name, seeks further clarification on how “low or no expectation of privacy” will be applied to BPDs, with the aim that the parameters must be as clear as possible for the House to understand.

In Committee, the Minister used the Panama papers as an example of leaked and widely republished material being defined as a BPD with a low or no expectation of privacy. I understand why the Minister chose to use that example, but most other leaked documents containing personal information do not attract anywhere near the same level of media attention. Again, I would be grateful if the Minister took this opportunity to provide another example of information from a leak without widescale press coverage that would be suitable for the designation of a bulk personal data set with a low or no expectation of privacy.

[Tom Tugendhat]

As always, the hon. Gentleman is quite right to highlight the areas I touched on. The important thing about the Panama papers was that they changed. They would have enjoyed a high level of privacy, but with republication they became “low/no”. It would not be right to say that any leaked document enjoys “low/no”, but the law should reflect the reality of the data that is currently being held. When data goes from being secret to being effectively public, it would be absurd to hold the intelligence services to a different standard from that which would apply to any of us, who would be able to access it on a website.

[Dan Jarvis]

That is a very useful clarification, and I thank the Minister for it.

--- Later in debate ---

Amendments 21 and 23 get to one of those points that irritates me. It is like a war of attrition with this Government—they cannot be seen to back down on anything or allow anyone else any victory, no matter how small. The code of practice says that once the designated Secretary of State has authorised something, the Prime Minister “should” be informed of any decision made under the alternative approval process as soon as reasonably practicable. It does not say “will” be.

[Tom Tugendhat]

I very much hope the right hon. Gentleman has brought Lord West’s smelling salts with him, because I would like to clarify the concession that Lord West got in the Lords here in the Commons. I can happily commit to strengthening the language on notification requirements in the code of practice, when it is formally brought forward in due course, to require that the Prime Minister “will” be notified of any decisions under the alternative process, rather than “should” be.

[Mr Jones]

I welcome that, but can I hear it again and pin the Minister down a little more? I am sure it is a massive victory, but is he giving a solemn pledge to the House that the code of practice will remove the word “should” and insert the word “will”? Is that what he is agreeing to?

[Tom Tugendhat]

Yes.

[Mr Jones]

Victory at last—there is such power in changing one word. The Minister has given a solemn undertaking on the Floor of the House that the code of practice will change the word “should” to “will”. A small victory for the ISC, but I am sure my colleagues will take it in the spirit in which it is offered. I say to the Minister gently that we could have agreed that the other day when we met, but no doubt the issue that we will be voting on tonight was concentrating his mind.

With that great victory under my belt and those of the members of the ISC, I turn to other amendments. New clause 3, in the name of the right hon. Member for Haltemprice and Howden, deals with

“cruel, inhuman or degrading treatment”.

I understand why he has proposed the new clause. It is always worthwhile debating the issues, which run through the entire Bill. Am I assured that there are processes in place that protect our civil liberties? Yes, I am. However, there are occasions when things can go wrong or people ignore them. I think they have been strengthened greatly, but the right hon. Gentleman refers to an important point. I was on the Committee in 2017 when we did the inquiry into detention and rendition. That took a long time, but it was a good report given where it got to. It unearthed things that were not pleasant but had been done in our names as a democracy.

One conclusion the Committee came to was that in its view the UK tolerated actions and took others that were regarded as inexcusable. Well, they were inexcusable, because as the report outlined, we passed on information to allies who then used it. I think things have changed, and to give Members an example of how the ISC can improve things, we called for a review of the consolidated guidance surrounding the way that security operatives should operate regarding issues of rendition or torture. That led to the Fulford principles, which I think have moved on and tightened up the rules and guidance for members of our security services. That was a big movement forward.

I do not think the right hon. Member for Haltemprice and Howden will push the new clause to a vote, but it reinforces the point that if we have a situation whereby, again, we get information that is passed to one of our allies, we must ensure that those principles are upheld. Am I confident that they are upheld now? I think I am, but how did we get to that pretty damning report in 2017? We got there because those principles and the guidance in place were not followed. We must be vigilant about that, and over the years the right hon. Gentleman has done not only this House but the country a service through his tenacity on these subjects.

--- Later in debate ---

[Mr Jones]

I agree, but that then places an unnecessary burden on the system. The current process with the Secretary of State, the judicial commissioner and the Prime Minister is robust enough to ensure that people are not doing this to find out what someone ordered on Amazon Prime this weekend or to look at their Tesco account, so I think those assurances are fine.

New clause 4 would

“remove the ability of the Secretary of State to authorise the interception of the communications of, or the obtaining of communications intended for, or private information belonging to, Members of Parliament.”

Again, it is good to have this debate, but I would support such a measure for the reasons I have outlined.

The other change in the Bill concerns bulk data. The right hon. Member for South Holland and The Deepings covered the original investigatory powers in detail, but there are now big data sets held not only by public authorities but by others, and that has made it more important that our security services are able to access them. Whenever we do this, however, it means more intrusion, so let me deal with the issue of oversight in the Bill, and with the broader, more intrusive powers to obtain internet connection records for the discovery of targets.

Again, that is something that I and other ISC members totally support, but the authorisation process is internal. One stance that the ISC has taken throughout all this is that if we are to give more powers to our security services, there must be a balance. There will not be a situation whereby what people have seen can be identified, but this power will drag in a lot of people who, as the right hon. Gentleman said earlier, are completely innocent. As I said, there is a need for such a power, but we thought there should be more oversight from the Investigatory Powers Commissioner. Therefore, the points I made about amendment 15 are important.

The Investigatory Powers Commissioner’s Office does a great job of ensuring public support for what we do, but, again, there is an issue around bulk datasets. Some of the examples that were given to ISC members—thanks must go to the Minister, who arranged a meeting for the Committee to be briefed on this—make sense when it comes to the issue of low or no reasonable expectation of privacy. It is burdensome, for example, to access the electoral register, but today the Government have said that somehow that is a secret document. Well, that is not the case under this Bill, in which case it is important that the security services should be able to use it, rather than having to go through the warrantry process. That goes to the point, which my hon. Friend the Member for Barnsley Central raised earlier on, about the definition of “low expectation”.

Another perfectly legitimate reason that the security services need these measures is related to testing new AI models of learning. They need access to these new big datasets, which are out there and which companies use, and the Bill will allow them to have it without going through the warrantry system. If intelligence is going to be on the front foot when it comes to AI, we will have to have these big datasets that will teach the systems how to do it.

The problem comes back my hon. Friend’s question of what is deemed a low or no reasonable expectation of privacy. That is something we have considered throughout this process. One thing the ISC has considered is adding to the existing categories. One suggestion we put forward was that, when the agencies do this, they should have to email the Investigatory Powers Commissioner to notify them that they have done it.

[Tom Tugendhat]

rose—

[Mr Jones]

I hope the Minister is not going to intervene again. My legs might get wobbly if I have to sit down again. I might even need some smelling salts. He has explained the internal system, which I am quite satisfied with, but as I said to him and his civil servants—I think other members of the ISC have also said this—it is not us that he has to convince, but the public.

[Tom Tugendhat]

I thank the right hon. Member for giving way. I just want to assure him that I have taken on board his points. I went back to the agencies and assured myself of the challenge that he had raised and found what I think is a better answer than the one we looked at when we were chatting. I wrote to Sir Brian Leveson and I am delighted to say that he responded, confirming that he will pay specific oversight to this regime in the early years until he is content that it operates in the way that the ISC, the Government and the British public would expect. IPCO has taken on this responsibility, which, I think, answers the question more succinctly than it would be if it were included in the Bill.

[Mr Jones]

Well, I shall take that as half a victory.

[Tom Tugendhat]

Take them where you can get them!

[Mr Jones]

May I just get some clarity? That is a perfectly legitimate way of doing it, and it will mean not interfering with the existing system, which was the concern of both the services and the Minister. I understand that this not as simple as an email being sent. Will that mean that there will be a section looking at this issue in the first annual report? If that is the case, we could at least say to the public that it is actually being considered and the promise is being followed up.

[Tom Tugendhat]

The right hon. Member will understand that IPCO is operationally independent, so I will not instruct the office or speak for Sir Brian, who has been unbelievably rapid and helpful in his response today. I am sure that he will have heard the comments that the right hon. Member made and, no doubt, will want to draw attention to any areas where he has any doubts at all.

[Mr Jones]

That would be helpful. That would give reassurance to the public and provide a test of how the system works. As I have said, I am comfortable with the process of authorisation, but the public must be comfortable with it as well.

[Mr Jones]

I understand where the right hon. Gentleman is coming from. Our original idea about having an email was explained when I met the Minister and his civil servants. I think that that would really cut across some of the processes that we have in place. The suggestion that has been made would be one way of doing it, but IPCO already has the powers to look at such things. The only problem with doing that is that we would then have to set up someone in the agencies to produce another report. I do not want to do anything that holds up their work, and I think that that might do it.

Possibly the Minister’s suggestion of how Sir Brian Leveson is going to do it will give the public some reassurance. Let us not forget that Sir Brian has the power to take action if things are not being done correctly. If we read his reports, we can see that he is not fearful of doing these things. A fair compromise has been put forward. I think we have one and a half victories so far—

[Tom Tugendhat]

I think it’s two.

--- Later in debate ---

Turning to communications data and the way that will be dealt with, and the additional bodies that will have access to some powers that have previously only been in the hands of a very few, could the Minister clarify that in respect of local authorities, this will not be a permissive power? There are times when local government in its regulatory role will be working with the police, dealing with very serious and organised crime—I am thinking of licensing, trading standards and so on, for example. Where serious criminals can be involved in matters that pertain to the functions of local authorities, I accept that there are some cases in which they should have those quite extensive powers, but one would not want to think that every parish council in the land would enjoy the same legal powers as the SIS or MI5.

[Tom Tugendhat]

rose—

[Sir John Hayes]

The Minister is going to satisfy me immediately, it seems.

[Tom Tugendhat]

I will satisfy my right hon. Friend immediately and, I hope, save him time in his speech. Local authority trading standards teams are responsible for a range of legislation where enforcement requires investigation and may need to draw on communications data. The idea is that the powers in this Bill will be in keeping with those powers, not for them to be expansive, so my right hon. Friend is right: it is for serious crimes, as has already been set out.

[Sir John Hayes]

That is excellent—it helps, because the schedule associated with that part of the Bill does not make that explicit. I hope that the Minister, having given that binding assurance to the House, will reinforce it in the explanatory notes associated with the Act and in the code attached to it.

[Tom Tugendhat]

indicated assent.

[Sir John Hayes]

I am seeing the Minister nodding. He might want to say a word or two more when he sums up.

[Sir John Hayes]

The Minister may want to intervene on me again to do exactly what the right hon. Gentleman has suggested.

[Tom Tugendhat]

On the grounds that it will save me time when I wrap up at the end of the debate, I will make it clear now. His Majesty’s Treasury is responsible for civil enforcement of financial sanctions regulations, and some information that is essential to carrying out its civil enforcement functions is now communications data, such as the timestamp on online banking transactions. His Majesty’s Treasury cannot currently use its information powers to compel that information to be provided by a telecoms operator, so to go back to the statement I made earlier, local authority trading standards teams are responsible for a range for legislation where enforcement requires investigation and may need to draw on communications data.

[Sir John Hayes]

That is very helpful and, I think, goes a fair way towards what I want to achieve. The Minister has therefore made clear that the power will not be permissive. If he uses those very words—forgive me for putting them into his mouth, Madam Deputy Speaker—that would also help. These are going to be rarely used, particular powers associated with regulatory or legal functions of local authorities, not permissively available to those local authorities at their whim. That is clear as crystal, is it not?

[Tom Tugendhat]

If my right hon. Friend will forgive me, I will use the words I am using. Those powers will be used as infrequently as we all hope they will be, but they will be used in keeping with the law as described. If the frequency increases, it will be because of the need to act; I am very cautious about saying that these crimes will disappear, and therefore the frequency will change. I am not willing to predict that criminality now.

[Sir John Hayes]

I entirely understand. I used the example myself of trading standards: in Lincolnshire, we have an issue with the sale of illegal cigarettes that has become not a trivial matter, but one of organised crime. It is not restricted to my county or locality: it is a national problem, and it is of course an example of where a local authority, working closely with the police, might well need to use those powers. By the way, those local authorities will be working with other agencies too: because money laundering is involved, His Majesty’s Revenue and Customs might be involved, and so on and so forth. That is a good example of where those powers might be useful in catching very serious criminals indeed, but the word I wanted the Minister to use is that these powers are not permissive. He will understand what I mean by that, and I cannot see why that would present any problem at all, given the reasonable, sensible man he is.

[Tom Tugendhat]

I apologise to my right hon. Friend. These powers are not permissive in the sense that they are expansive: they are permissive only in the sense applied to them by this law, with the restriction of the powers that local authorities already have. They are not to be used in any way other than as set out very clearly in the Bill.

[Sir John Hayes]

I think that is helpful. The Minister will remember that when we debated the original Bill that became the Investigatory Powers Act, one or two newspapers used the term “the snoopers’ charter”, and images were used of local authorities using those powers to investigate people’s rubbish to make sure they were recycling properly, for example. I do not want to add unnecessary levity to our consideration tonight, because we are dealing with very serious matters indeed, but the Minister will understand how that kind of misunderstanding—indeed, misinformation—could do far more harm than good.

[Tom Tugendhat]

Again, just to clarify for my right hon. Friend, this Bill offers no greater expansion than his own Bill did in 2016. In the same way he ensured that Bill was no snoopers’ charter, I assure him that this one is not either.

[Mr Kevan Jones]

rose—

--- Later in debate ---

[Sir John Hayes]

Yes, exactly. The right hon. Gentleman has put it very clearly, and the sense of what the Minister has said has reassured me that it is not the Government’s intention to extend those powers beyond the very strict legal limits associated with the kind of organised crime that he and I have both cited. For me, that is considerable progress. The right hon. Gentleman spoke earlier about half a win; I think that is three quarters of a win, at least. For that reason, I feel that I can move on to my next request of the Minister.

We spoke earlier about IPCO, and its role and association with Government. As the Minister will know and as the right hon. Member for North Durham referred to, this legislation provides for a report to be made available to the ISC on an annual basis. There has been some concern that that report might be rather different from the one that is made available to Ministers and others, and my anxiety is that it should not be different. All that it should exclude is current operational matters; nothing else should be excluded from what my Committee considers, and clearly, it needs to be the same as what IPCO gets. We cannot have three or four different reports.

[Tom Tugendhat]

I can give my right hon. Friend that assurance.

[Sir John Hayes]

That is a 100% win. It is not half a win or three quarters of a win; it is just a win. So we are making huge progress tonight, partly due to the diligence of the members of the ISC and other Members of this House, including the official Opposition, but largely due to the reasonableness of the Minister. He is a listening figure, and he is growing in stature and reputation as a result. I am delighted that the Minister has agreed to the fourth of my requirements.

--- Later in debate ---

[Jim Shannon]

I thank the right hon. Gentleman for his intervention. I share those concerns, but I wish to put on the record my concern for my constituents in relation to how the changes are interpreted and how they will affect people.

I will give the last sentence of the quotation from the Computer & Communications Industry Association:

“They could risk deterring investment in improving service for UK consumers and contribute to a sense that the UK is not a safe market in which to invest.”

Those are the four tech companies, and the questions are on the record—I put them in Hansard—so that perhaps the Minister can give me an answer. Will he outline what mitigations are in place for the matters affecting those four companies in order to secure the tech industry’s place in the fabric of our lives in the United Kingdom?

I am pleased that the Minister has accepted amendment 23, which was tabled by the right hon. Member for North Durham (Mr Jones). The Democratic Unionist party was minded to support that amendment, but, because it has been accepted, we will not need to do so.

While I am aware of valid concerns, I am also aware of the need for this Bill, which the gallant Minister will know about better than most in the House. He served in Northern Ireland, so he understands the implications for us in Northern Ireland and the lives that we have led for some years. I was a part-time soldier in the Ulster Defence Regiment and in the Territorial Army for 14 and a half years. I have been a recipient of security intelligence and know how it can save lives. I am here today because of intelligence, which found out what the IRA’s intentions were. That is a fact. That has affected not just me; over the years, the intelligence services have saved the lives of other hon. and gallant Members. I have many friends who served and who are alive today because of the intelligence service or the Security Service. I had many other friends who unfortunately are not alive today; I remember them as well, so I do.

We must remember that the whole objective of the Bill is to keep us safe, to keep us secure and to ensure that our lives with our families can continue. I do hope that a balance has been struck, as the Minister outlined, because freedom is a prize worthy of getting it right. I know that the Minister wants to get it right, and I want it to be right. Madam Deputy Speaker, you want it to be right as well. Let us do it and get it right tonight.

[Tom Tugendhat]

Right hon. and hon. Members will be delighted to hear that, having answered colleagues as we went along, I have only a few short words to conclude. [Hon. Members: “Hear, hear!”] I know how to keep them happy.

Amendments 3 to 6 to clause 14 concern the restoration of specified public authorities’ general information powers to secure the disclosure of communications data from a telecommunications operator by compulsion. I pay tribute and thanks to my right hon. Friend the Member for South Holland and The Deepings (Sir John Hayes). I hope that Members will have noticed that I have listened carefully to Members across the House, and I believe that this Bill has been pulled together carefully alongside the Intelligence and Security Committee. It is a slight shame I cannot thank the right hon. Member for New Forest East (Sir Julian Lewis) in person, who is sadly at a funeral today. He has played an important role in contributing to and leading the engagement of which I have had the advantage in preparing this Bill.

Let me quickly touch on one or two points. My right hon. and learned Friend the Member for Kenilworth and Southam (Sir Jeremy Wright) spoke about notices. It is important to note that the notices do not block innovation. They do not stop a technical patch or infringe on companies’ ability to update their systems. All they do is make sure that the existing level of access remains while that is being looked at. That is a reasonable element to ensure that the British people are kept safe by the British law enforcement authorities.

[Sir Jeremy Wright]

I understand what my right hon. Friend is saying, but the practical consequence of issuing such a notice is that the development of the product about which concern has been expressed has to stop. Therefore, the infringement on commercial liberty, in practice, is exactly what I have described, is it not?

[Tom Tugendhat]

If my right hon. and learned Friend will forgive me, I will be able discuss that in a more secure environment, but I can only say, “Not necessarily.” I will be able to describe why that is in a different environment, but I cannot do it here.

The reason for not accepting amendments 22 and 23 —I understand the points made by right hon. and hon. Friends and Members across the House—is that we are talking about a very limited number of people. One Secretary of State is already used to do the initial request. The second person on the triple lock is a judicial commissioner—a judge. The third therefore has to be one of the four Secretaries of State left. Therefore, it is important that we make sure that it is somebody in whom the Prime Minister has confidence. Given that we are about to have a new Government—I hope the new Conservative Government, but still a new one—it is entirely possible that there will be a new Cabinet and that the routine explanation will not be satisfactory. As routine duties do not have legal clarity, we will not use them.

[Mr Kevan Jones]

The Minister has used that argument before about new Secretaries of State, and it is complete nonsense, is it not? It would not happen on day one unless the Prime Minister suddenly got covid or was indisposed. By the time this came in, those three people would be there anyway. His argument is pretty weak.

[Tom Tugendhat]

The right hon. Member has made his point and I have made mine; I am afraid I will leave it there rather than continue. The ways in which we have been able to engage on the Bill has been incredibly supportive and helpful.

The removal of clause 15 from the Bill would prevent the intelligence agencies and the National Crime Agency from detecting some national security and serious crime threats, and those intent on committing child sexual exportation and abuse. Given the robust oversight of the regime in general, and the internet connection records in particular, we simply do not believe that this is in the best interests of the British public. Removal would benefit only those who threaten our safety and serve to make the work of the intelligence services and the NCA significantly harder as they seek to protect us and bring paedophiles to justice. The Investigatory Powers Commissioner already has the necessary powers to inspect and report on all parts of the CD regime. If the Investigatory Powers Commissioner wishes is to focus attention on condition D of the internet connection record, they have the power to do so. With those clarifications, I commend the Bill to the House.

Question put, That the clause be read a Second time.

--- Later in debate ---

[Tom Tugendhat]

I beg to move, That the Bill be read the Third time.

I pay huge tribute to all the contributions from across this House, and particularly to my hon. Friend the Member for North Cornwall (Scott Mann), who whipped this through in exemplary fashion and will be delighted that since my appointment he has not had to take a Minister’s place on a Bill. He will also be grateful, along with me, to Lord Sharpe in the other place who has led on this Bill brilliantly, and taken us through with exemplary speed. I thank the hon. Member for Barnsley Central (Dan Jarvis), who has been a great friend for many years. We have now completed a Bill together, which really does bring us that bit closer. I also say an enormous thanks to Phoebe, Fintan, Francesca, James, Emer, Lucy x 2, Megan, Sophie, and Tom Ball, whose exemplary work in the Bill Committee has been fantastic.

[Mr Kevan Jones]

It is gratifying that we will get this Bill on the statute book, because it will give our security services the necessary powers to keep us all safe. I add my thanks to the staff of the Committee on which I and other Members served, and like the Minister I thank the civil servants who I have engaged with throughout the passage of the Bill. I also thank my hon. Friend the Member for Barnsley Central (Dan Jarvis) for his engagement on the Bill. The right hon. Member for New Forest East (Sir Julian Lewis) would have liked to have been here today. He has played an integral part not just in speaking about the Bill, but in his work on the ISC. As I said earlier, unfortunately he is at the funeral of Lord Cormack; the House will understand his reason.

As I said, the Bill will improve our abilities. Perhaps the Minister would also like to put on record his thanks to the ISC, which he forgot to do. It might have been a painful process at times, but can I give him some advice, possibly for the future? He may well have been able to solve some of these issues earlier in our discussions, and avoided keeping his colleagues here on a Monday night—[Interruption.] The Secretary of State for Levelling Up, Housing and Communities says from a sedentary position that that was impossible, but the Minister has agreed to our amendments.

[Tom Tugendhat]

I was going to do so!

[Mr Jones]

The Minister says that he was going to, but if he had done that last week we could perhaps have had very short discussions tonight.