The Investigatory Powers (Amendment) Bill: an Encroachment on Personal Data?

Introduction

Technology bodies have expressed concern towards the UK’s Investigatory Powers (Amendment) Bill (“the Bill”) and the changes contained within it. The leading group, TechUK, has advanced the argument that in its current iteration, the reforms are neither balanced nor proportionate to achieve the Home Office’s desired aim: the protection of the nation from sexual abusers and terrorists.

Moreover, the group is concerned that the increased scope of data harvesting will restrict companies from advancing data protection measures. Guarding user data has come to be expected by individuals, governments and regulators globally, meaning the Bill’s proposals may slow down innovation in this area.

What Amendments are Proposed?

The Bill was introduced in the House of Lords on 8th November 2023. The 2016 Act – which this Bill aims to amend – radically modified the framework governing the powers of public bodies when gathering communications data. Whilst the framework will remain largely intact, the scope of the Act will be altered, pursuant to the Bill’s approval.

The key proposals advanced include:

-       A new, “lighter touch” model for the retention and examination of large personal datasets where there is a low/no expectation of confidentiality within that data.

-       An additional condition allowing authorities to access Internet Connection Records (“ICRs”), enabling them to identify individuals using specific sites and services, when appropriate, to address crime and protect national security.

-       A new requirement for telecommunications operators to inform the Government of changes to products/services which may hamper authorities from lawfully accessing data.

Each of these core suggestions have received noteworthy criticism, with TechUK describing the legislation as “rushed”. For example, the concept of “less sensitive data” (pertaining to the first recommendation) remains loosely defined and ambiguous.

However, it is the second proposal which has attracted the most criticism.

Invasive Data Gathering: Where Should the Boundaries lie?

In January 2024, the Open Rights Group (“the ORG”) published their response to the Bill following the Report Stage in the House of Lords. Their criticisms focused largely on Clause 14 which pertains to ICRs.

Under the current legislative framework, ICRs can be obtained in a targeted and specific way under section 62 of the Investigatory Powers Act, so long as the time and use of a service, or the person’s identity, are known.

Clause 14 broadens this statutory power, enabling “target discovery”, which the ORG describes as “generalised surveillance”. They observe that this approach reverses the orthodox British investigation procedure: surveillance follows on from suspicion. Under the proposed framework, speculative surveillance would be used to root out suspicious behaviour.

It is also noted in the ORG’s report that no other European or Five Eyes country has surveillance laws that explicitly permit for the compulsory generation and retention of ICRs or “web logs” for people within their own borders. For these reasons, the ORG believes the Clause (in its current form) is untenable in a democratic society.

Based on the Government’s explanatory notes of the Bill, it appears that they are aware of the potential harm that Clause 14 may have on individuals. They concede that utilising ICRs for target discovery is ‘highly susceptible to imprecise construction’.

Conclusion

Protecting the public from sexual abusers and terrorism is a fundamental role of the Government. Where legislative changes concern sensitive personal information, however, the legislature must tread with caution; pursue objectives without jeopardising other safeguarding measures.

The Government’s proposals hold potential, but the speed at which the Amendment Bill has processed is alarming. The concerns expressed by TechUK and the ORG indicate that the reforms require more attention before they can truly be viable.

Update (29.04.24): The Bill returned to the House of Lords for consideration on 23rd April 2024. Despite the criticism, the proposed changes were approved and after parliamentary ‘ping-pong’, the amended Bill was approved, coming into law on the 25th April 2024.

By Alexander McLean