There’s no law to prevent intelligence agencies using private data. That has to change
|
Version 0 of 1. The secret intelligence service MI6 breached internal rules by allowing one of its officers unjustified access to bulk personal data, the intelligence services commissioner has reported. Sir Mark Waller disclosed the breach in his annual report, published today, but no identifying details have been given. Bulk personal datasets are large databases acquired by or held on an analytical system in the intelligence services – the haystacks in which analysts can find a needle. They contain personal information about a wide range of people in the UK and elsewhere, most of whom are unlikely to be of intelligence interest. Though an increasingly important investigative tool for MI5, MI6 and GCHQ, their existence was disclosed (“avowed”) only three months ago in a report by parliament’s intelligence and security committee. Related: UK surveillance laws need total overhaul, says landmark report As that committee explained, personal datasets are used to identify individuals who may be of interest. To take the obvious example, if the agencies have a telephone number, they can find the name and address of the person to whom the phone is registered. Datasets are also used to establish links to other people and to verify information obtained through other sources. “Given that this capability may be highly intrusive and impacts upon large numbers if people,” the intelligence and security committee said on 12 March, “it is essential that it is tightly regulated.” MPs and peers recommended that Waller’s non-statutory oversight should be put on a statutory footing. The following day, David Cameron issued a direction under updated Regulation of Investigatory Powers Act legislation requiring the intelligence services commissioner to keep under review the “acquisition, use, retention and disclosure” of bulk personal datasets. Waller, a former appeal judge, says the most important aspect of his new role is to see that the agencies have systems in place to protect the privacy of individuals who are not of intelligence interest. “Bulk personal data (BPD) systems hold highly personal data and it is vital that staff only have access if they have a business need,” he writes in his report. “In one recent instance of misuse in SIS [MI6], an officer accessed the BDP system despite having moved to another role which did not require access. The access was for a legitimate work process but was still unacceptable and a breach notice was issued. However, I informed SIS that the corporate failure which allowed the officer to retain access to the system was a more serious breach.” This is all very commendable. But there are much deeper concerns here. Bulk personal datasets are not defined in primary legislation and there are no statutory restrictions on their acquisition or use. Decisions on whether to acquire and retain specific datasets are, instead, taken by review panels of senior officials on grounds of necessity and proportionality. Legal authority for the datasets’ acquisition and use is implicit rather than explicit. Access does not require ministerial approval and misuse attracts no criminal penalties. There are, of course, internal safeguards, but they do not apply to overseas partners with whom the agencies may share their data. Review by a commissioner should be the first step, not the last And we know from the intelligence and security committee’s report that bulk personal datasets may include “personal information such as an individual’s religion, racial or ethnic origin, political views, medical condition, ***, sexual orientation, or any legally privileged, journalistic or otherwise confidential information”. The asterisks indicate a redaction, presumably of personal information akin to a medical condition or sexual orientation. In broad terms, Waller is able to give all the agencies a pretty clean bill of health. He says they properly consider and keep under review whether it is necessary and proportionate to hold or continue to hold bulk personal data. Access is permitted only if needed. Intrusion into the privacy of others is as limited as possible. Monitoring of staff and contractors to prevent unjustified access is as effective as it can be. More generally, and subject to the human errors that are inevitable in large organisations, Waller finds that the agencies and the Ministry of Defence take compliance with the law extremely seriously. But that is not enough. As David Anderson QC recommended two weeks ago, the law itself needs to be changed. As individuals, we have little choice in the information we provide to others. We should not be surprised that some of that information is used by the agencies whose job it is to protect us. But even those who support the security and intelligence services are entitled to demand that the agencies’ use of bulk personal datasets is now put on to a proper statutory footing. Review by a commissioner should be the first step, not the last. |