On Saturday, a grassroots petition asking for the Investigatory Powers Bill to be repealed reached over 100,000 signatures on Parliament’s petition site. This means it will be considered for debate. This is fantastic news.
It followed a week of press coverage warning how everyone’s website history would be recorded for a year, and how many organisations would be able to access that data. These are proposals that have caused public consternation for a decade.
What does this huge public response mean, given that the Bill has been voted on by both Houses of Parliament with seemingly little interest from the public? Why was there so little debate in the press, given that this has been debated in Commons, Lords and committees for practically six months now?
In my view, Brexit has a lot to do with our predicament. The media, MPs and public were almost entirely preoccupied with the vote and its aftermath when it mattered, in May and June. In those two months, MPs had their major debates, and the campaign against the Bill threw everything we had at raising public consciousness, including a huge media campaign and awareness raising online, but without the kind of response we are seeing now.
MPs now have another chance to consider what they have voted for. They may be tempted to reject this petition, as it their right, as the issue has been through a full Parliamentary procedure, and subject to very recent Commons votes. However I do not believe that Parliament has given this Bill the thought it deserved and is weaker for that lack of serious challenge. For these reasons, I would urge that people keep signing the petition, and continue building the number up. Parliament must be shown that there is still a great deal of concern.
Of course it is unlikely that the whole bill will be undone, as the petition demands. Not all of the bill is completely bad, either; oversight arrangements are generally improved.
But what Parliament can and must do is look again at measures which constitute mass interference into people’s privacy. Parliament may be forced to re-legislate several of the measures in the Bill, as a consequence of legal actions that are soon to come back, so this request for a debate gives a timely opportunity to consider the issues that will be brought up by the courts.
The first of the judgments is the case against data retention brought by Tom Watson (and David Davis, before he became a minister). This case went before the Court of Justice of the EU, to work out how UK law should deal with the CJEU judgment against EU data retention. The likely result is the CJEU will state that there are minimum privacy safeguards expected in EU law.
These will be common sense, perhaps restricting what data can be kept, how it can be used, and most importantly, how access is authorised afterwards. That is how the Advocate General’s opinion suggested the court rules.
The court will almost certainly say that authorisation must be made by an independent body. Currently, police and other authorities have trained staff to make these authorisations, but they are not by any means independent.
The UK data retention regime has been expanded massively by the bill, through the creation of powers to keep Internet Connection Records, and a Home Office or police search engine to access this data. This combination is incredibly intrusive and may also be called into question by the CJEU judgment.
This is what has most upset the signatories of the petition, and must be addressed by Parliament after the judgment comes back early next year.
There are many other problems that have not been properly fixed. They include restraints on hacking, bulk hacking, problems with asking companies to weaken security, and the bulk collection at GCHQ. Perhaps the most stark of these is the way that GCHQ and the United States’ NSA work together.
The Bill does not set out what safeguards and protections are available when people’s data is handed to the USA. Yet data sharing is near complete: with the USA able to access and use practically all of the UK’s raw data, collected in bulk, about UK and foreign citizens. The US does not regard foreigners as having strong privacy rights. Under a Trump presidency, the risks are plainly unacceptable.
The impact of the ECtHR case is harder to know at this point. They have however started to be clearer that indiscriminate collection of data is, let’s say, problematic. They are likely to say things about the safeguards necessary for any surveillance regime. While the most obvious safeguard, legal clarity, has been improved by spelling out the powers the state has in the IP Bill, we expect the court will point to more that can be done.
What Parliament should know, as a consequence of this fantastic petition, is that they need to command the confidence of the public when legislating for intrusive and potentially dangerous powers, and right now, for a significant number of people, that confidence is not there.