The draft Investigatory Powers Bill may seem like someone else’s fight: a triangular contest among technology and communications companies, the Home Office as proxy for law enforcement and intelligence agencies, and civil liberties campaigners. Holding the ring is Parliament while the Luxembourg and Strasbourg courts are the tournament referees.
But the fight is over our own internet coming and goings. They stand to be intercepted, captured, retained, processed, stored and accessed at the behest of the State in the numerous ways that the draft bill empowers.
Beyond that, some aspects of the new legislation would directly affect the legal profession and its clients. The most obvious point of engagement is legal professional privilege. What if a proposed intercept or disclosure of communications data would risk revealing the content of privileged communications, or indicate that someone had been talking to their lawyer?
The draft bill leaves these questions to codes of practice. That has come under fire from the Law Society and the Bar Council. The joint parliamentary committee conducting pre-legislative scrutiny has recommended that privilege protection for all categories of acquisition and interference addressed in the bill should be included in the bill and not left to a code of practice.
The draft bill would cast a wider net than present over who could, for instance, be required to assist with an interception warrant, comply with a notice requiring an interception capability to be put in place or retain communications data for up to 12 months.
Private networks enter the fray
The net covers not just public networks (including internet cafés, public libraries and wireless hotspots) but private networks: businesses, universities, schools and even home networks. Few of the existing powers go that far. If in practice it is not intended to use the draft bill’s powers more extensively against private networks, it is unclear why the draft bill throws the net wider at all. If it is intended, there has been little or no discussion of why that change is necessary.
A further reason to pay attention to the bill is one that should concern us all as lawyers – the desire to see good quality law in an important area. Basic rule of law tenets require that intrusive powers should be set out in publicly accessible law. They should be clearly described so that anyone may foresee with reasonable certainty the kind of circumstances in which they may be used.
Clarity of the draft will be key
The existing interception and communications data acquisition legislation, RIPA [the Regulation of Investigatory Powers Act 2000], has for years attracted criticism for its obscurity – ranging from Lord Bingham in 2004 (“perplexing”) to David Anderson QC’s review last year (“incomprehensible to all but a tiny band of initiates”).
A few weeks ago Sir Francis Richards, the director of GCHQ when RIPA was enacted, said on the BBC’s World at One: “The old legislation was designed to be obscure because there was not supposed to be any public understanding of the agencies’ techniques.”
We are moving on from that approach. The Anderson Review called for the new legislation to be ‘comprehensive and comprehensible’. Clarity is not a lawyer’s nice-to-have. It will be central to the bill’s compliance with rule of law principles.
“We are moving on from the RIPA approach. Clarity is not a lawyer’s nice-to-have. It will be central to the bill’s compliance”
However the draft bill falls short on that among other scores. All three parliamentary committees that have recently considered it have criticised the draft bill’s lack of clarity. Home Office security minister John Hayes has acknowledged that the committees have made “valuable recommendations about how the bill could be improved and our proposals clarified”. Some of its provisions approach RIPA standards of impenetrability.
The Home Office faces a formidable task to meet all the committees’ criticisms of the draft bill, at least within the Government’s timescale of publication early this year. That is driven in part by the 31 December 2016 sunset clause in the existing data retention legislation (DRIPA).
Other countries will be following the progress of this legislation. It is likely, for better or worse, to set an international benchmark. Good legislation is unlikely to be achieved by rushing the necessary revisions to the draft bill. The simplest option would be to extend DRIPA for a period to provide breathing space in which to mould the bill into shape.
