Senior police officers are to lose the power to self-authorise access to personal phone and web browsing records under a series of late changes to the snooper’s charter law proposed by ministers in an attempt to comply with a European court ruling on Britain’s mass surveillance powers.
A Home Office consultation paper published on Thursday also makes clear that the 250,000 requests each year for access to personal communications data by the police and other public bodies will in future be restricted to investigations into crimes that carry a prison sentence of at least six months.
But the government says the 2016 European court of justice (ECJ) ruling in a case brought by Labour’s deputy leader, Tom Watson, initially with David Davis, now the Brexit secretary, does not apply to the “retention or acquisition” of personal phone, email, web history or other communications data by national security organisations such as GCHQ, MI6 or MI5, “as national security is outside the scope of EU law”.
The new safeguards involve fresh amendments to the Investigatory Powers Act – described as the snooper’s charter – and follow the ECJ ruling, which said the “general and indiscriminate retention” of personal communications data “cannot be considered justified within a democratic society”.
The European judges ruled that such mass harvesting of personal communications data could only be considered lawful if accompanied by strong safeguards including judicial or independent authorisation and only with the objective of fighting serious crime including terrorism.
Davis, before withdrawing from the case when he became a minister, argued that the government’s approach to collecting communications and other personal digital data amounted to “treating the entire nation as suspects”.
However, Watson said the Home Office concessions were flawed and did not go far enough.
“The current legislation fails to protect people’s fundamental rights or respect the rule of law. That’s what my legal challenge proved and I’m glad Amber Rudd is making significant concessions today. But I will be asking the court to go further, because today’s proposals from the Home Office are still flawed.
“Ministers aren’t above the law – they don’t get to pick and choose which rights violations they address and they can’t haggle with the courts to avoid properly protecting people’s freedom. All of the fundamental safeguards demanded by the court must now be implemented.”
Communications data covers the who, where, when, how and with whom of a phone call, text, email or web page visit but does not cover the content of those exchanges, which is covered separately by interception laws that require ministerial authorisation.
The proposed safeguards, which are the subject of a seven-week consultation, include:
- Communications data requests to be authorised by a new body, the Office for Communications Data Authorisation, under the investigatory powers commissioner, Lord Justice Fulford. They are currently authorised by police officers, at the level of superintendent or inspector, and by senior officers in Border Force, the Department for Work and Pensions and HM Revenue & Customs.
- Restricting the use of communications data to investigations of serious crime but using an offence carrying a six-month prison sentence rather than the usual three-year threshold so that offences such as stalking and grooming are not excluded. In the case of internet connection records – tracking personal web browsing histories – the threshold remains at 12 months.
- Additional safeguards that must be taken into account before a “data retention order” can be issued to a phone or postal operator.
- The retention or acquisition of communications data will no longer be allowed for public health, tax collection or to regulate the financial markets.