Data retention bill goes even further than politicians would have you believe
While those within the Westminster bubble obsess about the gender, age and Eurosceptic balance of David Cameron’s re-shuffled cabinet, a serious change to UK surveillance law is being rushed through parliament with little or no scrutiny.
To understand what’s happening we need to go back to April 2014 when the European Court of Justice (ECJ) invalidated the data retention directive. This directive required communications service providers to collect data on what everyone does on their internet and phone networks. The Grand Chamber of the ECJ declared this blanket and indiscriminate data retention to be a serious and disproportionate interference with the right to privacy as far as EU law was concerned.
With the directive gone, the UK’s own data retention regulations were on shaky legal ground. The government’s response to the court’s decision was to effectively declare nothing had changed but that it would review whether anything had changed and in the meantime ISPs must continue to retain everyone’s data, as before. Given that the government’s response to the Edward Snowden revelations on mass surveillance has been “nothing to see here, move along, we’re operating within the law”, the reaction to the ECJ decision was not a surprise.
The surprise came when the government decided in a panic last week that maybe the judgement would undermine data retention in the UK after all and therefore had to pass an emergency law to avoid that catastrophe. That realisation may have had something to do with the legal challenge various human rights groups are pursuing against the GCHQ data collection publicised by Snowden, with the hearing at the Investigatory Powers Tribunal starting this week.
To get the opposition on side it declared the Data Retention and Investigatory Powers (DRIP) Bill an essential measure for saving lives and fighting paedophiles and terrorists. That always plays well with the party faithful of all sides and the media love the “tough on paedophiles, tough on the causes of terrorists” line, or variations thereon.
The home secretary duly made a statement in Parliament. Or, if I were to paraphrase:
those bally European judges may have undermined our pristine UK data retention law; so we’re just re-enforcing it; merely maintaining the “status quo”; there’s nothing to see here move along; even those Labour louts… er… the esteemed opposition agree we have to fight terrorists and paedophiles; and if we don’t get this emergency status quo law passed before we disappear for the summer hols, the country will be overrun with paedophiles and terrorists; did I mention paedophiles and terrorists and status quo?
The text of the DRIP bill was made available as the home secretary was speaking on Thursday July 10. The regulations associated with it appeared on Friday July 11 at 4pm, after most of the people who would be remotely interested had headed off for the weekend. The bill also has 15 pages of explanatory notes and further associated documents available are at the parliamentary website.
The home secretary also seemed to suggest, in giving evidence before the Home Affairs Select Committee on Monday July 14, that Parliament would not see the proposed law in all its glory before having to pass it.
Unfortunately the actual DRIP bill goes much further than the government and opposition appear to be saying.
Section 1 attempts to reinforce the blanket, indiscriminate data retention in the UK that the ECJ declared a breach of EU privacy law. This section also gives the Secretary of State the power to change this law as and when and how she feels like it.
Section 2 is best left to the lawyers. It is one of those Russian doll-like clauses that attempts to explain what words in the statute mean, by referring back and forward to parts of the statute itself and other laws. At one point, I kid you not, it says in S2(1) “‘specify’ means specify”.
Sections 3, 4 and 5 attempt to amend the immensely complex Regulation of Investigatory Powers Act (RIPA) 2000. I have the privilege of knowing a lot of incredibly smart people but I don’t think I’ve ever met anyone who can provide a full, comprehensive and definitive explanation of what RIPA actually means. That the emergency DRIP bill is attempting to revise RIPA without a long and informed debate should raise warning bells.
That it is doing so in a way that attempts to give UK law global reach is unlikely to go down too well with other sovereign territories. Additionally Clause 5 exponentially expands the meaning of “telecommunications service” in such a way as to seemingly catch any individual, entity or organisation using a computer connected to the internet. Your teen running a Minecraft server for his or her friends could well now be required to retain data for subsequent law enforcement access.
The entire DRIP enterprise is a mess. If, as seems likely, it does get passed in haste this week, on a three-line party whip, we will all come to regret it at our leisure. It is going through a sparsely populated Commons chamber today, Tuesday July 15. When the bell goes, MPs roll in to vote as they are instructed by their party leaderships. MPs have, even as I write this, agreed (439 for, 49 against) to fast track DRIP; or as one MP, Mark Durkan, put it, they are “microwaving leglislation onto the statute book”. It is in the House of Lords tomorrow and comes back to the Commons for rubber stamping the following day, Thursday July 17.
Some commentators have labelled DRIP the Dangerous Logs Act. The sad thing about that particular joke is that many of the MPs voting it through in the next few days will not get it. More seriously, this fast tracking of an ill-thought-through emergency surveillance bill is an affront to the rule of law.
If the government were serious that there is an emergency here, they should postpone their holidays for a couple of weeks and devote the time to comprehensive public and parliamentary debate about the issues connected to the DRIP bill.