Joint Briefing on the Investigatory Powers (Amendment) Bill

Part 7 of the IPA permits the intelligence services to harvest ‘bulk personal datasets’ (BPDs), defined as ‘a set of information that includes personal data relating to a number of individuals’ whereby ‘the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions’ (IPA, s.199). [...] The Bill does not define the ‘low privacy’ BPD category, but, according to the Bill, the government says its application should be determined by having ‘regard’ to ‘circumstances’ including ‘in particular’ factors such as the ‘nature of the data’, whether the data ‘has been made public by the individuals’ or they have ‘consented to the data being made public’, the ‘extent to which the data is wide. [...] 10 DPA is that the ‘information contained in the personal data has been made public as a result of steps deliberately taken by the data subject’.2 That is a different standard to the nebulous threshold in the new BPD category whereby information is considered ‘low privacy’ according to the ‘extent to which the data is widely known about’, and if it is has ‘already been used in the public domain’,. [...] The explanatory notes accompanying the present Bill explain that the “intention of this [expansion of the ICR power] is to improve target detection, enhancing the usefulness of the power” and “to assist in detecting new subjects of interest.”12 18. [...] In addition to stifling innovation and reducing the security of the processing of personal data on which the digital economy and everyday life depends, the changes proposed at Clauses 17 and 20 may also imperil the EU’s 2021 Adequacy Decision, which enables the seamless flow of personal data from the EU to the UK.