Privacy International asks Intelligence Agencies about existence of secret oversight regime

For further information please contact PI Legal Officer Millie Graham Wood: camilla@privacyinternational.org

For media enquiries please contact press@privacyinternational.org

Documents obtained by Privacy International reveal the existence of a secret oversight function given to the Intelligence Services Commissioner (ISC), in operation since at least 2014. The details of this function, referred to as the ‘third direction’, remain redacted and only came to light following disclosure of the confidential annex of the Intelligence Services Commissioners’ 2014 report. Privacy International is calling for clarity around the previously undisclosed third direction, especially since the first two directions concern controversial functions of the intelligence services — the collection of bulk personal datasets and the detention and interviewing of detainees overseas.
 
 The Prime Minister can ‘direct’ the ISC to keep under review any aspect of the functions of the Intelligence Services. This power, at section 59A of the Regulation of Investigatory Powers Act (“RIPA”) 2000, was introduced by the Justice and Security Act 2013 and until recently the public and Parliament were led to believe the Prime Minister had only issued two directions. 
 
 The importance of this revelation is underscored by the nature of the two previously secret directions, both referred to in the 2014 confidential annex. The first direction governs the oversight of the highly controversial bulk personal datasets, whose existence was not known until March 2015, despite being in operation for over a decade. Bulk personal datasets are any data sets that are held by companies, organisations, and individuals, such as library card holders or patients with the NHS, that the government requests, copies, and looks through. The government describes such datasets as personal information from citizens who are “unlikely to be of intelligence or security interest”. The second direction relates to the Agencies’ “Consolidated Guidance” regarding the Detention and Interviewing of Detainees Overseas and has been the subject of concern relating to risks of UK action resulting in torture or other ill-treatment.
 
 The disclosure was made by the Security and Intelligence Services during Privacy International’s Bulk Personal Dataset legal challenge. Sir Mark Waller, ISC, states in the Confidential Annex to the Intelligence Services Commissioner’s Report for 2014 at page 4 of the Report:
 

 “Under paragraph 59A of RIPA, inserted by the Justice and Security Act, the Prime Minister may direct me to keep under review the carrying out of any aspect of the functions of the intelligence services. 
 
 The Prime Minister has now issued three such directions placing all of my oversight on a statutory footing. Two of the directions are set out in my open report:
 
 · The acquisition, use, retention, disclosure, storage and deletion of bulk personal datasets including the misuse of data and how this is prevented
 
 · Compliance with the Consolidated Guidance.
 
 · [redacted]
 
 [redacted]”

 
In the quote above, Sir Mark Waller reveals that there are in fact three directions, as opposed to the previously disclosed two. Given that the existence of a third direction has now been made public, Privacy International believes there is no reason why the full explanation of the third direction cannot be published publicly as well. This will ensure that its legal basis and legal interpretations adopted by the Agencies and Commissioner can be analysed and subjected to challenge, if appropriate. 
 
Millie Graham Wood, Legal Officer at Privacy International said:
 
“It is wrong in principle for there to be an entire area of intelligence oversight — and potentially of intelligence activity — about which the public knows nothing at all. The risks of such a position are obvious, given that the Commissioners have previously adopted legal analysis provided by the Agencies in secret, which has turned out to be incorrect. This includes the incorrect conclusion of the Interception of Communications Commissioner that Article 8 ECHR did not apply to the obtaining of Bulk Communications Data and the failure of the Intelligence and Interception of Communications Commissioners to appreciate that the internal arrangements of the handling of legally privileged material by each of the Agencies was plainly defective.”
 
 “The Investigatory Powers Bill was lauded as an attempt to ensure intrusive surveillance powers were subject to robust safeguards and visible, effective oversight. Yet days before the Investigatory Powers Bill it is enacted, we learn of yet another secret power. We invite the Prime Minister to publish the third direction — redacted, summarised or gisted as appropriate — and to republish the open reports of the Intelligence Services Commissioner, to reflect the facts that the existence of the third direction has now been disclosed.”
 
 — ends — 
 
Notes to editors
Privacy International’s letter to the Intelligence Agencies seeking publication and the confidential annex can be found here.

The ISC’s disclosed functions are listed here: http://intelligencecommissioner.com/content.asp?id=4 
 
 Section 59A RIPA was inserted into the Act by the Justice and Security Act 2013. It allows the Prime Minister to expand the statutory oversight functions of the Intelligence Services Commissioner by issuing a direction. Section 59A(5) requires the publication of such directions, subject to limited exceptions:
 
 59A Additional functions of the Intelligence Services Commissioner
 
 …
 
 (5) The Prime Minister must publish, in a manner which the Prime Minister considers appropriate, any direction under this section (and any revocation of such a direction) except so far as it appears to the Prime Minister that such publication would be contrary to the public interest or prejudicial to — 
 
 (a) national security, 
 
 (b) the prevention or detection of serious crime,
 
 (c ) the economic well-being of the United Kingdom, or
 
 (d) the continued discharge of the functions of any public authority whose activities include activities that are subject to review by the Intelligence Services Commissioner.’
 
 
 To date, two section 59A directions have been published:
 
 (a) The Intelligence Services Commissioner (Additional Review Functions) (Consolidated Guidance) Direction 2014 came into force on 28 November 2014. It requires the Commissioner to review compliance with what is known as the “Consolidated Guidance”.
 
 (b) The Intelligence Services Commissioner (Additional Review Functions) (Bulk Personal Datasets) Direction 2015 came into force on 13 March 2015. It requires the Commissioner to review the use of bulk personal datasets by the Security and Intelligence Agencies and the adequacy of safeguards against their misuse.