Overlooked - Liberty

58 Overlooked: Surveillance and personal privacy in modern Britain
security services and some specialist police agencies such as the Serious Organised Crime
Agency (SOCA) have effectively unfettered access. They are also able to access the ‘audit trail’ of
the register.
The ‘audit trail’ creates some particularly interesting privacy implications for the scheme. Paragraph
9 of Schedule 1 to the IDCA goes far beyond the basic name, address, nationality and so on to be
recorded in the register. It allows for a record to be made of every occasion where information in the
register is provided to anyone, details of the person to whom the information has been given and
‘other particulars’ relating to each occasion this is done. As the register is rolled out, a growing
number of both public and private sector bodies will provide an interface to the NIR. This means that
a detailed record of everyone’s movements, what services they have accessed at what time, and so
on, will be collated. This will create an imprint of our existence going way beyond that currently
created. Some agencies will have unlimited access to it without consent and without the need to
justify access.
While the framework set up by the Bill is broad, it has considerable scope for extension. All powers
of access are subject to extension by order of the Secretary of State. It does seem inevitable that
many agencies that might be considered suitable to gain access to the register will eventually be
granted access. This is not some unfounded ‘Big Brother’ prediction. It has logic and a precedent.
The logic derives from the fact that once a system is in place it is sensible to seek as many uses for
it as possible. If there is any justification for a particular public or private body to be given access
then it is unlikely to be rejected. No government would like to run the risk of allegations that a crime
or terrorist attack could have been prevented if only access to the register had been given to a
particular body. That would be political disaster. Far preferable would be the prospect of a few
allegations of insufficient attention being paid to privacy.
The precedent comes from RIPA. As discussed earlier, RIPA sets out the powers and abilities of public
bodies to undertake differing levels of targeted surveillance such as intercepting communications,
using undercover operatives and obtaining communications traffic. The scheme as set up in the
legislation is structurally similar to the IDCA. The legislation creates the scope of powers and allows
regulations to list those that can use them. Once RIPA was in operation, the Home Office published
regulations in 2003 that would have allowed an unprecedented range of ‘public bodies’ access to
communications data such as records of emails and telephone or mobile phone conversations. The
regulations, dubbed in the press ‘the Snooper’s Charter’, allowed all local authorities as well as such
diverse bodies as the Food Standards Agency and New Forest District Council powers to access
data. Once The Guardian newspaper had run the story there was a surprisingly high level of public
concern resulting in the Government promising to look again at its plans. This was notable for two
reasons. First, the backlash against the plans demonstrated that people could be highly engaged by
the prospect of intrusion from sources other than police and security services. It appeared that people
were much less trusting of their local authority than of MI5. Second, this was, and remains, one of
the few instances where secondary legislation by way of regulation has not been passed as a matter
of course. In fact, the most surprising thing about the Snooper’s Charter was that any attention was
paid to it at all. When the revised and reduced list of public bodies was published it passed though
parliament almost unnoticed. It is likely that any set of regulations passed under the IDCA will also
eventually be passed with little attention being paid to their content.