The Joint Committee, made up of MPs and peers, has published its report on the Draft Communications Data Bill, a bill which proposes to extend the obligations of communications service providers ("CSPs") to provide law enforcement agencies with greater information in relation to individuals' communication activities. The Committee criticised the bill as being "too sweeping", calling for a redraft, along with a new round of consultation, in order to better address the balance between providing data that will help to tackle serious crime, whilst protecting the privacy of law-abiding citizens.
Failure to consult
The applicability of the bill, announced in June, extends beyond traditional CSPs such as telecoms firms, to social media providers and any services with a communication element, such as social gaming. Such a regime warrants wide ranging consultation with the affected parties. However, the Committee considered the level of consultation carried out was far from sufficient, in particular in relation to overseas service providers, with Facebook stating in its witness evidence to the report "We had no dialogue with the Home Office before the bill was published".
The proposed new measures have the potential to impose significant additional costs for CSPs, with the extended obligations requiring the generation and storage of data that would not ordinarily be kept by CSPs for business purposes and an obligation to capture communications data traversing across their networks which originate from overseas providers. The Committee considered that such obligations might result in the need for some CSPs to re-structure their systems, and yet CSPs were not consulted in relation to the assessment of such potential costs. Accordingly, the Committee criticised the Government's cost assessment as not being robust enough, described the estimated measure of benefits as "misleading and fanciful", and appealed for closer consultation with CSPs in order to obtain a more accurate assessment.
Wide scope and privacy concerns
The legislation, as drafted, would provide the Government with the power to request access to a wide range of communications data. A key recommendation of the committee was that powers should be limited to categories of data for which a case can now be made, which may include data matching IP addresses to users, web logs and certain data from overseas providers. Whilst recognising the Government's desire to "future-proof", the committee made clear that further extension of any powers should be subject to Parliamentary scrutiny.
Particular concern was expressed in relation to the definition of "subscriber data" which could "cover all sorts of data that social networks and other services keep on their customers which can be highly personal, and is not traditionally thought of as communications data." Further consultation on the definition of communications data and the creation of a hierarchy of data types according to the degree of privacy intrusion was recommended in the report. The Committee also highlighted concerns surrounding the provision of internet users' web log history, deeming such information to be at the "more intrusive end of the communications data spectrum", having the potential to reveal considerable information about an individual. In order to alleviate privacy concerns, the Committee highlighted the importance of strengthening the safeguards against abuse of communications data by public authorities and ensuring the security of such information. The Information Commissioner welcomed these comments, which reemphasise the concerns expressed in the ICO's own statement regarding the Bill.
In light of this report it seems clear that further changes to the Bill, along with further consultation with CSPs, will be needed before the reforms can make progress. The Government has acknowledged this, with the Prime Minister's spokesman stating "We accept the substance of the Committee's criticisms and we will now look at how we can redraft the legislation."
The progress of the bill can be tracked on the Parliament website at this link.