Covert human intelligence sources: code of practice

1. Introduction

Definitions

1.1. In this code:

• " RIP(S)A" means the Regulation of Investigatory Powers (Scotland) Act 2000;
• "1997 Act" means the Police Act 1997;
• " RIPA" means the Regulation of Investigatory Powers Act 2000;
• " IPA" means the Investigatory Powers Act 2016;
• "2010 Order" means the Regulation of Investigatory Powers (Prescription of Offices, etc. and Specification of Public Authorities) (Scotland) Order 2010 ^[2] ;
• "2014 Order" means The Regulation of Investigatory Powers (Authorisation of Covert Human Intelligence Sources) (Scotland) Order 2014; and
• " CHIS" means covert human intelligence source.

Background

1.2. This code of practice provides guidance on the authorisation of the use or conduct of a CHIS by public authorities under RIP(S)A.

1.3. This code is issued pursuant to Section 24 of RIP(S)A, which stipulates that the Scottish Ministers shall issue one or more codes of practice in relation to the powers and duties in RIP(S)A. This code replaces the previous code of practice issued in 2014. This version of the code reflects changes to the oversight of investigatory powers made under the IPA, including oversight by the Investigatory Powers Commissioner ( IPC). The previous arrangements, set out in the code of practice issued in December 2014 should be applied, until the relevant provisions of the 2016 Act have been commenced.

1.4. This code of practice is primarily intended for use by the public authorities able to authorise activity under RIP(S)A. It will also allow other interested persons to understand the procedures to be followed by those public authorities. This code is publicly available and should be readily accessible by members of any relevant public authority seeking to use RIP(S)A to authorise the use or conduct of CHIS. ^[3]

Effect of code

1.5. RIP(S)A provides that all codes of practice relating to RIP(S)A are admissible as evidence in criminal and civil proceedings. If any provision of this code appears relevant to any court or tribunal, including the Investigatory Powers Tribunal, established under RIPA, considering any such proceedings, or to the IPC or one of the Judicial Commissioners responsible for overseeing the powers conferred by RIP(S)A, it must be taken into account. Public authorities may also be required to justify, with regard to this code, the use or granting of authorisations in general or the failure to use or grant authorisations where appropriate.

1.6. Examples are included in this code to assist with the illustration and interpretation of certain provisions. Examples are included for guidance only. It is not possible for theoretical examples to replicate the level of detail to be found in real cases. Consequently, public authorities should avoid allowing superficial similarities with the examples to determine their decisions and should not seek to justify their decisions solely by reference to the examples rather than to the law, including the provisions of this code. The examples should not be taken as confirmation that any particular public authority undertakes the activity described; the examples are for illustrative purposes only.

1.7. For the avoidance of doubt, the duty to have regard to the code when exercising functions to which the code relates exists regardless of any contrary content of a public authority's internal advice or guidance.

Scope of covert human intelligence source activity to which this code applies

1.8. RIP(S)A provides for the authorisation of the use or conduct of CHIS. The definitions of these terms are laid out in section 1 of RIP(S)A and Chapter 2 of this code.

1.9. Not all human sources of information will fall within these definitions and an authorisation under RIP(S)A will therefore not always be appropriate.

1.10. Neither RIP(S)A nor this code of practice is intended to affect the existing practices and procedures surrounding criminal participation of CHIS.

Personal data

1.11. Personal data is data which relates to a living individual who can be identified from that data or from that data and other information which is in the possession of, or is likely to come into the possession of, the data controller. It is likely that much of the private information obtained by the methods described in this code will be personal data if it is recorded by the relevant agency. Where this is the case, data protection law will apply to the processing of that personal data until it is securely destroyed.