Covert human intelligence sources: code of practice

8. Safeguards (including privileged or confidential information)

Introduction

8.1. This chapter provides guidance on the procedures and safeguards to be applied in relation to the handling of any material obtained through use or conduct of a CHIS. It also details the procedures and safeguards to be applied where authorisations are likely to result in the acquisition of material subject to legal privilege, or other confidential material including journalistic material and the constituency business of a member of a relevant legislature ^[18] .

8.2. Public authorities should ensure that their actions when handling private information obtained by means of the use or conduct of a CHIS comply with relevant legal frameworks so that any interference with privacy is justified in accordance with Article 8(2) of the European Convention on Human Rights. Compliance with these legal frameworks will ensure that the handling of private information so obtained continues to be lawful, justified and strictly controlled, and is subject to robust and effective safeguards.

8.3. All material obtained through the use or conduct of a CHIS must be handled in accordance with safeguards which the public authority has approved in line with the requirements of this code. These safeguards should be made available to the IPC. Breaches of these safeguards must be reported to the IPC in a way that is agreed with the IPC. Public authorities must keep their internal safeguards under periodic review to ensure that they remain up-to-date and effective. During the course of such periodic reviews, public authorities must consider whether more of their internal arrangements might safely and usefully be put into the public domain.

8.4. Dissemination, copying and retention of material obtained through use or conduct of a CHIS must be limited to the minimum necessary for the authorised purposes. Dissemination, copying and retention is necessary for the authorised purposes if the material:

• is, or is likely to become, necessary for any of the statutory purposes set out in RIP(S)A;
• is necessary for facilitating the carrying out of the functions under RIP(S)A of the public authority ;
• is necessary for facilitating the carrying out of any functions of the IPC or the IPT;
• is necessary for the purposes of legal proceedings; or
• is necessary for the performance of the functions of any person by or under any enactment.

Retention and destruction of material

8.5. Each public authority must ensure that arrangements are in place for the secure handling, storage and destruction of material obtained through the use or conduct of a CHIS. Authorising officers must ensure compliance with the appropriate data protection requirements under the data protection law and any relevant codes of practice produced by individual authorities relating to the handling and storage of material.

8.6. Where the product of the use or conduct of a CHIS could be relevant to pending or future criminal or civil proceedings, it should be retained in accordance with applicable disclosure requirements.

8.7. Subject to the provisions in Chapter 4, there is nothing in RIP(S)A or this code which prevents material obtained from authorisations for the use or conduct of a CHIS for a particular purpose from being used to further other purposes.

Law enforcement agencies

8.8. In the cases of the law enforcement agencies, particular attention is drawn to the requirements of Part 6 of the Criminal Justice and Licensing (Scotland) Act 2010. This requires that material which is obtained in the course of a criminal investigation and which may be relevant to the investigation must be provided to the prosecutor.

Use of material as evidence

8.9. Subject to the provisions in this chapter, material obtained from a CHIS may be used as evidence in criminal proceedings. The admissibility of evidence is governed by the common law and impacted by the Human Rights Act 1998. While this code does not affect the application of those rules, obtaining appropriate authorisations should help ensure the admissibility of evidence derived from CHIS.

8.10. Product obtained by a CHIS is subject to the ordinary rules for retention and disclosure of material.

8.11. Any decisions by a Judicial Commissioner in respect of granting prior approval for use or conduct of a CHIS shall not be subject to appeal or be liable to be questioned in any court. ^[19]

8.12. Ensuring the continuity and integrity of evidence is critical to every prosecution. These considerations will apply to any material acquired through use or conduct of a CHIS that is used in evidence. When information obtained through use or conduct of a CHIS is used evidentially, the public authority should be able to demonstrate how the evidence has been obtained, to the extent required by the relevant rules of evidence and disclosure.

8.13. Where material acquired through use or conduct of a CHIS could be relevant to pending or future criminal or civil proceedings, it should be retained in accordance with established disclosure requirements.

Reviewing authorisations

8.14. Regular reviews of all authorisations should be undertaken during their lifetime to assess the necessity and proportionality of the conduct. Particular attention should be given to the need to review authorisations frequently where they involve a high level of intrusion into private life or significant collateral intrusion, or particularly sensitive information is likely to be obtained. At the point the public authority is considering applying for an authorisation, they must have regard to whether the level of protection to be applied in relation to information obtained under the authorisation is higher because of the particular sensitivity of that information.

8.15. In each case, unless specified by a Judicial Commissioner, the frequency of reviews should be determined by the public authority that made the application. This should be as frequently as is considered necessary and proportionate.

8.16. In the event that there are any significant and substantive changes to the nature of the operation during the currency of the authorisation, the public authority should consider whether it is necessary to apply for a new authorisation.

Handling material

8.17. Paragraphs 8.20 to 8.25 provide guidance as to the safeguards which govern the dissemination, copying, storage and destruction of material obtained through use or conduct of a CHIS. Each public authority must ensure that there are internal arrangements in force for securing that the requirements of these safeguards are satisfied in relation to such material. Authorising officers, through their relevant Data Protection Officer, must ensure compliance with all data protection requirements under data protection law including any relevant internal arrangements produced by individual authorities relating to the handling and storage of material.

8.18. The heads of law enforcement agencies are also under a duty to ensure that arrangements are in force to secure that: (i) no information is obtained except so far as necessary for the proper discharge of their functions; and (ii) no information is disclosed except so far as is necessary for those functions, for the purpose of any criminal proceedings.

8.19. Public authorities' internal arrangements should be made available to the IPC. The arrangements should ensure that the disclosure, copying and retention of material obtained through use or conduct of a CHIS is limited to the minimum necessary for the authorised purposes. Breaches of these handling arrangements should be reported to the IPC.

Dissemination of material

8.20. Material acquired through use or conduct of a CHIS may need to be disseminated both within and between agencies, as well as to consumers of intelligence (which includes oversight bodies for example), where necessary in order for action to be taken on it. Material which tends to indicate the presence, activity or identity of a specific CHIS should be classed and handled as highly sensitive material. The number of persons to whom such material is disclosed, and the extent of disclosure, is limited to the minimum that is necessary for the authorised purposes. This obligation applies equally to disclosure to additional persons within an agency, and to disclosure outside an agency. It may be enforced, where appropriate, by prohibiting disclosure to persons who have not been appropriately vetted and also by the need-to-know principle in accordance with section 7(6)(e) of RIP(S)A: this requires that records maintained by the relevant investigating authority that disclose the identity of the source will not be available to persons except to the extent that there is a need for access to them to be made available to those persons. For example, if a summary of the material will suffice, no more than that should be disclosed.

8.21. The obligations apply not just to the original public authority, but also to anyone to whom the material is subsequently disclosed. In some cases this will be achieved by requiring the latter to obtain the original public authority's permission before disclosing the material further. In others, explicit safeguards should be applied to secondary recipients. The above is not intended to affect arrangements for sharing actionable intelligence in accordance with the statutory functions and procedures of public authorities, particularly where that information has been prepared to ensure that it does not disclose the identity of the CHIS or sensitive working processes.

Copying

8.22. Material obtained through use or conduct of a CHIS may only be copied to the extent necessary for the authorised purpose. Copies include not only direct copies of the whole of the material, but also extracts and summaries and any other records which contain material obtained through use or conduct of a CHIS. The making, distribution and destruction of any such copies, extracts and summaries should be recorded in order to ensure that material is not being copied more widely than is necessary.

Storage

8.23. Material obtained through use or conduct of a CHIS and all copies, extracts and summaries which contain such material, must be handled and stored securely, so as to minimise the risk of loss or theft. It must be held so as to be inaccessible to persons without the required level of security clearance (where applicable). This requirement to store such material securely applies to all those who are responsible for the handling of the material.

8.24. In particular, each public authority must apply the following protective security measures:

• physical security to protect any premises where the information may be stored or accessed;
• ICT security to minimise the risk of unauthorised access to ICT systems; and
• an appropriate security clearance regime for personnel which is designed to provide assurance that those who have access to this material are reliable and trustworthy.

Destruction

8.25. Material obtained through use or conduct of a CHIS, and all copies, extracts and summaries which contain such material, should be scheduled for deletion or destruction and securely destroyed as soon as they are no longer needed for the authorised purpose. If such information is retained, it should be reviewed at appropriate intervals to confirm that the justification for its retention is still valid. In this context, destroying material means taking such steps as might be necessary to make access to the data impossible. If such material is retained, it should be reviewed at appropriate intervals to confirm that the justification for its retention is still valid.

Protection of the identity of a CHIS

8.26. People who take on the role of a CHIS may place themselves at considerable risk, while their continued co-operation is of great importance to the effectiveness of investigations and law enforcement work. All organisations have a responsibility to protect the identity of individuals working as a CHIS, and others who may be affected by the disclosure of the operative's identity. Any corrosion of the belief that organisations will attempt to protect the identities of CHIS by all lawful means possible and where appropriate by neither confirming nor denying the existence of a deployment or the identity of the CHIS, would in turn lead to the position where organisations could no longer credibly encourage people to undertake this difficult work, on the basis that their identities and roles would be protected.

8.27. In all cases it should be borne in mind that the risk to the CHIS may not disappear or deplete with time. The CHIS may have been involved in numerous operations either before or since the specific case where their identity is being considered. Exposing their identity, even long after their deployment has concluded, may cause risk not only to them but may cause risk to other individuals associated with the role which they performed, or be harmful to the future sustainability of the CHIS tactic. Such an approach may also be appropriate in circumstances where the CHIS themselves have disclosed their identity, as official confirmation has the potential to lead to the adverse impacts described above.

Confidential or privileged information

8.28. RIP(S)A does not provide any special protection for 'confidential information'. Nevertheless, particular care should be taken in cases where the subject of the intrusion might reasonably expect a high degree of privacy, or where confidential information is involved. Confidential information includes matters subject to legal privilege, confidential personal information, confidential constituent information or confidential journalistic material. So, for example, extra care should be taken where, through the use or conduct of a CHIS, it would be possible to acquire knowledge of discussions between a minister of religion and an individual relating to the latter's spiritual welfare, or between a member of a relevant legislature and a constituent relating to private constituency matters, or wherever matters of medical or journalistic confidentiality or legal privilege may be involved.

8.29. Annex B of this code lists the authorising officer for each public authority, permitted to authorise the use or conduct of a CHIS, in circumstances where knowledge of privileged or confidential information may be acquired. The authorisation levels are set at a more senior level than that required for other CHIS activity, reflecting the sensitive nature of such information.

8.30. In cases where through the use or conduct of a CHIS it is likely that confidential information will be acquired, the deployment of the CHIS is subject to a higher level of authorisation. The 2010 Order lists the authorising officer for each public authority permitted to authorise use or conduct of a CHIS ^[20] . In addition, the 2014 Order puts in place further arrangements that must be adhered to for CHIS authorisations where there is a likelihood of obtaining legally privileged material.

8.31. There may be circumstances when a relevant source, as set out in the 2014 Order, will have access to legally privileged or confidential information. In such circumstances the authorisation process set out in the 2014 Order should be adhered to. The authorisation levels for access to confidential material are set out at Annex A.

Confidential personal information and communications of a member of a relevant legislature

8.32. Confidential personal information is information held in confidence concerning an individual (whether living or dead) who can be identified from it, and the material in question relates to his or her physical or mental health or to spiritual counselling. Such information can include both oral and written communications. Such information as described above is held in confidence if it is held subject to an express or implied undertaking to hold it in confidence or it is subject to a restriction on disclosure or an obligation of confidentiality contained in existing legislation. For example, confidential personal information might include consultations between a health professional and a patient, or information from a patient's medical records.

8.33. Spiritual counselling includes conversations between an individual and a Minister of Religion acting in his or her official capacity, and where the individual being counselled is seeking, or the Minister is imparting, forgiveness, absolution or the resolution of conscience with the authority of the Divine Being(s) of their faith.

8.34. Communications of a member of a relevant legislature includes communications sent by, or intended for, a person who is an elected representative, a member of a relevant legislature's private information and communication between a member of a relevant legislature and a constituent in respect of constituency business.

8.35. Where the intention is to acquire confidential personal information, or communications of a member of a relevant legislature, the reasons should be clearly documented and the specific necessity and proportionality of doing so should be carefully considered by the authorising officer in accordance with the safeguards in this chapter. If the acquisition of confidential personal or elected representative information is likely but not intended, any possible mitigation steps should be considered by the authorising officer and, if none is available, consideration should be given to whether special handling arrangements are required within the relevant public authority.

8.36. Material which has been identified as confidential personal or member of a relevant legislature information should be retained only where it is necessary and proportionate to do so in accordance with the authorised purpose or where otherwise required by law. It should be securely destroyed when its retention is no longer needed for those purposes. If such information is retained, there should be adequate information management systems in place to ensure that continued retention remains necessary and proportionate for the authorised purpose.

8.37. Where confidential personal or member of a relevant legislature information is retained or disseminated to an outside body, reasonable steps should be taken to mark the information as confidential. Where there is any doubt as to the lawfulness of the proposed handling or dissemination of confidential information, advice should be sought from a legal adviser within the relevant public authority before any further dissemination of the material takes place.

8.38. Any case where confidential personal or member of a relevant legislature information is retained, other than for the purpose of destruction, should be reported to the IPC as soon as reasonably practicable, and any material which has been retained should be made available to the IPC on request so that the IPC can consider whether the correct procedures and considerations have been applied.

Applications to acquire material relating to confidential journalistic material and journalists' sources

8.39. There is a strong public interest in protecting a free press and freedom of expression in a democratic society, including the willingness of sources to provide information to journalists anonymously.

8.40. The acquisition of material through use or conduct of a CHIS will be a justifiable interference with an individual's human rights under Articles 8 (right to respect for private and family life) and, in certain circumstances, 10 (freedom of expression) of the ECHR, only if the conduct being authorised is necessary, proportionate and in accordance with law.

8.41. For the purpose of this code, confidential journalistic material is:

• in the case of material contained in a communication, journalistic material which the sender of the communication
• holds in confidence;
• intends the recipient, or intended recipient, of the communication to hold in confidence; or
• in any other case, journalistic material which a person holds in confidence.

8.42. Confidential journalistic material includes material acquired or created for the purposes of journalism and held subject to an undertaking to hold it in confidence, as well as communications resulting in information being acquired for the purposes of journalism and held subject to such an undertaking.

8.43. A person holds material in confidence if they hold the material subject to an express or implied undertaking to hold it in confidence, or they hold the material subject to a restriction on disclosure or an obligation of secrecy contained in an enactment. Confidentiality can continue to attach to confidential journalistic material when it is sent to or held by a person who is neither the journalist nor the source (for example, a news editor who has been sent some notes by a journalist).

8.44. When a public authority applies for an authorisation where the purpose, or one of the purposes, of the authorisation is to authorise the acquisition of material that the authority believes will be confidential journalistic material, the authorisation application must contain a statement that the purpose is to acquire material which the public authority believes will contain confidential journalistic material. The person to whom the application is made may issue the authorisation only if they consider that appropriate safeguards relating to the handling, retention, use and disclosure of the material are in place.

8.45. A source of journalistic information is an individual who provides material intending the recipient to use it for the purpose of journalism or knowing that it is likely to be so used. Any reference to sources in this code should be understood to include any person acting as an intermediary between a journalist and a source.

8.46. When a public authority applies for an authorisation where the purpose, or one of the purposes is to identify or confirm a source of journalistic information, the application must contain a statement confirming that this is the purpose (or one of the purposes) for the application. The person to whom the application is made may issue the authorisation only if they consider that appropriate safeguards relating to the handling, retention, use and disclosure of the material are in place.

8.47. An assessment of whether someone is a journalist (for the purpose of this code) should be made on all the facts and circumstances available at the time. Consideration should be given, in particular, to the frequency of the individual's relevant activities, the level of personal rigour they seek to apply to their work, the type of information that they collect, the means by which they disseminate that information and whether they receive remuneration for their work. This approach will take into account the purpose of the safeguards in this code, which is to protect the proper exercise of free speech, and reflect the role that journalists play in protecting the public interest.

8.48. The acquisition of material through use or conduct of a CHIS will be a justifiable interference with an individual's human rights under Articles 8 (right to respect for private and family life) and, in certain circumstances, 10 (freedom of expression) of the ECHR only if the conduct being authorised is necessary, proportionate and in accordance with law.

8.49. Where material is created or acquired with the intention of furthering a criminal purpose, the material is not to be regarded as having been created or acquired for the purpose of journalism. Once material has been broadcast, no confidentiality can attach to the material so it is not confidential journalistic material. The fact that a person uses social media tools to communicate does not, in itself, indicate that that person is a journalist or that he or she is likely to be holding confidential journalistic material.

8.50. Where confidential journalistic material, or that which identifies the source of journalistic information, is retained and disseminated to an outside body, reasonable steps should be taken to mark the disseminated information as confidential. Where there is any doubt as to the lawfulness of the proposed handling or dissemination of such information, advice should be sought from a legal adviser to the relevant public authority before any further dissemination of the content takes place.

Reporting to the IPC

8.51. Where confidential journalistic material, or that which identifies a source of journalistic information, has been obtained and retained, other than for the purposes of destruction, the matter should be reported to the IPC as soon as reasonably practicable.

Matters subject to legal privilege - Introduction

8.52. In Scotland, the law relating to legal privilege rests on common law principles. In general, communications between professional legal advisers and their clients will be subject to legal privilege unless they are intended for the purposes of furthering a criminal act.

8.53. For the purpose of this code, any communications or items held between lawyer and client, or between a lawyer and another person for the purpose of actual or contemplated litigation (whether civil or criminal), must be presumed to be privileged unless the contrary is established. For example, where it is plain that the communication or item does not form part of a professional consultation of the lawyer, or there is clear and compelling evidence that the 'furthering of criminal purpose' exemption applies. Where there is doubt as to whether the material is subject to legal privilege or over whether material is not subject to material privilege due to the 'in furtherance of criminal purpose' exception, advice should be sought from a legal adviser within the relevant public authority.

8.54. Legal privilege does not apply to communications made with the intention of furthering a criminal purpose (whether the lawyer is acting unwittingly or culpably). Legally privileged communications will lose their protection if, for example, the professional legal adviser is intending to hold or use them for a criminal purpose. But privilege is not lost if a professional legal adviser is properly advising a person who is suspected of having committed a criminal offence. The concept of legal privilege applies to the provision of professional legal advice by any individual, agency or organisation qualified to do so.

8.55. Public authorities may obtain knowledge of matters subject to legal privilege via a CHIS in three scenarios: first, where the public authority responsible for the CHIS deliberately authorised the use or conduct of the CHIS in order to obtain knowledge of matters subject to legal privilege; second, where the CHIS obtains knowledge of matters subject to legal privilege through conduct incidental (within the meaning of section 1(6)(a) of RIP(S)A) to his conduct as a CHIS; and, third, where a CHIS obtains knowledge of matters subject to legal privilege where his conduct cannot properly be regarded as incidental to his conduct as a CHIS. Separate guidance is relevant to each scenario.

Authorisations for the use or conduct of a CHIS intended to obtain, provide access to or disclose knowledge of matters subject to legal privilege

8.56. The 2014 Order creates an enhanced regime of prior approval for such authorisations. It provides that before an authorising officer grants or renews an authorisation to which the Order applies, he or she must give notice to the relevant approving officer. The relevant approving officer will be a Judicial Commissioner. The authorising officer is prohibited from granting or renewing an authorisation to which the 2014 Order applies until he or she has received confirmation in writing that a Judicial Commissioner has approved the application. If a Judicial Commissioner does not approve the application, the authorising officer may still grant an authorisation in respect of the use or conduct of the CHIS in question, but may not authorise the use or conduct of the CHIS to obtain, provide access to, or disclose knowledge of, matters subject to legal privilege.

8.57. Where the intention is to acquire items subject to legal privilege, the authorisation application must contain a statement that the purpose, or one of the purposes, of the authorisation is to obtain legally privileged material. An authorisation should only be issued where there are exceptional and compelling circumstances that make the authorisation necessary, and a Judicial Commissioner approves that decision. Circumstances cannot be exceptional and compelling unless certain conditions are met. Exceptional and compelling circumstances will arise only in a very restricted range of cases, where there is a threat to life or limb or in the interests of national security. The exceptional and compelling test can only be met when the public interest in obtaining the information sought outweighs the public interest in maintaining the confidentiality of legally privileged material, and when there are no other reasonable means of obtaining the required information. The authorised use or conduct must be reasonably regarded as likely to yield the intelligence necessary to counter the threat.

Example: A public authority may need to deliberately target legally privileged communications where the legal consultation might yield intelligence that could prevent harm to a potential victim or victims. For example, if they have intelligence to suggest that an individual is about to commit an act likely to result in serious harm and the consultation may reveal information that could assist in averting the attack (e.g. by revealing details about the location and movements of the individual) then they might want to target the legally privileged communications.

8.58. Further, in considering any such application, the authorising officer or Judicial Commissioner must be satisfied that the proposed use or conduct is proportionate to what is sought to be achieved and must have regard to the public interest in the confidentiality of items subject to privilege. They will wish to consider carefully whether the activity or threat being investigated is of a sufficiently serious nature to override the public interest in preserving the confidentiality of privileged communications, and the likelihood that the information sought will have a positive impact on the investigation. The authorising officer or Judicial Commissioner will take into account both the public interest in preserving the confidentiality of those particular items and the broader public interest in maintaining the confidentiality of items subject to legal privilege more generally. The authorising officer and Judicial Commissioner must consider that there are exceptional and compelling circumstances (see example above) that make it necessary to issue the authorisation and must be satisfied that there are appropriate arrangements in place for the handling, retention, use and destruction of privileged items, and the Judicial Commissioner must approve the issuing authority's decision. In such circumstances, the authorising officer and Judicial Commissioner will be able to impose additional requirements such as regular reporting arrangements, so as to keep the authorisation under review more effectively.

8.59. Where there is a renewal application in respect of an authorisation which has resulted in the obtaining of a legally privileged item or items, that fact should be highlighted in the renewal application.

Circumstances in which the obtaining of knowledge of matters subject to legal privilege by a CHIS or public authority is incidental to the conduct authorised in the authorisation

8.60. The reactive nature of the work of a CHIS, and the need for a CHIS to maintain cover, may make it necessary for a CHIS to engage in conduct which was not envisaged at the time the authorisation was granted, but which is incidental to that conduct. Such incidental conduct is regarded as properly authorised by virtue of section 5 of RIP(S)A, even though it was not specified in the initial authorisation.

8.61. This is likely to occur only in exceptional circumstances, such as where the obtaining of such knowledge is necessary to protect life and limb, including in relation to the CHIS, in circumstances that were not envisaged at the time the authorisation was granted.

8.62. If the use or conduct is not intended to result in the acquisition of knowledge of matters subject to legal privilege, but it is likely that such knowledge will nevertheless be acquired during the operation, the application should include, in addition to the reasons why the use or conduct is considered necessary, an assessment of how likely it is that information which is subject to legal privilege will be obtained. The public authority should also confirm that any inadvertently obtained material that is subject to legal privilege will be treated in accordance with the safeguards set out in this chapter and that reasonable and appropriate steps will be taken to minimise access to the material that is subject to legal privilege.

8.63. If any of these situations arise, the public authority should draw it to the attention of the Judicial Commissioner or Inspector during his next inspection (at which the material should be made available if requested). In addition, the public authority in question should ensure that any knowledge of matters subject to legal privilege obtained through conduct incidental to the use or conduct of a CHIS specified in the authorisation is not used in law enforcement investigations or criminal prosecutions.

8.64. If it becomes apparent that it will be necessary for the CHIS to continue to obtain, provide access to, or disclose knowledge of, matters subject to legal privilege, the initial authorisation should be replaced by an authorisation that has been subject to the prior approval procedure set out in the 2014 Order at the earliest reasonable opportunity.

Unintentional obtaining of knowledge of matters subject to legal privilege by a CHIS

8.65. Public authorities should make every effort to avoid their CHIS unintentionally obtaining, providing access to, or disclosing knowledge of, matters subject to legal privilege. If a public authority assesses that a CHIS may be exposed to such knowledge unintentionally, the public authority should task the CHIS in such a way that this possibility is reduced as far as possible. When debriefing the CHIS, the public authority should make every effort to ensure that any knowledge of matters subject to legal privilege which the CHIS may have obtained is not disclosed to the public authority, unless there are exceptional and compelling circumstances that make such disclosure necessary. If, despite these steps, knowledge of matters subject to legal privilege is unintentionally disclosed to the public authority, the public authority in question should ensure that it is not used in law enforcement investigations or criminal prosecutions. Any unintentional obtaining of knowledge of matters subject to legal privilege by a public authority, together with a description of all steps taken in relation to that material, should be drawn to the attention of the Judicial Commissioner or Inspector during his next inspection (at which the material should be made available if requested).

Lawyers' material

8.66. Where a lawyer (acting in a professional capacity) is the subject of a CHIS operation, it is possible that a substantial proportion of the material which will be acquired will be subject to legal privilege. Therefore, in any case where the subject of a CHIS operation is known to be a lawyer acting in a professional capacity and it is intended that a lawyer's material is to be acquired, the application should be made on the basis that it is intended to acquire communications or items subject to legal privilege and the provisions in paragraphs 8.56 to 8.59 will apply, as relevant.

8.67. The public authority will wish to consider which of the three circumstances apply when items subject to legal privilege will or may be obtained is relevant, and what processes should therefore be followed. In other words, they will need to consider whether items subject to legal privilege are likely to be obtained; whether items subject to legal privilege are intentionally sought; or whether the purpose or one of the purposes is to obtain material that, if it was not created or held with the intention of furthering a criminal purpose, would be subject to legal privilege. This paragraph does not prevent an application being made on the grounds that the lawyer is under investigation for serious criminal offences, in which case, the application or notification must be made on the basis that it is likely to acquire items subject to legal privilege and the additional considerations set out at paragraphs 8.56 to 8.59 will apply.

8.68. Any such case should also be notified to the IPC during his or her next inspection and any material which has been retained should be made available to the IPC on request.

The handling, retention and deletion of material subject to legal privilege

8.69. Legally privileged information is particularly sensitive and any use or conduct of a CHIS which obtains, provides access to or discloses such material may give rise to issues under Article 6 of the ECHR (right to a fair trial) as well as engaging Article 8 (right to respect for private and family life).

8.70. Where public authorities deliberately obtain knowledge of matters subject to legal privilege via the conduct of a CHIS, they may use it to counter the threat which led them to obtain it; but not for other purposes. In particular, public authorities should ensure that knowledge of matters subject to legal privilege is kept separate from law enforcement investigations or criminal prosecutions.

8.71. In cases likely to result in the obtaining by a public authority of knowledge of matters subject to legal privilege, the authorising officer or Judicial Commissioner may require regular reporting so as to be able to decide whether the authorisation should continue. In those cases where knowledge of matters subject to legal privilege has been obtained and retained, the matter should be reported to the authorising officer by means of a review and to the Judicial Commissioner or Inspector during his next inspection (at which the material should be made available if requested).

8.72. A substantial proportion of the communications between a lawyer and his client(s) may be subject to legal privilege. Therefore, in any case where a lawyer is the subject of an investigation or operation, authorising officers should consider whether the special safeguards outlined in this chapter apply. Any material which has been retained from any such investigation or operation should be notified to the Judicial Commissioner or Inspector during his next inspection and made available on request.

8.73. A legal adviser to the public authority must be consulted when it is believed that material which attracts privilege is obtained. The legal adviser is responsible for determining that material is privileged rather than an officer who is involved in an investigation. In cases where there is doubt as to whether material is privileged or not, the IPC may be informed who will be able to give a view. Where it is discovered that privileged material has been obtained inadvertently, an early assessment must be made of whether it is necessary and proportionate to retain it for one or more of the authorised purposes. If not, the material should not be retained, other than for the purpose of its destruction or in accordance with other statutory requirements.

8.74. Material which has been identified as legally privileged (and is being retained for purposes other than its destruction) should be clearly marked as subject to legal privilege and the IPC must be notified of the retention of the items as soon as reasonably practicable. Paragraph 8.51 provides more detail on reporting privileged items to the IPC. Such material should be retained only where it is necessary and proportionate to do so for one or more of the authorised purposes. Privileged items must be securely destroyed when their retention is no longer needed for those purposes. If such material is retained, there must be adequate information management systems in place to ensure that continued retention, for purposes other than their destruction, remains necessary and proportionate for the authorised statutory purposes.