Equipment interference code of practice

5 Handling of information, general safeguards and sensitive professions

Overview

5.1 All material obtained under the authority of a targeted equipment interference warrant must be handled in accordance with safeguards which the law enforcement chief considers to be satisfactory ^[13] . The details of these safeguards are made available to the IPC, and they must meet the requirements of sections 129 and 130 of the Act which are set out below. Any breach of these safeguards must be reported to the IPC. The relevant agencies must keep their internal safeguards under periodic review to ensure that they remain up-to-date and effective. During the course of such periodic reviews, the relevant agencies must consider whether more of their internal arrangements might safely and usefully be put into the public domain.

5.2 The relevant agencies must also ensure that their actions when handling private information obtained by equipment interference complies with relevant legal frameworks so that any interference with privacy is justified in accordance with article 8(2) of the ECHR. Compliance with these legal frameworks will ensure the handling of private information so obtained continues to be lawful, justified and strictly controlled, and is subject to robust and effective safeguards.

5.3 In any case where communications, equipment data or other information are obtained under Part 3 of the 1997 Act, the relevant agencies must handle the material so obtained in accordance with the safeguards set out in Covert Surveillance and Property Interference Code. Compliance with these safeguards will ensure that the relevant agency handles the material in accordance with safeguards equivalent to those set out in chapter 5 of this code.

Use of material as evidence

5.4 Subject to the provisions in chapter 5 of this code, material obtained through targeted equipment interference may be used as evidence in criminal proceedings. The admissibility of evidence is primarily governed by the common law and impacted by the Human Rights Act 1998.

5.5 Ensuring the continuity and integrity of evidence is critical to every prosecution. When information obtained from targeted equipment interference is used evidentially, the relevant agencies should be able to demonstrate how the evidence has been recovered, and be capable of showing each process through which the evidence was obtained where appropriate to do so.

5.6 Where the product of targeted equipment interference could be relevant to pending or future criminal or civil proceedings, it should be retained in accordance with established disclosure requirements for a suitable further period, commensurate to any subsequent review.

5.7 The relevant agencies are also under a duty to ensure that arrangements are in force to secure: (i) that no information is obtained except so far as necessary for the proper discharge of their functions; and (ii) that no information is disclosed except so far as is necessary for those functions, for the purpose of any criminal proceedings.

General safeguards

5.8 Section 129 of the Act requires that disclosure, copying and retention of material obtained under targeted equipment interference warrants is limited to the minimum necessary for the authorised purposes. Something is necessary for the authorised purposes if the material:

• is, or is likely to become, necessary on any relevant grounds as set out in section 129(7) of the Act. These are for the purpose of preventing or detecting serious crime, or for the prevention of death or injury;
• is necessary for facilitating the carrying out of the functions under the Act of the law enforcement chief or the person to whom the warrant is addressed;
• is necessary for facilitating the carrying out of any functions of the Judicial Commissioners or the Investigatory Powers Tribunal;
• is necessary for the purposes of legal proceedings; or
• is necessary for the performance of the functions of any person by or under any enactment.

5.9 The relevant agency must always ensure, through their relevant Data Protection officer, compliance with data protection legislation and any relevant internal guidance produced by the agency in relation to handling and storage, retention and dissemination of material.

Reviewing warrants

5.10 Regular reviews of all warrants should be undertaken during their currency to assess the necessity and proportionality for the targeted equipment interference activity to continue. The results of a review should be retained for at least three years. Particular attention should be given to the need to review warrants frequently where the targeted equipment interference involves a high level of intrusion into private life or significant collateral intrusion, or confidential information is likely to be obtained.

5.11 In each case, unless specified by the law enforcement chief or Judicial Commissioner, the frequency of reviews should be determined by the relevant agency which made the application. This should be as frequently as is considered necessary and proportionate.

5.12 In the event that there are any significant and substantive changes to the nature of the interference and/or the identity of the equipment during the currency of the warrant, the relevant agency should consider whether it is necessary to apply for a fresh warrant.

Dissemination of material obtained under a targeted equipment interference warrant

5.13 The number of persons to whom any of the material is disclosed, and the extent of disclosure, is limited to the minimum that is necessary for the authorised purposes. This obligation applies equally to disclosure to additional persons within a relevant agency, and to disclosure outside the relevant agency. In the same way, only so much of the material may be disclosed as is necessary for the authorised purposes. For example, if a summary of the material will suffice, no more than that should be disclosed.

5.14 The obligations apply not just to the original relevant agency which obtained the data, but also to anyone to whom the material is subsequently disclosed. In some cases this will be achieved by requiring the latter to obtain the originator's permission before disclosing the material further. In others, explicit safeguards are applied to secondary recipients.

5.15 Section 130 of the Act provides that where material, or a copy of such material, obtained under a targeted equipment interference warrant is handed over to the authorities of a country or territory outside the UK, the law enforcement chief must ensure that arrangements are in force to ensure that the material is only shared if the relevant agency considers that arrangements corresponding to the requirements in section 129 of the Act (relating to minimising the extent to which material is disclosed, copied, distributed and retained) will apply to the extent that the law enforcement chief considers appropriate. In particular, the material must not be further disclosed to the authorities of a third country or territory unless explicitly agreed with the issuing relevant agency, and must be returned to the issuing relevant agency or securely destroyed when no longer needed.

Offence of making unauthorised disclosure

5.16 Under section 134 of the Act it is a criminal offence to make an unauthorised disclosure of the existence, content or details relating to a targeted equipment interference warrant, the existence or content of any requirement to provide assistance in giving effect to a warrant, any steps taken in pursuance of a warrant and any material derived from targeted equipment interference. This offence applies to all parties listed in section 132(3) of the Act. The offence does not apply however if:

• the disclosure is an excepted disclosure according to section 133 of the Act. For example, a law enforcement officer may be authorised by the person to whom a targeted equipment interference warrant is addressed to disclose material acquired by targeted equipment interference in order to carry out their functions; or
• the individual is unaware that the disclosure of the material in question would be in breach of the duty not to make unauthorised disclosures. This could be because they are not aware that the material they are disclosing is derived from targeted equipment interference, as it may not be identifiable as the product of targeted equipment interference.

5.17 Section 133(2) of the Act sets out that disclosures may be authorised by the warrant, by the person to whom the warrant is addressed or by the terms of any requirement to provide assistance in giving effect to a warrant. If the law enforcement chief or the person to whom the warrant is addressed intends to authorise a disclosure under this section they must first consider the safeguards set out in section 129 of the Act and paragraphs 5.13 to 5.15 of this code.

Copying

5.18 The number of copies of material must be limited to the minimum necessary for the authorised purposes. Copies include not only direct copies of the whole of the material, but also extracts and summaries which identify themselves as the product of a targeted equipment interference warrant, and any record which includes the identities of the persons who owned, used or were in possession of the equipment interfered with under the warrant.

Storage

5.19 Material and all copies, extracts and summaries of it, must be handled and stored securely, so as to minimise the risk of loss or theft. This requirement to store material securely applies to all those who are responsible for handling it, including providers.

5.20 In particular, each relevant agency must apply the following protective security measures:

• physical security to protect any premises where the information may be stored or accessed;
• ICT security to minimise the risk of unauthorised access to ICT systems; and
• an appropriate security clearance regime for personnel which is designed to provide assurance that those who have access to this material are reliable and trustworthy.

Destruction

5.21 Material and all copies, extracts and summaries which can be identified as the product of a targeted equipment interference warrant, must be marked for deletion and securely destroyed as soon as possible once it is no longer necessary or likely to become necessary for any of the authorised purposes.

5.22 If such material is retained, it should be reviewed at appropriate intervals to confirm that the justification for its retention is still valid for one or more of the authorised purposes.

5.23 Any collateral material that has been acquired over the course of a testing or training exercise should be destroyed as soon as reasonably possible following the conclusion of the testing or training.

Safeguards applicable to the handling of material obtained as a result of a request for assistance

5.24 Where material is obtained by a relevant agency as a result of a request to an international partner to undertake targeted equipment interference on its behalf, the material must be subject to the same internal rules and safeguards that apply to the same categories of material when they are obtained directly by the relevant agencies as a result of equipment interference under the Act.

Material involving confidential journalistic material, confidential personal information and exchanges between a member of a relevant legislature ^[14] and another person on constituency business

5.25 Particular consideration should be given in cases where material is obtained under a targeted equipment interference warrant and the subject of the obtaining might reasonably assume a high degree of privacy, or where confidential information is involved. Confidential information includes where confidential journalistic material may be involved; where targeted equipment interference might involve confidential personal information relating to communications between a medical professional or minister of religion and an individual concerning the latter's health or spiritual welfare; or where material concerning communications between a member of a relevant legislature and another person on constituency business may be involved. In such cases, law enforcement chiefs must have regard to whether the level of protection to be applied in relation to obtaining information by virtue of a warrant is higher because of the particular sensitivity of that information.

5.26 Confidential personal information is information held in confidence concerning an individual (whether living or dead) who can be identified from it, and the material in question relates to his or her physical or mental health or to spiritual counselling. Such information can include both oral and written communications. Such information as described above is held in confidence if it is held subject to an express or implied undertaking to hold it in confidence, or is subject to a restriction on disclosure or an obligation of confidentiality contained in existing legislation. For example, confidential personal information might include consultations between a health professional and a patient, or information from a patient's medical records.

5.27 Spiritual counselling includes conversations between an individual and a minister of religion acting in his or her official capacity, and where the individual being counselled is seeking, or the minister is imparting forgiveness, absolution or the resolution of conscience with the authority of the divine being(s) of their faith.

5.28 Where the intention is to acquire confidential information, a statement to this effect must be contained in the application and the reasons should be clearly documented and the specific necessity and proportionality of doing so should be carefully considered. If the acquisition of confidential personal information is likely but not intended, any possible mitigation steps should be considered and, if none is available, consideration should be given to whether special handling arrangements are required within the relevant agencies.

5.29 Material which has been identified as confidential information should be retained only where it is necessary and proportionate to do so for one or more of the authorised purposes. It must be securely destroyed when its retention is no longer needed for those purposes. If such information is retained, there must be adequate information management systems in place to ensure that continued retention remains necessary and proportionate for the authorised statutory purposes.

5.30 Where confidential information is retained or disseminated to an outside body, reasonable steps should be taken to mark the information as confidential. Where there is any doubt as to the lawfulness of the proposed handling or dissemination of confidential information, advice should be sought from a legal adviser within the relevant agencies and before any further dissemination of the material takes place.

5.31 Any case where confidential information is retained should be notified to the IPC as soon as reasonably practicable, as agreed with the IPC. Any material which has been retained should be made available to the IPC on request.

Items subject to legal privilege

5.32 In Scotland, items subject to legal privilege means communications between a professional legal adviser and their client, or communications made in connection with, or in contemplation of, legal proceedings and for the purposes of those proceedings which would, by virtue of any rule of law relating to confidentiality of communications, be protected in legal proceedings from disclosure. Legal privilege does not apply to material held with the intention of furthering a criminal purpose. Communications are not covered by legal privilege if they are taking place in order to further a criminal purpose.. But privilege is not lost if a professional legal adviser is properly advising a person who is suspected of having committed a criminal offence. The concept of legal privilege applies to the provision of professional legal advice by any individual, agency or organisation qualified to do so.

5.33 For the purposes of this code, any communication between lawyer and client, or between a lawyer and another person for the purpose of actual or contemplated litigation (whether civil or criminal), must be presumed to be privileged unless the contrary is established: for example, where it is plain that the items do not form part of a professional consultation of the lawyer, or there is clear and compelling evidence that the 'furthering a criminal purpose' exemption applies. Where there is doubt as to whether the items are subject to legal privilege or over whether the items are not subject to legal privilege due to being "in furtherance of a criminal purpose", advice should be sought from a legal adviser within the relevant agency.

5.34 Section 112 of the Act provides special protections for legally privileged items. Acquiring such items is particularly sensitive and may give rise to issues under Article 6 (right to a fair trial) of the ECHR as well as engaging Article 8 (right to respect for private and family life). The acquisition of items subject to legal privilege (whether deliberately obtained or otherwise) is therefore subject to additional safeguards under this code as set out from paragraph 5.36. The guidance set out may in part depend on whether matters subject to legal privilege have been obtained intentionally or incidentally to other content which has been sought.

5.35 In a case where section 112 of the Act applies in relation to making a modification, the warrant must be approved by a Judicial Commissioner.

Legal privilege - Application process for targeted equipment interference warrants

5.36 Where the intention is not acquire items subject to legal privilege buta targeted equipment interference warrant is likely to result in a person acquiring items subject to legal privilege, the application should include, in addition to the reasons why it is considered necessary for the interference to take place, a statement that the applicant considers that the relevant material is likely to include items subject to legal privilege and assessment of how likely it is that items which are subject to legal privilege will be obtained or examined. Additionally, where an application is made for a targeted equipment interference warrant and the purpose or one of the purposes of the warrant is to obtain items subject to legal privilege, the application must contain a statement to this effect. In this case, the law enforcement chief will only issue the warrant if satisfied that there are exceptional and compelling circumstances that make the authorisation necessary and that appropriate arrangements are made in terms of safeguards for retention and disclosure of material obtained and for the use and destruction of such material.

5.37 Section 112(6) of the Act provides that there cannot be exceptional and compelling circumstances unless the public interest in obtaining the information outweighs the public interest in the confidentiality of items subject to legal privilege; there are no other means by which the information may be reasonably obtained; and the information is necessary for preventing death or serious injury.

5.38 The law enforcement chief will be able to impose additional conditions such as regular reporting arrangements, so as to be able to exercise his or her discretion on whether a warrant should continue to have effect.

5.39 Where there is a renewal application in respect of a warrant which has resulted in the obtaining of legally privileged items, that fact should be highlighted in the renewal application.

Lawyers' material

5.40 Where a lawyer, acting in a professional capacity, is the subject of a targeted equipment interference warrant, it is possible that a substantial proportion of the material which will be obtained will be subject to legal privilege. Therefore, in any case where the subject of a targeted equipment interference warrant is known to be a lawyer acting in a professional capacity where it is intended that a lawyer's material is to be obtained, the relevant agency must assume that section 112 of the Act applies.

5.41 The relevant agency will wish to consider which of the three circumstances which apply when items subject to legal privilege will or may be obtained is relevant, and what processes should therefore be followed. In other words, they will need to consider whether items subject to legal privilege are likely to be obtained; whether items subject to legal privilege are intentionally sought; or whether the purpose or one of the purposes is to obtain material that, if it was not created or held with the intention of furthering a criminal purpose, would be subject to privilege. This paragraph does not prevent an application being made on the grounds that the lawyer is under investigation for serious criminal offences, in which case the application or notification must be made on the basis that it is likely to acquire items subject to legal privilege and the additional considerations set out at paragraph 5.36 will apply.

5.42 Any such case should also be notified to the IPC during his or her next inspection and any material which has been retained should be made available to the IPC on request.

Handling, retention and deletion

5.43 As mentioned above, legally privileged material is particularly sensitive and any targeted equipment interference which obtains, provides access to or discloses such material may give rise to issues under Article 6 of the ECHR as well as engaging Article 8. This applies to handling, retention and deletion as well as to obtaining the information. Relevant agencies should ensure that knowledge of matters subject to legal privilege is kept separate from criminal prosecutions. Dissemination of information and the relevant considerations is discussed further from paragraph 5.51.

5.44 In addition to safeguards governing the handling and retention of material as provided for in section 129 of the Act, authorised persons who analyse material obtained by equipment interference should be alert to any communications or items which may be subject to legal privilege. Section 131 of the Act sets out the additional arrangements that apply to legally privileged items where the intention is to retain them for a purpose other than their destruction.

5.45 A legal adviser in the relevant agency must be consulted when it is believed that material which attracts privilege is obtained. The legal adviser is responsible for determining that material is privileged rather than an officer who is involved in an investigation. In cases where there is doubt as to whether material is privileged or not, the IPC may be informed who will be able to give a view. Where it is discovered that privileged material has been obtained inadvertently, an early assessment must be made of whether it is necessary and proportionate to retain it for one or more of the authorised purposes set out in section 129(3) of the Act. If not, the material should not be retained, other than for the purpose of its destruction.

5.46 A decision to retain such material should only be made where it is necessary and proportionate to do so for one or more of the authorised purposes set out in section 129(3) of the Act. Privileged items must be securely destroyed when their retention is no longer needed for those purposes. If such material is retained, there must be adequate information management systems in place to ensure that continued retention, for purposes other than their destruction, remains necessary and proportionate for the authorised statutory purposes.

5.47 Material which has been identified as legally privileged (and is being retained for purposes other than its destruction) should be clearly marked as subject to legal privilege and the IPC must be notified of the retention of the items as soon as reasonably practicable. Paragraphs 5.48-5.50 provide more detail on reporting privileged items to the IPC.

Reporting to the IPC

5.48 In those cases where items identified by a legal adviser in the relevant agency as being legally privileged have been acquired, the matter should be reported to the IPC as soon as reasonably practicable.

5.49 Section 131 of the Act provides that the IPC must order the destruction of the items or impose conditions on their use or retention unless the public interest in retaining the item outweighs the public interest in the confidentiality of items subject to legal privilege, and retaining the item is necessary in the interests of national security or for the purpose of preventing death or significant injury. Even if retention is necessary and the public interest in its retention outweighs the public interest in the confidentiality of items subject to legal privilege, the IPC may still impose conditions as he or she considers necessary to protect the public interest in the confidentiality of items subject to privilege. It may be the case in some circumstances that privileged items can be retained when its retention does not outweigh the public interest in the confidentiality of items subject to privilege. This includes, for example, where it is not possible to separate privileged items from those that are not privileged and of intelligence value and where the retention is necessary and proportionate for one or more of the authorised purposes set out in section 129(3) of the Act. In these circumstances, the person to whom the warrant is addressed must inform the IPC as soon as is reasonably practicable and the IPC must direct that the item is destroyed or impose one or more conditions on the use or retention of the item.

5.50 The IPC will make an assessment of whether the public interest in retaining the item outweighs the public interest in the confidentiality of items subject to legal privilege, and of whether retaining the item is necessary for the purpose of preventing death or significant injury. If this condition is met, the IPC may impose conditions as to the use or retention of the items, but the IPC is not obliged to do so. If those conditions are not met, the IPC must direct that the item is destroyed, or must impose one or more conditions as to the use or retention of the items. Circumstances in which it may be appropriate to impose conditions on the use or retention of the item, but not to order destruction of the item, include where it is not possible to separate privileged items from those that are not privileged and of intelligence value, and where the retention is necessary and proportionate for one or more of the authorised purposes set out in section 129(3) of the Act. The IPC must have regard to any representations made by the relevant agency about the proposed retention of privileged items or conditions that may be imposed.

Dissemination

5.51 In the course of an investigation, a relevant agency will not act on or further disseminate legally privileged items unless it has first informed the IPC that the items have been obtained, except in urgent circumstances. Where there is an urgent need to take action and it is not reasonably practicable to inform the IPC that the material has been obtained before taking action, the relevant agency may take action before informing the IPC. In such cases, the relevant agency should, wherever possible consult a legal adviser. A relevant agency must not disseminate privileged items if doing so would be contrary to a condition imposed by the IPC in relation to those items.

5.52 The dissemination of legally privileged material to an outside body should be accompanied by a clear warning that it is subject to legal privilege, where doing so would not breach the duty not to disclose the existence or contents of a warrant in section 132 of the Act. It should be safeguarded by taking reasonable steps to remove the risk of it becoming available, or its contents becoming known, to any person whose possession of it might prejudice any criminal or civil proceedings to which the information relates, including law enforcement authorities. In this regard civil proceedings include all legal proceedings before courts and tribunals that are not criminal in nature. Neither the Crown Office and Procurator Fiscal Service lawyer nor any other prosecuting authority lawyer with conduct of a prosecution should have sight of any legally privileged material, held by the relevant agency, with any possible connection to the proceedings. In respect of civil proceedings, there can be no circumstances under which it is proper for any public authority to have sight of or seek to rely on legally privileged material in order to gain a litigation advantage over another party in legal proceedings.

5.53 In order to safeguard against any risk of prejudice or accusation of abuse of process, the relevant agencies must take all reasonable steps to ensure that lawyers or other officials with conduct of legal proceedings should not see legally privileged material relating to those proceedings (whether the privilege is that of the other party to those proceedings or that of a third party). If such circumstances do arise, the relevant agency must seek independent advice from Counsel and, if there is assessed to be a risk that sight of such material could yield a litigation advantage, the direction of the Court must be sought.

Applications to acquire material relating to confidential journalistic material and journalists' sources

5.54 There is a strong public interest in protecting a free press and freedom of expression in a democratic society, including the willingness of sources to provide information to journalists anonymously.

5.55 Section 264 of the Act defines confidential journalistic material as:

• in the case of material contained in a communication, journalistic material which the sender of the communication-
• holds in confidence, or
• intends the recipient, or intended recipient, of the communication to hold in confidence;
• in any other case, journalistic material which a person holds in confidence.

5.56 Confidential journalistic material includes material acquired or created for the purposes of journalism and held subject to an undertaking to hold it in confidence, as well as communications resulting in information being acquired for the purposes of journalism and held subject to such an undertaking.

5.57 Section 264(7) of the Act sets out when a person holds material in confidence. This is if a person holds material subject to an express or implied undertaking to hold it in confidence or the person holds the material subject to a restriction on disclosure or an obligation of secrecy contained in an enactment. Confidentiality can continue to attach to confidential journalistic material when it is sent to or held by a person who is neither the journalist nor the source (for example, a news editor who has been sent some notes by a journalist).

5.58 Section 113 of the Act sets out the safeguards which apply when a relevant agency applies for a warrant under Part 5 of the Act where the purpose, or one of the purposes, of the warrant is to authorise the acquisition of material that the authority believes will be confidential journalistic material. The warrant application must contain a statement that the purpose is to authorise or require the acquisition of material which the relevant agency believes will contain confidential journalistic material. The person to whom the application is made may issue the warrant only if they consider that appropriate safeguards relating to the handling, retention, use and disclosure of the material are in place.

5.59 A source of journalistic information is an individual who provides material intending the recipient to use it for the purpose of journalism or knowing that it is likely to be so used. Throughout this code any reference to sources should be understood to include any person acting as an intermediary between a journalist and a source.

5.60 Section 114 of the Act sets out the safeguards which apply when a relevant agency applies for a warrant under Part 5 of the Act where the purpose, or one of the purposes is to identify or confirm a source of journalistic information. The application must contain a statement confirming that this is the purpose (or one of the purposes) for the application. The person to whom the application is made may issue the warrant only if they consider that appropriate safeguards relating to the handling, retention, use and disclosure of the material are in place.

5.61 An assessment of whether someone is a journalist (for the purposes of the Act) should be made on all the facts and circumstances available at the time. Consideration should be given, in particular, to the frequency of the individual's relevant activities, the level of personal rigour they seek to apply to their work, the type of information that they collect, the means by which they disseminate that information and whether they receive remuneration for their work. This approach will take into account the purpose of the provisions contained within the Act which is to protect the proper exercise of free speech, and reflect the role that journalists play in protecting the public interest.

5.62 The acquisition of material under part 5 of the Act will be a justifiable interference with an individual's human rights under Articles 8 (right to respect for private and family life) and, in certain circumstances, 10 (freedom of expression) of the ECHR only if the conduct being authorised is necessary, proportionate and in accordance with law.

5.63 Where material is created or acquired with the intention of furthering a criminal purpose, section 264(5) of the Act states that the material is not to be regarded as having been created or acquired for the purpose of journalism. Once material has been broadcast, no confidentiality can attach to the material so it is not confidential journalistic material; the materials used to develop the broadcast, including all materials that were not broadcast, remains confidential and as such remain subject to the protections outlined in the Act. The fact that a person uses social media tools to communicate does not, in itself, indicate that that person is a journalist or that he or she is likely to be holding confidential journalistic material as defined in the Act.

5.64 Where confidential journalistic material, or that which identifies the source of journalistic information, is retained and disseminated to an outside body, reasonable steps should be taken to mark the disseminated information as confidential. Where there is any doubt as to the lawfulness of the proposed handling or dissemination of such information, advice should be sought from a legal adviser within the relevant agency and before any further dissemination of the content takes place.

Reporting to the Commissioner

5.65 Where confidential journalistic material, or that which identifies a source of journalistic information, has been obtained and retained, other than for the purposes of destruction - the matter should be reported to the IPC as soon as reasonably practicable.