Regulation of Investigatory Powers (Scotland) Act 2000 - Update
North Lanarkshire Council · 8 June 2023
Back to Policy and Strategy Committee — 8 June 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Regulation of Investigatory Powers (Scotland) Act 2000 - Update North Lanarkshire Council Report Does this report require to be approved? ☒ Yes ☐ No Ref AA/ER/PC Date 08/06/23 From Archie Aitken, Chief Officer (Legal and Democratic) E-mail rossev@northlan.gov.uk Telephone 07903 354852 Executive Summary This report is seeking approval of the Council’s Policy and Procedure on Directed Surveillance, Use of Covert Human Intelligence Sources and Obtaining Communications Data (“the Policy”) which has been updated to ensure continued compliance with the Council’s obligations under the Regulation of Investigatory Powers (Scotland) Act 2000 (“RIPSA”) and associated statutory guidance. It also informs Committee of the extent of the use by the Council of powers under this legislation during the last five years, as well as summarising actions taken by the Chief Officer (Legal and Democratic) to ensure continued compliance and increased awareness across Services. Recommendations It is recommended that the Policy and Strategy Committee: (1) Approve the updated Policy and Procedure on Directed Surveillance, Use of Covert Human Intelligence Sources and Obtaining Communications Data as required by paragraph 4.43 of the Scottish Government’s Covert surveillance and property interference: Code of Practice and paragraph 3.27 of the Scottish Government’s Covert human intelligence sources: Code of Practice. (2) Review the Council’s use of its powers under RIPSA as required by paragraph 4.43 of the Scottish Government’s Covert surveillance and property interference: Code of Practice and paragraph 3.27 of the Scottish Government’s Covert human intelligence sources: Code of Practice. The Plan for North Lanarkshire Priority Improve North Lanarkshire's resource base Ambition statement (25) Ensure intelligent use of data and information to support fully evidence based decision making and future planning Policy and Strategy Committee
Page 2
1. Background
1.1 The Council is required to have policies and procedures in place to manage covert
surveillance activities carried out under the Regulation of Investigatory Powers
(Scotland) Act 2000 ("RIPSA").
1.2 The Scottish Government's “Covert surveillance and property interference: Code of
Practice” and “Covert human intelligence sources: Code of Practice” (“the Codes of
Practice”) require that Elected Members should review the Council's use of RIPSA and
set the policy annually.
2. Report
2.1 The Council's policy and procedure on Directed Surveillance, Use of Covert Human
Intelligence Sources and Obtaining Communications Data (“the Policy”) sets out how
the Council complies with its obligations when conducting surveillance under RIPSA.
Surveillance of individuals in a covert manner is potentially intrusive and could interfere
with a person's right to respect for private and family life provided by Article 8 of the
European Convention on Human Rights. Compliance with the legal framework set out
in RIPSA and the Policy ensures that any covert surveillance undertaken by the Council
does not unlawfully interfere with an individual's right to privacy i.e. it is in accordance
with law, it is necessary to pursue a legitimate aim and is proportionate.
2.2 The Council's use of its powers under RIPSA is overseen by the Investigatory Powers
Commissioner's Office (“IPCO”), with inspections carried out approximately every three
years. The Council was last inspected in June 2020, the outcome of which was
reported to this Committee in October 2020. No formal recommendations were made
by IPCO, however, some observations were made relating to how the Council could
raise awareness of its responsibilities under RIPSA and ensure continued compliance
with the legal framework and the Codes of Practice.
2.3 The Chief Officer (Legal and Democratic) is the Council’s Senior Responsible Officer
for RIPSA with responsibility for: -
• ensuring proper processes are in place for the authorisations of directed
surveillance and CHIS activities;
• compliance with the legislation and codes of practice;
• engagement with IPCO and inspectors during inspections;
• ensuring authorising officers are of an appropriate standard in light of
any recommendations made by IPCO.
2.4 A summary of the action taken by the SRO in relation to these observations is
provided below:
Online Investigations
In the IPCO Inspection Report from 2020, IPCO made specific reference to the potential
use of social media accounts by services. It was made clear that monitoring or
surveillance of such accounts, irrespective of privacy settings, can potentially constitute
directed surveillance as defined by RIPSA. In order to assess the extent of any such
potential surveillance, an audit of Services' use of the internet to gather information on
individuals was carried out. This revealed that use of the internet as an investigativePage 3
technique is carried out in several service areas, however, it is not extensive. That being the case, more detailed guidance for services explaining considerations which should be taken into account prior to commencing any online investigations will be issued to staff. This should ensure any such activity is necessary, proportionate and compliant with RIPSA and the Policy. Authorising Officers There are currently 10 Officers named as Authorising Officers under the Policy. These are: - Head of Regulatory Services and Waste Solutions, Business Manager (Environmental Health), Business Manager (Trading Standards), Head of Housing Solutions, Head of Planning and Regeneration, Business Manager, Development Solutions, Head of Children, Families and Justice Social Work Services, Head of Adult Social Work Services, Head of Audit and Inspection, Head of Revenue and E-Government Solutions. It has been recognised that the volume of directed surveillance operations carried out by the Council is very low. It is, therefore, proposed that the number of Authorising Officers is reduced to seven. This is in line with previous observations and recommendations made by IPCO. Accordingly, it is recommended that Authorising Officers are now named as the following: Chief Officer (Legal and Democratic) Chief Officer (Audit and Risk) Chief Officer (Community Operations) Chief Officer (Adult Social Work Services) Business Manager (Protective Services) Planning and Place Manager (Enterprise & Communities) Senior Education & Families Manager (Social Work) (Justice) This reduced number will allow for a more operationally competent pool of Authorising Officers, with each officer having a correspondingly higher rate of exposure to RIPSA authorisations. Refresher training for these officers and those involved in directed surveillance activities will be arranged during 2023. Policy An updated Policy is contained in Appendix 1. The two main changes that have been made to the Policy since it was previously reported to this Committee in October 2020 relate to (1) the designation of Authorised Officers referred to above and which are contained within Appendix 1 of the Policy and (2) an Appendix 2 which sets out the new arrangements for the central recording of all authorisations, reviews, cancellations and refusals on a designated Microsoft Teams channel. The other changes are minor consequential references to officers names given the recent changes to Chief Officer titles. No changes to the legislation or the Codes of Practice have been made since the last policy review. It is recommended that Committee approve the updated Policy contained in Appendix 1.
Page 4
Use of RIPSA Powers 2.5 The Council’s use of its powers under RIPSA is very low, as has been the case for a number of years. Below is a table showing the number of directed surveillance authorisations that have been granted to date this calendar year, and the total authorisations granted for the previous five years. Year No. of directed surveillance authorisations 2018 8 2019 7 2020 1 2021 2 2022 4 2023 (to date) 2 2.6 These authorisations relate to surveillance activity carried out by the Trading Standards team within Protective Services to tackle the sale of counterfeit goods and the sale of age restricted items to underage buyers, such as tobacco and vaping products. 2.7 The Council has not used its powers to deploy Covert Human Intelligence Sources (CHIS) since 2016. 3. Measures of success 3.1 IPCO continuing to find that there are suitably strong governance processes in place within the Council to ensure compliance with the legislation and codes of practice. 4. Supporting documentation 4.1 Updated Policy and Procedure on Directed Surveillance, Use of Covert Human Intelligence Sources and Obtaining Communications Data Archie Aitken Chief Officer (Legal and Democratic)
Page 5
5. Impacts ( http://connect/report-template-guidance ) 5.1 Public Sector Equality Duty and Fairer Scotland Duty Does the report contain information that has an impact as a result of the Public Sector Equality Duty and/or Fairer Scotland Duty? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? If Yes, has an assessment been carried out and published on the council’s website? https://www.northlanarkshire.gov.uk/your-community/equalities/equality- and-fairer-scotland-duty-impact-assessments Yes ☐ No ☐ 5.2 Financial impact Does the report contain any financial impacts? Yes ☐ No ☒ If Yes, have all relevant financial impacts have been discussed and agreed with Finance? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.3 HR policy impact Does the report contain any HR policy or procedure impacts? Yes ☐ No ☒ If Yes, have all relevant HR impacts have been discussed and agreed with People Resources? Yes ☐ No ☐ If Yes, please provide a brief summary of the impact? 5.4 Legal impact Does the report contain any legal impacts (such as general legal matters, statutory considerations (including employment law considerations), or new legislation)? Yes ☒ No ☐ If Yes, have all relevant legal impacts have been discussed and agreed with Legal and Democratic? Yes ☒ No ☐ If Yes, please provide a brief summary of the impact? This report forms part of the duties of the Senior Responsible Officer to ensure compliance with the requirements of RIPSA and statutory codes of practice. 5.5 Data protection impact Does the report / project / practice contain or involve the processing of personal data? Yes ☐ No ☒ If Yes, is the processing of this personal data likely to result in a high risk to the data subject? Yes ☐ No ☐ If Yes, has a Data Protection Impact Assessment (DPIA) been carried out and e- mailed to dataprotection@northlan.gov.uk Yes ☐ No ☐
Page 6
5.6 Technology / Digital impact Does the report contain information that has an impact on either technology, digital transformation, service redesign / business change processes, data management, or connectivity / broadband / Wi-Fi? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? Where the impact identifies a requirement for significant technology change, has an assessment been carried out (or is scheduled to be carried out) by the Enterprise Architecture Governance Group (EAGG)? Yes ☐ No ☐ 5.7 Environmental / Carbon impact Does the report / project / practice contain information that has an impact on any environmental or carbon matters? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.8 Communications impact Does the report contain any information that has an impact on the council’s communications activities? Yes ☐ No ☒ If Yes, please provide a brief summary of the impact? 5.9 Risk impact Is there a risk impact? Yes ☒ No ☐ If Yes, please provide a brief summary of the key risks and potential impacts, highlighting where the risk(s) are assessed and recorded (e.g. Corporate or Service or Project Risk Registers), and how they are managed? This report contains information about steps identified to ensure the Council remains compliant with the requirements of RIPSA. This will help to reduce the likelihood of human rights challenges in relation to individuals’ Article 8 privacy rights, any associated impact on the Council’s reputation, potential financial loss resulting from such claims. Continued compliance will also serve to reduce the likelihood of any evidence recovered through covert surveillance activities undertaken by the Council being deemed inadmissible in any subsequent criminal proceedings. 5.10 Armed Forces Covenant Duty Does the report require to take due regard of the Armed Forces Covenant Duty (i.e. does it relate to healthcare, housing, or education services for in-Service or ex- Service personnel, or their families, or widow(er)s)? Yes ☐ No ☒ If Yes, please provide a brief summary of the provision which has been made to ensure there has been appropriate consideration of the particular needs of the Armed Forces community to make sure that they do not face disadvantage compared to other citizens in the provision of public services.
Page 7
Appendix NORTH LANARKSHIRE COUNCIL POLICY AND PROCEDURE on DIRECTED SURVEILLANCE, USE OF COVERT HUMAN INTELLIGENCE SOURCES AND OBTAINING COMMUNICATIONS DATA
Page 8
NORTH LANARKSHIRE COUNCIL POLICY AND GUIDELINES ON SURVEILLANCE (1) INTRODUCTION In some circumstances it may be necessary for Council employees, in the course of their duties, to make observations of a person(s) in a covert manner, i.e. without that person’s knowledge, or to instruct third parties to do so on the Council’s behalf. Actions of this sort are potentially intrusive. The Human Rights Act 1998 obliges all public authorities to act in a manner compatible with the rights contained in the European Convention of Human Rights (“the Convention”). Article 8 of the Convention affords everyone the right to respect for private and family life including home and correspondence. Surveillance activities by public authorities may therefore result in a legal challenge in terms of Article 8. Article 8 of the Convention is not however an absolute right. Interference with this right of privacy may be justified if this is: • in accordance with law; • necessary to pursue a legitimate aim, for example, the public interest; and • the interference is proportionate to the legitimate aim, i.e. the interference with the right is not greater than is necessary to achieve the aim. The Regulation of Investigatory Powers (Scotland) Act 2000 (“RIPSA”) provides, for the first time, a legal framework for covert surveillance by public authorities and an independent inspection regime to monitor these activities. If RIPSA is properly complied with, any interference with the right to privacy will be in accordance with law. In order to put forward a robust defence to any claim by an individual of wrongful interference with their right to privacy under Article 8 of the European Convention on Human Rights, any surveillance type activities undertaken by a local authority must be both necessary and proportionate. (2) OBJECTIVES The objective of this policy is to ensure that all covert surveillance by Council employees is carried out appropriately and on a lawful basis. This policy should be read in conjunction with the Scottish Government’s Covert Surveillance and Property Interference Code of Practice 2017 which is covered in Part One of this Policy and Covert Human Intelligence Sources Code of Practice 2017 which is covered in Part Two. If the procedures outlined in this policy are not followed, any evidence acquired as a result of surveillance activities may be susceptible to a human rights challenge. It may therefore not be admissible in Court, and the Procurator Fiscal is unlikely to take proceedings on the basis of such evidence. The Council may also be exposed to legal action by individuals who claim that their human rights to privacy and respect for family will have been abused. (3) SCOPE OF THE POLICY The policy only applies where surveillance is covert i.e. where the individual or individuals are not aware at the time of surveillance that surveillance is being carried out. It does not apply to observations or surveillance which are not carried out covertly, e.g., use of overt CCTV cameras or unplanned observations made as an immediate response to events. The Information Commissioner has issued separate guidance of the use of CCTV surveillance.
Page 9
(4) REVIEW OF POLICY This policy shall be reviewed and set annually by elected members. PART 1 - DIRECTED SURVEILLANCE 1.1 DEFINITION OF DIRECTED SURVEILLANCE The Regulation of Investigatory Powers (Scotland) Act 2000 defines directed surveillance as surveillance which is covert but not intrusive and is undertaken - (a) for the purposes of a specific investigation or a specific operation; (b) in such a manner as is likely to result in the obtaining of private information about a person (whether or not one specifically identified for the purposes of the investigation or operation); and (c) otherwise than by way of an immediate response to events or circumstances the nature of which is such that it would not be reasonably practicable for an authorisation under this Act to be sought for the carrying out of the surveillance. The terms of this Policy apply in all cases where “directed surveillance” is being planned or carried out by Council Officers. 1.2 EXPLANATION OF INTRUSIVE SURVEILLANCE The Regulation of Investigatory Powers (Scotland) Act 2000 does not permit the authorisation by Council officers of intrusive surveillance. Surveillance is intrusive where it is covert and - (a) is carried out in relation to anything taking place on any residential premises or in any private vehicle; and (b) involves the presence of an individual on the premises or in the vehicle or as carried out by means of a surveillance device. Some additional points should be made about intrusive surveillance. Residential premises are not thought to include common areas such as common stairs and closes. Surveillance is not intrusive if directed into a home or private vehicle from outside unless the information is consistently of the same quality as would be produced by a device actually sited in the home or vehicle in question. Advice from the Office of Surveillance Commissioners suggests that the sort of surveillance undertaken by the Council is unlikely to reach this level of sophistication, however, this will clearly be subject to review in the future. Thus, activities such as filming goods being sold from the back of a car or monitoring the level of noise (but not the actual words) generated by an anti social person are unlikely to be classified as intrusive, and so, those activities can be safely carried out subject to appropriate authorisation. Furthermore, devices carried into a home or a private vehicle by a covert human intelligence source (see Part 2 of this Policy) do not constitute intrusive surveillance as long as the CHIS has been invited in. However, the device must not be left behind when CHIS leaves the premises or vehicle. 1.3 PRINCIPLES OF DIRECTED SURVEILLANCE In planning and carrying out directed surveillance, Council employees must comply with the following principles:
Page 10
• lawful purposes - directed surveillance shall only be carried out where necessary to achieve one or more of the permitted purposes (as defined in RIPSA) i.e., it must be:- (a) for the purpose of preventing or detecting crime or the prevention of disorder; (b) in the interest of public safety; or (c) for the purpose of protecting public health. Employees carrying out surveillance should not cause damage to any property or harass any person. • necessity - directed surveillance should only be undertaken where there is no reasonable and effective alternative way of achieving the required objective. • effectiveness - planned directed surveillance should be undertaken only by, or under the supervision of, suitably trained or experienced employees. • proportionality - the use and extent of directed surveillance should not be excessive, i.e. it shall be in proportion to the significance of the matter being investigated. • intrusive surveillance - no surveillance should be undertaken which comes within the definition of “intrusive surveillance”. • collateral intrusion - specific consideration should be given at both the application and authorisation stages, to the extent of any risk of intrusion into the privacy of persons other than those who are directly the subjects of the investigation or operation. Measures should be taken, wherever practicable, to avoid or minimise unnecessary intrusion into the lives of those not directly connected with the investigation or operation. • authorisation - all directed surveillance must be authorised in accordance with the procedures described below. • confidentiality - all directed surveillance should be undertaken in such a way as to minimise, wherever possible, the acquisition of confidential material. 1.4 MAKING AN APPLICATION FOR DIRECTED SURVEILLANCE Any officer whose duties involve directed surveillance who wishes to carry out directed surveillance must make an application seeking authorisation to do so. Services may require in the course of their operation or of directed surveillance duties from time to time, to make and consider applications for authorisations. (a) When is Directed Surveillance Appropriate? By its very nature, directed surveillance intrudes on people’s privacy. It should therefore be regarded as a final option, only to be considered when all other methods have either been tried and failed, or where the nature of the activity to which the surveillance relates is such that it can be reasonably concluded that no alternative action will yield the information sought. For example, if a vending machine is regularly being broken into, consideration should be given to installing overt CCTV cameras with appropriate signage before installing hidden cameras. Any use of covert surveillance must be proportionate to the objective being pursued.
Page 11
(b) Directed Surveillance Authorisation levels are prescribed by the Regulation of Investigatory Powers (Prescription of Officers, etc. and Specification of Public Authorities) (Scotland) Order, SS1 2010/350. In relation to local authorities, the Regulations refer to Assistant Head of Service and Investigation Manager, titles which are little used within local authorities. The Council’s equivalent to an “assistant Head of Service” is a third tier Council officer, for example, a Legal Manager within Legal and Democratic Solutions. Third tier officers are graded usually between NLC15 and NLC16 depending upon the Service in which they work. It is felt that the most likely local authority equivalent to an “Investigation Manager” would be the Council’s Trading Standards Manager or an equivalent post within another Council Service. Such a post would be likely to be graded at NLC15. If in any doubt about the level of seniority of a proposed authorising officer in any particular case specific advice should be sought from the Head of Legal and Democratic Solutions. Applications must be made in writing using the approved forms, copies of which are available on Connect. In urgent cases, however, an oral application may be approved by an Authorising Officer. Where an urgent application is made this should be supplemented by a normal written application as soon as practicable and in any event within 72 hours failing which the oral authorisation will expire. Before the application can be granted, the authorising officer must be satisfied that the surveillance is necessary, that the action is proportionate with what it seeks to achieve and that the aim could not have reasonably been achieved by any other means. The Authorising Officer should note the time and date of the grant/refusal of the application on the relevant form. A Schedule of the Council’s designated Authorising Officers is included at Appendix 1. Authorising officers should not normally be responsible for authorising operations in which they are directly involved. Where an authorising officer authorises such an investigation or operation this should be recorded in the Central Record of Surveillance Activities. 1.5 GRANTING AND RECORDING AUTHORISATIONS AND REFUSALS The Authorising Officer’s job is to be satisfied that the directed surveillance is necessary and that applicant has correctly identified the lawful purpose for the proposed surveillance, has planned the operation properly so as to minimise collateral intrusion (invasion of privacy of individuals who are not the subject(s) of the surveillance being carried out) and the collection of confidential information, is not proposing to stray beyond permissible bounds of directives and has correctly applied the proportionality test. The authorisation should be granted only if the Authorising Officer is satisfied that these issues have been properly considered, that surveillance is justified and that the application conforms with the Statutory Code of Practice. Any restrictions imposed on the authorisation should be noted as authorising officer comments. 1.6 RECEIPT AND LOGGING OF APPLICATIONS All Services carrying out surveillance activities must forward all relevant documentation to the Chief Officer (Legal and Democratic) so that the Central Register of Surveillance Activities carried out by the Council can be maintained. This confidential register will be open
Page 12
to inspection by the Investigatory Powers Commissioner’s Office and provides evidence of
the Council’s compliance with the law and the Scottish Government’s Codes of Practice. The
arrangements for updating the Central Register are set out in Appendix 2 of this Policy.
1.7 DURATION, RENEWAL AND CANCELLATION OF AUTHORISATIONS
An authorisation for directed surveillance is valid for a period of three months or in the case
of urgent oral applications 72 hours. However, if the reasons justifying carrying out the
surveillance cease to apply prior to the expiry of a three month period or a 72 hour period
whichever is applicable, then the authorisation should be cancelled and the cancellation form
forwarded to the Chief Officer (Legal and Democratic) for filing in the Central Register.
On approving the authorisation, a planned review date shall be fixed to monitor the
effectiveness of the surveillance and its continuing necessity and proportionality.
If surveillance is to be continued for longer than the original period authorised, it is necessary
to have a renewal authorised. The tests applicable to renewals are identical to those for initial
applications (Forms for cancellation and renewal of surveillance are available).
1.8 NECESSITY AND PROPORTIONALITY
Obtaining an authorisation under RIPSA will only ensure that there is a justifiable interference
with an individual’s Article 8 rights if it is necessary and proportionate for these activities to
take place. RIPSA first requires that the person granting an authorisation is satisfied that the
authorisation is necessary in the circumstances of the particular case for one or more of the
statutory grounds in Section 6.3 of RIPSA for directed surveillance. Section 6.3 provides that
an authorisation is necessary on the following grounds:-
(a) for the purpose of preventing or detecting crime or preventing disorder;
(b) in the interest of public safety; or
(c) for the purpose of protecting public health.
Then, if the activities are necessary, the person granting the authorisation must be satisfied
that they are proportionate to what is sought to be achieved by carrying them out. This
involves balancing the intrusiveness of the activity on the target and others who might be
affected by it against the need for the activity in operational terms. The activity will not be
proportionate if it is excessive in the circumstances of the case or if the information which is
sought could reasonably be obtained by other less intrusive means. All such activities should
be carefully managed to meet the objective in question and must not be arbitrary or unfair.
1.9 CONFIDENTIAL MATERIAL AND COLLATERAL INTRUSION
Confidential material covers a number of areas: professional legal advice, health information,
spiritual counselling and material held under an obligation of confidentiality. So far as
possible, surveillance operations should be designed so as to minimise or eliminate the
possibility of confidential information being acquired. If confidential information is in fact
acquired, special care should be taken to avoid unnecessary disclosure.
Before authorising surveillance the Authorising Officer should also take into account the risk
of intrusion into the privacy of persons other than those who are directly the subjects of the
investigation or operation ("collateral intrusion"). Operations should be planned so as to
minimise or eliminate as far as possible the risk of collateral intrusion, and the extent to which
it remains is a factor to consider when determining the proportionality of the operation. Where
recovery of such material is anticipated and unavoidable, it is a requirement that
authorisation for surveillance must be sought from the Chief Executive or, in his absence,
the Chief Officer (Legal and Democratic).Page 13
1.10 SURVEILLANCE BY OTHER PUBLIC AUTHORITIES AND COMBINED AUTHORISATIONS Council officers are occasionally asked to assist in surveillance operations being conducted by other public authorities such as the police, the Department for Work and Pensions, other local authorities, HMRC etc. In cases where the Council is acting on behalf of another agency, it is normally for the tasking agency to obtain or provide authorisation. In such cases it is for the tasking agency (who are seeking assistance from the Council) to ensure that it has appropriate authorisations in place. Written confirmation should be obtained from the tasking agency and exhibited to the Council’s appropriate authorising officer confirming that such authorisations have been duly granted. 1.11 USE OF SOUND RECORDING EQUIPMENT Where it is considered necessary for an investigating officer to record levels of noise as part of directed surveillance activity this may involve the use of noise recording equipment. When using such technical equipment investigating officers must ensure that the equipment is activated in such a way as to record only the level of the noise in question and not the actual content of any conversation between the subject of directed surveillance and any other party. 1.12 USE OF THE INTERNET Use of the internet for investigative or research purposes can constitute surveillance and may require an authorisation if such use falls within the definition of directed surveillance at para 1.1. above. If an officer is going to engage with others online without disclosing their identity as an officer of the Council, acting in that capacity, then a CHIS authorisation may be needed (see Part 2 of this policy). Such online surveillance will be considered covert if the individuals are unlikely to know that the surveillance is or may be taking place. Using the internet to carry out surveillance could be considered covert just by its very nature, in that individuals will not know it is being carried out, unless they have been informed that it will, or may be carried out by the Council in certain circumstances. If they have been informed, or reasonable steps have been taken to inform them, then it is unlikely that an authorisation is required. Individuals may have an expectation of privacy in regards to their information on the internet, even in publicly accessible areas – particularly social media sites where it is likely their information will constitute private information. This is regardless of any privacy settings which may have been used by the individual. However, where an individual’s information is accessible via a publicly available database e.g. Companies House, it is unlikely they would have any reasonable expectation of privacy in regards to that information. Similarly, if an individual uses social media or a website as a platform to deliberately communicate to a wide audience, they are less likely to have a reasonable expectation of privacy compared to someone who uses a social media site where they only communicate with a smaller group of individuals personally known to them. The nature of the surveillance activity is also relevant in considering if an authorisation is required. Looking at a website to identify if it is of interest is unlikely to interfere with an individual’s reasonable expectation of privacy, however, if information is being routinely collected and stored about an individual or group of individuals then an authorisation should be considered. The following is an example from the Covert Surveillance and Property Interference Code of Practice 2017 which demonstrates the above considerations: A simple internet search on a name, address or telephone number to find out whether a subject of interest has an online presence is unlikely to need an authorisation. If, however,
Page 14
having found an individual’s social media profile or identity it is decided to monitor it or extract information from it for retention in a record because it is relevant to an investigation or operation, authorisation should then be considered. Visiting a website would not normally amount to surveillance, but if during that visit it is intended to extract and record information to establish a profile including information such as identity, pattern of life, habits, intentions or associations, it may be advisable to have in place an authorisation even for that single visit. Factors that should be considered in establishing whether a directed surveillance authorisation is required include whether:- - the investigation or research is directed towards an individual or group of people; - it is likely to result in obtaining private information about a person or group of people (taking account of the guidance at paragraph 3.14 of the Code of Practice); - it is likely to involve visiting internet sites to build up an intelligence picture or profile; - the information obtained will be recorded and stored; - the information is likely to provide an observer with a pattern of lifestyle; - the information is being combined with other sources of information or intelligence, which amounts to information relating to a person’s private life; - the investigation or research is part of an ongoing piece of work involving repeated viewing of the subject(s); - it is likely to involve identifying and recording information about third parties such as friends and family members of the subject of interest, or information posted by third parties such as friends or family members, which may include private information and therefore constitute collateral intrusion. If there is any dubiety over whether an authorisation is required in respect of the intended use of the Internet for investigative purposes, advice should be sought from an Authorising Officer or Legal Solutions prior to the investigation commencing. 1.13 SAFEGUARDS Information obtained under a directed surveillance authorisation must be handled in accordance with the safeguards set out below and elsewhere in this policy and the Code of Practice. Dissemination, copying and retention of information must only be carried out where necessary for the authorised purposes. The authorised purposes are that the material:- - is, or is likely to become, necessary for any of the statutory purposes set out in RIPSA; - is necessary for facilitating the carrying out of the functions of public authorities under RIPSA; - is necessary for the facilitating the carrying out of any functions of the IPC or IPT; - in necessary for legal proceedings; - is necessary for the performance of any person by or under any enactment.
Page 15
The information should only be copied and/or disclosed to the minimum people necessary (including internally within the Council) and to the minimum extent necessary for the authorised purposes i.e. if a summary or extract of the information can be disclosed instead of the entirety of the information, then this should be all that is disclosed. Similarly, information should only be copied to the minimum extent necessary for the authorised purposes. When material is to be used, or may need to be used, as evidence in criminal proceedings, consideration should be given to evidential integrity, the rules of evidence and disclosure, and it should be borne in mind that the Council will need to show how the material was obtained. Authorisations should be reviewed regularly to assess necessity and proportionality – this is particularly important where the directed surveillance is likely to involve a high level of intrusion into a person’s private life, a high degree of collateral intrusion or where sensitive information is likely to be obtained. The Council’s Data Protection policy must be complied with in respect of any personal data or special category data obtained as part of the investigation. The information should be stored securely to minimise the risk of loss and theft and should only be accessible to those authorised to access it. Information should be destroyed securely and in accordance with the Council’s Retention Schedule. The Investigatory Powers Commissioner’s Office has statutory powers of inspection and all records (applications, authorisations, cancellations and refusals) must be available for inspection. No records should be destroyed until an inspector has had the opportunity to see them. The Chief Officer (Legal and Democratic) shall ensure that the Central Register is kept secure and shall make proper arrangements for the retention and destruction of documentation in accordance with the requirements of the UK GDPR, the Data Protection Act 2018 and the Code of Practice. It should be noted that refusals as well as approved applications must be retained. The Code of Practice recommends retention of authorisations for five years or longer, if required for ongoing proceedings. Consult the Code of Practice and Legal Solutions if the information likely to be obtained is likely to be subject to legal privilege. 1.14 TRAINING Each Service is responsible for ensuring that their staff receive adequate training to deal with the authorisation process and any enquiries, guidance to relevant employees and legal advice will be available as required from the Chief Officer (Legal and Democratic). 1.15 COMPLAINTS In the event of any member of the public being unhappy or dissatisfied with the conduct of any covert surveillance, in addition to the Council’s complaints procedure, they have the right to complain to the Investigatory Powers Tribunal. Details of the complaints procedure are available for public reference from Legal and Democratic Solutions. Copies of the Complaints Procedure will be made available to the public by post or e-mail if requested.
Page 16
PART 2 - COVERT HUMAN INTELLIGENCE SOURCES (CHIS) 2.1 DEFINITION OF COVERT HUMAN INTELLIGENCE SOURCE RIP(S)A 2000 defines a covert human intelligence source as a person who- (a) establishes or maintains a personal or other relationship with another person for the covert purpose of facilitating the doing of anything following within paragraph (b) or (c) below; (b) covertly uses such a relationship to obtain information or to provide access to any information to another person; or (c) covertly discloses information obtained by the use of such a relationship or as a consequence of the existence of such a relationship. The Scottish Government Code of Practice confirms that a source may include individuals referred to as agents, informants and officers working under cover. A purpose is covert in relation to the establishment and or maintenance of a personal or other relationship only if the relationship is conducted in a manner that is calculated to ensure that one of the parties to the relationship is unaware of the purpose. By virtue of Section 1(8)(c) of RIP(S)A, a relationship is used covertly, and information obtained as above is disclosed covertly, if and only if it is used or, as the case may be, disclosed in a manner that is calculated to ensure that one of the parties to the relationship is unaware of the use or disclosure in question. The use of a source involves inducing, asking or assisting a person to engage in the conduct of a source or to obtain information by means of the conduct of such a source. Conduct of a source will include any activities involving the use of or actions of a covert human intelligence source (CHIS) specified in any authorisation. It includes conduct by the CHIS or in relation to the CHIS and where it is carried out for the purposes of or in connection with the specific investigation in question. Any surveillance which is carried out by means of a surveillance device in relation to anything taking place on any residential premises or in private vehicle; but is carried out without that device being present on the premises or in the vehicle (i.e. from a different location) is not intrusive unless that device is such that it consistently provides information of the same quality and detail as might be expected to be obtained from a device actually present on the premises or in the vehicle (Section 1(5) of the Act). 2.2 THE PRINCIPLES OF USE OF COVERT HUMAN INTELLIGENCE SOURCES When using or seeking to use covert human intelligence sources Council employees must comply with the following principles:- (a) Lawful purposes - use of covert human intelligence sources shall only be carried out where necessary to achieve one or more of the permitted purposes (as defined in RIP(S)A) which are:- • preventing or detecting crime or preventing disorder; • in the interest of public safety; or • for the purpose of protecting public health. (b) No authorisation for the conduct or use of a covert human intelligence source should be granted unless one of the three grounds specified above are established.
Page 17
2.3 AUTHORISATION OF COVERT HUMAN INTELLIGENCE SOURCE The process for granting authorisations for the use or conduct of CHIS is the same as for directed surveillance although there is a specific form of application. Copies of the relevant application, renewal and calculation of covert human intelligence source forms are attached at Appendix 2. In addition, however, authorisations for use of a CHIS can only be granted if sufficient arrangements have been in place for handling the source’s case. The arrangements therefore considered necessary are that:- (a) there will at all times be an appropriate officer within the Council who will have day to day responsibility for dealing with the source on behalf of the Council, and for the security and welfare of the source (“the handler”). (b) there will at all times be another appropriate person within the Council who will have general oversight of the use made of that source (“the controller”). (c) there will at all times be an appropriate person within the Council who will have responsibility for maintaining a record of the use made of the source. (d) the records relating to the source are maintained by an appropriate person within the Council and such records will always contain particulars of all such matters as may be specified by regulations made from time to time by the Scottish Ministers (clearly, this requirement should be reviewed on a corporate basis at regular intervals). (e) records maintained by the Council which disclose the identity of the source will not be available to persons except to the extent that there is a need for access to them to be made available to those persons. It is best practice that the officers identified as the handler and controller are named in authorisations. 2.4 GRANTING AND RECORDING AUTHORISATIONS AND REFUSALS The Authorising Officer’s job is to be satisfied that the use or conduct of a covert human intelligence source is necessary and that the applicant has correctly identified the lawful purpose for the proposed use, has planned the operation properly so as to minimise collateral intrusion and the collection of confidential information. Where the collection of such information is considered likely the application should be authorised by the Council’s Chief Executive. The proportionality test must clearly be satisfied. The authorisation should be granted only if the Authorising Officer is satisfied that these issues have been properly considered and that the application conforms with the Statutory Code of Practice and that use of a CHIS is justified. Any restrictions imposed on the authorisation should be noted as authorising officer comments. A risk assessment must be carried out before a CHIS is authorised to identify the risks to the CHIS and the likely consequences if the identity of the CHIS becomes known. This should consider the risks specific to each authorisation and be updated to reflect developments during the course of the deployment (and after if contact is maintained). The ongoing security and welfare of the CHIS after the deployment should be considered as part of the risk assessment and throughout the deployment. If there is likely to be a requirement to disclose information which may require the identity of the CHIS to be disclosed, this should also be considered. 2.5 RECEIPT AND LOGGING OF APPLICATIONS All Services carrying out CHIS activities must forward all relevant documentation to the Chief Officer (Legal and Democratic) so that the Central Register of CHIS activities
Page 18
carried out by the Council can be maintained. This confidential register will be open to inspection by the Investigatory Powers Commissioner’s Office and provides evidence of the Council’s compliance with the law and the Scottish Government’s Codes of Practice. The arrangements for updating the Central Register are set out in Appendix 2 of this Policy. 2.6 DURATION, RENEWAL AND CANCELLATION OF AUTHORISATIONS Authorisation for the conduct and use of a CHIS is valid for 12 months or 72 hours in the course of an urgent oral authorisation. Applications for the renewal of the conduct or use of a CHIS should not be granted unless the authorising officer is satisfied that a review has been carried out of the use made of the source and the period since the grant, the task given to the source during the period and the information obtained from the conduct or use of the source and unless he or she has considered the results of such a review. The authorisation should be cancelled if the person who granted or last renewed an authorisation is satisfied that the authorised conduct is no longer required or no longer satisfies the purpose for which it is granted. *However, if the reasons justifying carrying out the use of a CHIS cease to apply then the authorisation should be cancelled and the cancellation form forwarded to the Chief Officer (Legal and Democratic) for filing on the Central Register. On approving the authorisation a planned review date should be fixed to monitor the effectiveness of the use or conduct of the CHIS and its continuing necessity and proportionality. If surveillance is to be continued for longer than the original period authorised, it is necessary to have a renewal authorised. The tests applicable to renewals are identical to those for initial applications (Forms for cancellation and renewal of use or conduct of CHIS are attached at Appendix 2). 2.7 WHEN IS THE USE OF A CHIS APPROPRIATE? By its very nature the use of a CHIS intrudes on the privacy of individuals, perhaps even more so than in the case of directed surveillance. It must be regarded as the final option to recover information only to be considered when all other methods have either been tried and failed or where the nature of the activity to which the surveillance relates is such that it can be reasonably concluded that no alternative action will yield the information sought. Any use of a covert human intelligence source must be proportionate to the objective being pursued. 2.8 ONLINE COVERT ACTIVITY Where Council officers are interacting with individuals online, either via publicly open websites or more private communications, where those individuals are not reasonably likely to know the true identity of the Council officer, consideration should be given to whether a CHIS authorisation is required. If an investigation or operation requires a covert relationship with an individual or a group of people online to be established in order to gain access to information, a CHIS authorisation will likely be required e.g. using the internet to engage with an individual in order to facilitate a meeting in person. If no relationship is being established, then a CHIS authorisation may not be required immediately e.g. if a false identity needs to be set up to access a website (consideration should be given to whether a directed surveillance authorisation is required) or “liking” or “following” someone. It would only be once that interaction increased so as to start obtaining or accessing information that a CHIS authorisation would be required. If there is any dubiety over whether an authorisation is required, advice should be sought from Legal Solutions prior to the investigation commencing.
Page 19
Any risk assessment carried out in accordance with section 6.13 of the Covert Human Intelligence Source Code of Practice should include consideration of the risks arising from the online activity including the length of time spent online and the material to which the CHIS may be exposed. If an online persona is going to be used by multiple officers, separate risk assessments for each officer should be carried out (as well as separate authorisations sought). 2.9 NECESSITY AND PROPORTIONALITY Obtaining an authorisation under RIP(S)A will only ensure that there is a justifiable interference with an individual’s Article 8 rights if it is necessary and proportionate for these activities to take place. RIP(S)A first requires that the person granting an authorisation is satisfied that the authorisation is necessary in the circumstances of the particular case for one or more of the statutory grounds in Section 6.3 of RIP(S)A in the use of a CHIS. Section 6.3 provides that an authorisation is necessary on the following grounds:- • for the purpose of preventing or detecting crime or preventing disorder; • in the interest of public safety; or • for the purpose of protecting public health. Then, if the activities are necessary, the person granting the authorisation must be satisfied that they are proportionate to what is sought to be achieved by carrying them out. This involves balancing the intrusiveness of the activity on the target and others who might be affected by it against the need for the activity in operational terms. The activity will not be proportionate if it is excessive in the circumstances of the case or if the information which is sought could reasonably be obtained by other less intrusive means. All such activities should be carefully managed to meet the objective in question and must not be arbitrary or unfair. 2.10 CONFIDENTIAL MATERIAL AND COLLATERAL INTRUSION Confidential material covers a number of areas: professional legal advice, health information, spiritual counselling and material held under an obligation of confidentiality. So far as possible, use or conduct of a CHIS operations should be designed so as to minimise or eliminate the possibility of confidential information being acquired. If confidential information is in fact acquired, special care should be taken to avoid unnecessary disclosure. Before authorising use or conduct of a CHIS the authorising officer should also take into account the risk of intrusion into the privacy of persons other than those who are directly the subjects of the investigation or operation (collateral intrusion). Operations should be planned so as to minimise or eliminate as far as possible the risk of collateral intrusion, and the extent to which it remains is a factor to consider when determining the proportionality of the operation. Where recovery of such material is anticipated and unavoidable, it is a requirement that authorisation for use or conduct of a CHIS must be sought from the Chief Executive or, in his absence, the Chief Officer (Legal and Democratic). 2.11 SAFEGUARDS Material obtained by a CHIS must be handled in accordance with the safeguards set out below and elsewhere in this policy and the Code of Practice. Dissemination, copying and retention of material must only be carried out where necessary for the authorised purposes. The authorised purposes are that the material:-
Page 20
- is, or is likely to become, necessary for any of the statutory purposes set out in RIPSA; - is necessary for facilitating the carrying out of the functions of public authorities under RIPSA; - is necessary for the facilitating the carrying out of any functions of the IPC or IPT; - in necessary for legal proceedings; - is necessary for the performance of any person by or under any enactment. The material should only be copied and/or disclosed to the minimum people necessary (including internally within the Council) and to the minimum extent necessary for the authorised purposes i.e. if a summary or extract of the material can be disclosed instead of the entirety of the information, then this should be all that is disclosed. Similarly, information should only be copied to the minimum extent necessary for the authorised purposes. If material is disclosed to third parties, consideration should be given to what appropriate safeguards should be applied to those third parties. When material is to be used, or may need to be used, as evidence in criminal proceedings, consideration should be given to evidential integrity, the rules of evidence and disclosure, and it should be borne in mind that the Council will need to show how the material was obtained. Authorisations should be reviewed regularly to assess necessity and proportionality – this is particularly important where the directed surveillance is likely to involve a high level of intrusion into a person’s private life, a high degree of collateral intrusion or where sensitive information is likely to be obtained. The Council’s Data Protection policy must be complied with in respect of any personal data or special category data obtained as part of the investigation. The material should be stored securely to minimise the risk of loss and theft and should only be accessible to those authorised to access it. Information should be destroyed securely and in accordance with the Council’s Retention Schedule. The Investigatory Powers Commissioner’s Office has statutory powers of inspection and all records (applications, authorisations, cancellations and refusals) must be available for inspection. No records should be destroyed until an inspector has had the opportunity to see them. Documents created under this procedure are highly confidential and shall be treated as such. The Chief Officer (Legal and Democratic) shall ensure that the Central Register is kept secure and shall make proper arrangements for the retention and destruction of documentation in accordance with the requirements of the UK GDPR, the Data Protection Act 2018 and the Covert Human Intelligence Source Code of Practice 2017. It should be noted that refusals as well as approved applications must be retained. The Code of Practice recommends retention of authorisations for five years or longer, if required for ongoing proceedings. In accordance with guidance issued by the Office of Surveillance Commissioners, documents will be inspected periodically by a senior officer to ensure that a consistent approach is being adopted by different Council Departments. The Investigatory Powers Commissioner’s Office has statutory powers of inspection and all records (applications,
Page 21
authorisations, cancellations and refusals) must be available for inspection. No records should be destroyed until a Surveillance Commissioner has had the opportunity to see them. 2.11 TRAINING Each service is responsible for ensuring that their staff receive adequate training to deal with the authorisation process and any enquiries. Guidance to relevant employees will be issued by the Corporate Working Group and legal advice will be available as required from the Council's Legal and Democratic Solutions. 2.12 COMPLAINTS In the event of any member of the public being unhappy or dissatisfied with the conduct of any covert surveillance, in addition to the Council’s complaints procedure, they have the right to complain to the Investigatory Powers Tribunal. Details of the complaints procedure are available from the Council's Legal and Democratic Solutions. Copies of the Complaints Procedure will be made available to the public by post or e-mail if requested.
Page 22
APPENDIX 1 SCHEDULE OF DESIGNATED AUTHORISING OFFICERS FOR DIRECTED SURVEILLANCE AND COVERT HUMAN INTELLIGENCE SOURCE (“CHIS”) APPLICATIONS Chief Officer (Legal and Democratic) Chief Officer (Audit and Risk) Chief Officer (Community Operations) Chief Officer (Adult Social Work Services) Business Manager (Protective Services) Planning and Place Manager (Enterprise & Communities) Senior Education & Families Manager (Social Work) (Justice) APPENDIX 2 The Chief Officer (Legal and Democratic) is responsible for maintaining the Central Register of Directed Surveillance activities and Central Record of CHIS activities. Both central registers are stored on the RIPSA/RIPA Authorisations Microsoft Teams channel. Services must ensure that all authorisations, reviews, renewals, cancellations and refusals are uploaded to the designated Microsoft Teams channel as soon as they have been granted. The Information Governance team within Legal Solutions should also be notified of any additions to the central registers by email to DataProtection@northlan.gov.uk.
Page 23
PART 3 - COMMUNICATIONS DATA
This part sets out the Council’s policy and procedures in relation to the use of obtaining
communications data about a person.
3.1 THE PROTOCOL’S PURPOSE AND PRINCIPLES
3.1.1 Why do we have a Protocol?
The objective of this Part is to ensure that the obtaining of communications data
about a person by council employees on behalf of the Council is carried out
effectively, while remaining in accordance with the law. It should be read in
conjunction with the Acquisition and Disclosure of Communications Data Code
of Practice issued by the Home Office. The latest version was issued in 2007
and is available on the Home Office web site.
In some circumstances, it may be necessary for council employees, in the
course of their duties, to obtain or ask others to obtain communications data
about a person. By their nature, actions of this sort are potentially intrusive (in
the ordinary sense of the word) on someone’s privacy and may give rise to legal
challenge as a potential breach of Article 8 of the European Convention on
Human Rights and the Human Rights Act 1998 ('the right to respect for private
and family life').
The Regulation of Investigatory Powers Act (2000) [RIPA] provides a legal
framework for authorising public authorities to obtain this information and an
independent inspection regime to monitor these activities within the United
Kingdom.
The following procedures apply in all cases where communications data is to be
obtained.
3.1.2 What is “Communications Data”?
Communications data is defined in the Regulation of Investigatory Powers Act
2000 and in plain terms embraces the “who”, “when” and “where” of a
communication but not the content, for example a call from a mobile phone.
Communications data can comprise the telephone numbers involved, and the
time and place of the call, but not what was said.
3.1.3 What can the Council Access?
The Council do not have the same powers as for example the police. The table
on the next page details what information the Council can access and refers to
the relevant section in the Act in which the definition was given.Page 24
S21(4)(b) SERVICE USE INFORMATION (Service Data) Itemised telephone call records (numbers called) Itemised records of connections to internet services Itemised timing and duration of service usage ( calls and/or connections) Information about amounts of data downloaded and /or uploaded Information about the use made of services which the user is allocated or has subscribed to (or may have subscribed to) including conference calling, call messaging, call waiting and call barring telecommunications services Information about the use of forwarding/ redirection services Information about the selection of preferential numbers or discount calls Records of postal items, such as records of registered post, recorded or special delivery postal items, records of parcel consignment, delivery and collection S21(4)(c) SUBSCRIBER INFORMATION (Customer Data) “Subscriber checks” (also known as “reverse look ups”) such as “who is the subscriber of phone number 01698 45xx?”, “who is the account holder of e-mail account abc@abc.isp.co.uk?” or “who is entitled to post to web space www.example.co.uk?” Subscribers’ or account holders’ account information, including names and addresses for installation, and billing including payment method(s), details of payments Information about the subscriber to a PO Box number or a Postage Paid Impression used on bulk mailings Information about the provision to a subscriber or account holder of forwarding / redirection services, including delivery and forwarding addresses Subscribers or account holders account information including names and addresses for installation and billing including payment method(s), details of payments Information about the connection, disconnection and reconnection of services to which the subscriber or account holder is allocated or has subscribed to (or may have subscribed to) including conference calling, call messaging, call waiting and call barring telecommunications services Information about apparatus used by, or made available to, the subscriber or account holder, including the manufacturer, model, serial numbers and apparatus codes 3.1.4 What information is the Council not allowed to obtain? The Council is not allowed to obtain information which is defined as “traffic data” and examples are:- • information tracing the origin or destination of a communication that is, or has been, in transmission (including incoming call records); • information identifying the location of equipment when a communication is, has been or may be made or received (such as the location of a mobile phone); • information identifying the sender or recipient (including copy recipients) of a communication from data comprised in or attached to the communication;
Page 25
• routing information identifying equipment through which a communication is or has been transmitted (for example, dynamic IP address allocation, file transfer logs and e-mail headers - to the extent that content of a - communication, such as the subject line of an e-mail, is not disclosed; • web browsing information to the extent that only a host machine, server, domain name or IP address is disclosed; • anything, such as addresses or markings, written on the outside of a postal item (such as a letter, packet or parcel) that is in transmission and which shows the item’s postal routing; • record of correspondence checks comprising details of traffic data from postal items in transmission to a specific address, and online tracking of communications (including postal items and parcels). 3.1.5 How do these procedures affect communications made by Council staff? In short, they do not. The Council are empowered to monitor the content of e-mails etc. to ensure that there is no abuse of their system. The details of how and when any monitoring is carried out are contained within the Council is Telecommunications Policy, to which all employees using that that particular equipment or service (i.e. e- mail) have consented. 3.1.6 What are the Principles of Obtaining Communications Data? In obtaining communications data, employees of North Lanarkshire Council and investigators acting on behalf of the Council must comply with the following principles. (a) Lawful purposes - covert obtaining of communications data shall only be carried out where necessary to achieve the purpose of preventing or detecting crime or the prevention of disorder; Only if that purpose is met can there be any consideration of obtaining communications data. (b) Necessity - obtaining communications data shall only be undertaken where there is no reasonable and effective alternative way of achieving the desired objective(s). (c) Proportionality - the obtaining of communications data shall not be excessive i.e. it shall be in proportion to the significance of the matter being investigated and, for instance, shall take proper account of the possibility and extent of collateral intrusion. (d) Approval - all obtaining of communications data must be approved and supported by either a formal authorisation for officers of the Council to obtain the information or a notice requiring the Communications Service Provider to provide the information in accordance with the procedures described below. 3.1.7 What of statutory powers and processes to obtain Communications Data separate from the Regulation of Investigatory Powers Act 2000? It is always recommended that these procedures are similarly followed when obtaining communications data. However, provided that there is authorisation process undertaken before obtaining the Information taking into account the
Page 26
issues arising in terms of the Human Rights Act 1998, such a process can be followed. 3.2 HOW TO OBTAIN APPROVAL 3.2.1 Who prepares an application? As with the Procedures for Covert Surveillance, an application for approval to allow communications data to be obtained (“an application”) should be completed by the investigator who is involved in the operation in question. It is important to remember that it will be for the investigator to justify any information contained within an application, so extreme care should be taken. Further guidance on completing an application is available when completing an application on the NAFN website (see below). The investigator will have to provide the following information:- • The name or designation of the investigator; • The operation and person (if known) to which the requested information relates; • A description, in as much detail as possible, of the information requested (and whether the information is Service Use or Subscriber information); • The reason why obtaining the requested data is considered to be necessary for the prevention and detection of crime or prevention of disorder; • An explanation of why the information constitutes conduct proportionate to what it seeks to achieve; • Where appropriate, a consideration of collateral intrusion, the extent to which the privacy of others may be affected and why that intrusion (collateral intrusion) is justified; and • The timescale within which the information is required and why this is justified. Unlike the Procedures for Covert Surveillance, the application will be considered by the SPOC who can reject it, request further information from the investigator or pass it to the designated person for approval. 3.2.2 What and who is a Single Point of Contact (SPOC)? The Council has decided to utilise the National Anti-Fraud Network (NAFN) Telecommunications services to carry out the SPOC role. This is an on-line service using the NAFN website and will require all applicants and designated persons to be registered users, along with the Senior Responsible Officer. This is a reflection of the relatively low level of acquisition of communications data and means that the Council will not be required to retain trained officers for this role. The Home Office will deactivate those personal identification numbers held by existing council SPOCs as they will not be required. These SPOC details will remain on the Home Office system so that they can be reactivated at any point should the council cease to rely on the NAFN service.
Page 27
The officers concerned are the Trading Standards Manager, within Environmental Services, and the Audit Manager, within Finance & Customer Services. 3.2.3 What are the role and responsibilities of the Single Point of Contact? The SPOC has a regulatory role in connection with the applications for Authorisations. He/she will assess an application to make sure that there is sufficient information contained within it to allow the Designated Person to come to a decision on whether the application should be approved. If there is insufficient information contained within the application to allow the application to proceed to the Designated Person, the SPOC will at this stage refuse the application and return it, together with an explanatory report to the investigator. The SPOC is not considering the application on its merits as if he/she was a Designated Person but only the sufficiency of the information being provided by the investigator. If there is sufficient information, the SPOC will, before the application is forwarded to the Designated Person. • where appropriate assess whether access to communications data is reasonably practical for the Communications Service Provider; • advise investigators and Designated Persons on the practicalities of assessing different types of communications data from different postal or Communications Service Providers; • advise investigators and Designated Persons on whether the data falls within the classes to which the Council can have access; • provide safeguards for authentication; • assess any cost and resource implications to both the Council and the Communications Service Provider. The SPOC will prepare any comments that he/she might have on the application (such as cost etc.) and complete and forward the request for authorisation via the website to the Designated Person. The SPOC will not however be expected to justify any information contained in, or the approval of, any application. This will be a matter for the investigator and the Designated Person respectively. 3.2.4 Who is a Designated Person? The Act requires that only officers who have a high degree of responsibility within the Council may approve applications and grant authorisations/notices. An Order made under the Act refers to these officers as “Designated Persons” and sets minimum levels of responsibility of these officers. The levels specified within the statutory Order refer to “Director, Head of Service, Service Manager or equivalent”. Taking into account service needs and other criteria, the Designated Persons for the Council are the Trading Standards Manager and the Audit Manager, and in addition the Head of Protective Services and the Executive Director of Finance & Customer Services. Details of these officers will need to be confirmed and registered with NAFN.
Page 28
3.2.5 What are the duties of a Designated Person? On receiving an application, the Designated Person must ensure that the requirements of the law are met. Therefore he/she must be satisfied that:- • the permitted purpose exists; and • the obtaining of communications data is absolutely necessary; and • the obtaining of communications data is proportionate; and • any urgent timescale is justified. If the Designated Person is not satisfied that all of these conditions are met, he/she is under a duty to refuse the application. Remember that on any challenge it will be the Designated Person who will be required to justify the approval of the application. The Designated Person is not bound to accept any comments made by the SPOC in relation to the application but should consider them. A Guide to assist Designated Persons has been prepared and forms Appendix 1. Further information and guidance for the designated person will be available when considering applications on the NAFN website. 3.2.6 What about proportionality? Proportionality will be the most likely area for challenge. The Designated Person should not merely consider the investigation itself but its wider possible effects. So not only must he/she be satisfied that the need for the obtaining of communications data outweighs the individual’s expectation of privacy, but should also consider whether there is, for instance, any unnecessary or excessive collateral intrusion and the possibility of disclosure of confidential information. 3.2.7 What is Collateral Intrusion? Collateral Intrusion is the risk of intrusion into the privacy of someone other than the direct subjects to whom the communications data relates. Measures must be taken, wherever practicable, to avoid unnecessary intrusion into the lives of those not directly connected with the operation or investigation. 3.2.8 What if an Approval is required urgently? Unlike the procedures for covert surveillance there is no fast track system for obtaining Approvals and Authorisations/Notices for obtaining Communications Data. Therefore the above procedures must be followed regardless of urgency. 3.2.9 What if a Designated Person in unavailable? Sometimes a Designated Person, who would normally deal with applications, will not be available. In those circumstances, application may be approved by another officer of a similar grade/level as the Service Manager or of the grade(s)/level(s) above. The SPOC will forward any application to another Designated Person within the line management structure of the investigator unless other arrangements have been laid down by the Council.
Page 29
3.2.10 The application is refused, what next? If the Designated Person decides that an application should be refused, he/she will reject the application on the NAFN website, and the SPOC will notify the investigator accordingly. 3.3 PART (iii): HOW TO ACTION AN AUTHORISATION 3.3.1 When would an Authorisation be used? An Authorisation allows for the collection or retrieval of data. An Authorisation is granted by the Designated Person, but administered by the SPOC. The Designated Person will approve the conduct required to facilitate an Authorisation. An Authorisation allowing the NAFN SPOC to retrieve the data will only be issued where the Designated Person believes that one or more of the following apply:- • if a Notice is issued and the Communications Service Provider is incapable of complying with it; • if a Notice is served but the enquiry is likely to be prejudiced; or • there is an existing arrangement in place between NAFN and the Communications Service Provider for the exchange of data. 3.3.2 The application is approved, what next? The Designated Person will at the same time as approving the application grant the Authorisation completed by the SPOC. This will be done online using the NAFN website. 3.3.2.1 if the authorisation is approved, the designated person will follow the authorisation on to the Council’s Legal Services. The authorisation will be sent to the Sheriff Court for approval by the Sheriff of the authorisation; 3.3.2.2 the investigating officer who made the initial application for authorisation will attend a hearing in private at the Sheriff Court to support the Council’s request for approval. This appearance may also be made by the Council’s Legal Services staff. 3.3.2.3 The Sheriff can approve, refuse to approve or quash the authorisation, and this decision will be contained in a court order. If the Sheriff approves the authorisation then communications data can be obtained. If the Sheriff rejects the authorisation the Council can amend the application and re-submit for approval at a later date. If the Sheriff quashes the order, then no modified request for approval of an authorisation may be made. 3.3.2.4 The investigating officer will acquire a copy of the court order referred to in 3.3.2.3 above, and will refer this to the SPOC. This is required in the event of orders approving, refusing to approve and quashing the authorisation.
Page 30
3.3.3 How long does the Authorisation last? Authorisations will last for one month from the date of granting of the Authorisation. 3.3.4 Can an Authorisation be renewed? Prior to (but not after) expiry, officers can apply to have the Authorisation renewed using the same procedure as before. A Designated Person can only renew an approval if the renewal meets the same criteria as the original approval, i.e. if obtaining of communications data has become disproportionate the renewal must be refused. If an approval is renewed then the Designated Person must grant a new Authorisation. The new Authorisation will commence from the date of expiry of the previous Authorisation/Notice. The procedure is the same as seeking the original authorisation and must progress through the SPOC as normal. 3.3.5 Must an Authorisation be cancelled and, if so who cancels the authorisation? If it becomes obvious that the obtaining of communications data has not been fruitful or has expired without being renewed then the authorisation must be cancelled by the Designated Person. However if the original Designated Person is no longer available (for instance, having left the Council’s employment) the authorisation must be cancelled by his/ her replacement or a more senior officer. If the post of the Designated Person is not filled then the authorisation must be cancelled by an officer of the same level, or higher who has taken over the responsibilities of the original Designated Person. If for some reason that person is not available then the authorisation may be cancelled by any officer of the Council who could have granted that level of authorisation. Notification of the cancellation must be sent to the SPOC who will immediately contact the Communications Service Provider and advise them accordingly. 3.3.6 What if there is a cost? It is highly likely that the Communications Service Provider will incur costs in complying with the Authorisations. In that case the Council (i.e. the Service requesting the information) will be expected to meet those costs. Where the cost is greater than £10 then NAFN will seek approval beforehand. 3.4 DOCUMENTATION 3.4.1 What Documents are required? By using the NAFN RIPA Telecommunications service, all applications and authorisations are made on line. There is no requirement for the Council to hold copies of these documents. Statistics for the annual return for the Interception of Communications Commissioner’s Office (IOCCO) are provided by NAFN, and the Council is required to confirm that these authorisations were processed by NAFN. Inspections by IOCCO are conducted at NAFN.
Page 31
3.5 WHAT IF A PERSON WANTS TO MAKE A COMPLAINT? Anyone who is unhappy about the way the Council has obtained or is obtaining communications data may make a complaint by use of either internal or external procedures. The decision as to which procedure should be used lies with the individual concerned. 3.5.1 How to use the Internal Procedure If the person wishes to complain using the Council’s internal procedures, the complaint should be, in the first instance, addressed to the Executive Director of the Service carrying out or having carried out the obtaining of communications data. If this is unknown then the complaint should be made to the Executive Director of Corporate Services, the Council’s Monitoring Officer. The complaint should be in writing and give details of who is making the complaint. All Executive Directors may be contacted through the following address:- North Lanarkshire Council Civic Centre Windmillhill Street Motherwell ML1 1AB The Council will then investigate using officers who were not involved in the obtaining of communications data. Where possible the applicant will be advised of the outcome of the investigation, however, this might not be possible e.g. where the Council is unable to do so without prejudicing their regulatory functions. 3.5.2 How to use the External Procedure If a person wishes to complain directly to an independent body or has used the Council’s internal procedures and is still dissatisfied, then he/she may complain to the Investigatory Powers Tribunal. Complaints should be made in writing to:- The Investigatory Powers Tribunal PO Box 33220 London SW1H 9ZQ Notices and explanatory information on how to make a complaint, copies of this Protocol and any Council Policies, together with copies of the relevant forms, Code of Practice (if any) and the Regulation of Investigatory Powers Act 2000 must be made available in the public offices of Council Services which may be involved in obtaining of communications data.
Page 32
APPENDIX 1 Regulation of Investigatory Powers Act 2000 Guidance for Designated Persons APPLICATIONS FOR COMMUNICATIONS DATA 1. Background 1.1 The Council are empowered in terms of RIPA to obtain the “communications data” in respect of an individual. SERVICE USE INFORMATION (Service Data) Itemised telephone call records (numbers called) Itemised records of connections to internet services Itemised timing and duration of service usage ( calls and/or connections) Information about amounts of data downloaded and /or uploaded Information about the use made of services which the user is allocated or has subscribed to (or may have subscribed to) including conference calling, call messaging, call waiting and call barring telecommunications services Information about the use of forwarding/ redirection services Information about the selection of preferential numbers or discount calls Records of postal items, such as records of registered post, recorded or special delivery postal items, records of parcel consignment, delivery and collection SUBSCRIBER INFORMATION (Customer Data) “Subscriber checks” (also known as “reverse look ups”) such as “who is the subscriber of phone number 01698 45xx?”, “who is the account holder of e-mail account abc@abc.isp.co.uk?” or “who is entitled to post to web space www.example.co.uk?” Subscribers’ or account holders’ account information, including names and addresses for installation, and billing including payment method(s), details of payments Information about the subscriber to a PO Box number or a Postage Paid Impression used on bulk mailings Information about the provision to a subscriber or account holder of forwarding / redirection services, including delivery and forwarding addresses Subscribers or account holders account information including names and addresses for installation and billing including payment method(s), details of payments Information about the connection, disconnection and reconnection of services to which the subscriber or account holder is allocated or has subscribed to (or may have subscribed to) including conference calling, call messaging, call waiting and call barring telecommunications services Information about apparatus used by, or made available to, the subscriber or account holder, including the manufacturer, model, serial numbers and apparatus codes
Page 33
1.2 All of these examples fall into the category of private information about an individual and so obtaining the data would amount to an interference with an individual’s Convention rights. Consequently to obtain the information the Council must ensure that there is no improper interference with someone’s rights. In order to do so, the Council have created an approval system, where a Designated Person must give approval for the information to be obtained. 2. The Human Rights Test 2.1 In order to approve the obtaining of communications data, a Designated Person (“DP”) must be satisfied that the application complies with the following principles. 2.2 Lawful purposes - obtaining of communications data shall only be carried out where necessary to achieve the purpose of preventing or detecting crime or the prevention of disorder. Only if that purpose is met can there be any consideration of obtaining communications data. 2.3 Necessity - obtaining communications data shall only be undertaken where there is no reasonable and effective alternative way of achieving the desired objective(s). 2.4 Proportionality - the obtaining of communications data shall not be excessive i.e. it shall be in proportion to the significance of the matter being investigated and, for instance, the possibility and extent of collateral intrusion. 2.5 These criteria can be called “the Human Rights Test”. This Guide has been prepared to provide DPs assistance in assessing applications against each of the criteria. The determining of whether the Human Rights Test has been met will depend upon the merits and circumstances of each particular case. Consequently only rather general advice can be provided. If a DP wishes to obtain further advice on an application then he or she may contact one of the officers appointed by the Council to act as Single Points of Contact (“SPOC”) in terms of the Regulation of Investigatory Powers Act 2000 (“RIPA”). These officers are at present. 3. Lawful Purpose 3.1 The Council can only obtain communications data if it is required in connection with one or both of the following:- • The prevention and detection of crime; and • The prevention of public disorder. 3.2 If the DP is not satisfied that application substantiates one of these grounds then the application fails and must be rejected. It is not appropriate for the DP to automatically agree with the views of the investigator making the application. He/she must come to his or her own conclusions based solely on the information contained within the application. 3.3 Some matters on which the DP must be satisfied on are:- • Identification of either the crime which is being prevented or detected or disorder which is being prevented. This must be ascertainable from the application. A general suspicion of someone being involved in something illegal without knowing what in particular is unlikely to meet this test.
Page 34
• The clear linkage of the crime or disorder to the subject in respect of which the communications data is being sought. This does not mean that the subject must be the perpetrator of the crime or disorder, but where the subject is not the perpetrator then there could be issues in relation to “Necessity” and “Proportionality” (see later). • The crime must be something that the Council is investigating as a public law enforcement agency (“LEA”) similar to the police in relation to criminal law and so would not include a civil law matter. • Further it must be a matter which would fall or be expected to fall within the Council’s remit as a LEA. For example, while the Council are a LEA, they would not be expected to investigate crimes such as theft or assault. It may be that the Council wish to investigate the actions of their employees - but they are doing so as an employer not as a LEA - the criminal investigation is often being carried out by the police in tandem or in conjunction with the Council’s own investigation. 4. Necessity 4.1 This requires that the proposed action is “necessary in a democratic society”. Necessary does not mean “beneficial”, “useful”, “reasonable” or “desirable”. There must be a pressing social need for the obtaining of the communications data. The question arises as to what a “democratic society” encompasses. The “hallmarks” of such a society are “tolerance”, “pluralism” and “broadmindedness”. Consequently the interference can only be permitted if it is in accordance with those principles. 4.2 Therefore the obtaining of the information must be an absolute last resort. The DP must be satisfied that the information cannot be obtained without the interference with the Convention right. The investigator must show to the satisfaction of the DP that there are no alternative avenues or that the available avenues would be inappropriate (in exceptional circumstances). If in the view of the DP there are further steps which can be taken before the obtaining of the information through the Council’s RIPA powers, the application must be refused. 5. Proportionality 5.1 The DP must also be satisfied that the action proposed is proportionate i.e. is the exercise of the statutory power in balance with the matter being investigated. In looking at this issue the DP must balance the extent of the interference with the individual’s right to respect to his/her privacy and whether and to what extent it will interfere with the lives of others not connected with the investigation (“Collateral Intrusion”). The more intimate the interference, the more significant reasons for the interference are required. 5.2 Also where the subject is not the perpetrator of the alleged crime or disorder then, given their innocence, the matters justifying the interference must be particularly serious. 6. Conclusion 6.1 This guidance has been prepared to assist DPs in coming to a view on applications before them in respect of RIPA powers. As mentioned previously each case will depend upon its own circumstances. It will be for the DP to justify his/her decision in respect of each of these matters if the decision to approve the application is challenged. Consequently such decisions should not be taken lightly.