(c) www.lobster-magazine.co.uk (Issue 43)
    Summer 2002
  Last | Contents | Next  
Issue 43    

Into the Whitehall maw

Jane Affleck

  1. 1: The Investigatory Powers Tribunal

    Malcolm Kennedy (1) complained to the recently established Investigatory Powers Tribunal because he believes his telecommunications are being monitored and interfered with, and his persistent attempts to seek answers have led to brick walls and confusion. His case is currently proceeding. (2) But concerns have already been raised about the Tribunal, especially its secrecy, and whether the Tribunal's rules and procedures are compatible with human rights legislation.

    Introduction

    The Investigatory Powers Tribunal (IPT) was established by s65 of the Regulation of Investigatory Powers Act 2000 (RIPA), (3) and came into being when the Act came into force in October 2000. It replaces the Interception of Communications Tribunal, the Security Service Tribunal and Intelligence Services Tribunal (4) ; and the complaints function of the Commissioner appointed under the Police Act 1997. The Tribunal's jurisdiction is set out in RIPA s65; it is the body which hears all complaints concerning the intelligence agencies and complaints against public authorities, including the police forces, in respect of the powers covered by the RIP Act. It can examine any complaint relating to:

    'conduct by, or on behalf of, any of the intelligence services......conduct for, or in connection with, the interception of communications in the course of their transmission......any entry on, or interference with, property or any interference with wireless telegraphy .....the giving of a notice under s49 or any disclosure or use of a key to protected information or conduct to which Part II [of RIPA (surveillance and covert human intelligence sources)] applies; conduct to which Chapter 2 of Part 1 [Acquisition and Disclosure of Communications Data] applies.'

    The Tribunal is also the appropriate place to bring proceedings under the Human Rights Act 1998 s7 for claims that a public authority has acted in a manner incompatible with a Convention (ECHR) right. It is, in the words of Charles Clarke MP, 'effectively a one-stop shop for those complaining about the use of investigatory powers'.(5)

    The Tribunal President is Lord Justice Mummery, (a Court of Appeal judge. Under transitional arrangements L J Mummery also remains President of both the Security Service and Intelligence Services Tribunals) and the Vice President Sir Michael John Burton (a High Court judge, also President of the Interception of Communications Tribunal). (6)

    The remedies available to the Tribunal are set out in RIPA s67(7); it has the power to make an order 1) quashing or cancelling any warrant or authorisation; 2) requiring the destruction of any records of information obtained under a warrant or authorisation or held by any public authority; 3) to make an award of compensation 'or other order as they think fit.'

    Duty to Investigate

    The Tribunal has a duty to investigate whether any such conduct (see above) has occurred against the complainant by the person or authority named in the complaint; and if so, to investigate the authority, if any, for such conduct - e.g. whether a warrant or other authorisation exists; and then to determine the complaint by the application of the principles of judicial review. (RIPA s67(3)). Those people and organisations who are required to assist the tribunal in their investigations are listed in RIPA s 68(7) and include 'every person holding office under the Crown' and 'every person employed by or for the purposes of a police force'. They have a duty 'to disclose or provide to the Tribunal all such documents and information as the Tribunal may require' in exercising their jurisdiction.

    The IPT are able to determine their own procedure in relation to the investigation of any complaint. The investigation may be purely a paper exercise; but if the tribunal choses to do so, it could take on a more active role, such as interviewing particular members of an organisation. In carrying out their investigation, the tribunal also has the power to require assistance from a relevant Commissioner (RIPA s68(2)). RIPA sets up a new commissioner system, with the exception of surveillance commissioners, who continue under the Police Act 1997, and who now also have responsibility for overseeing the surveillance powers conferred under Parts II and III of RIPA (but not in relation to interception of communications and the intelligence services) where they are carried out by public authorities, including the police.(7)

    The Interception of Communications Commissioner, under RIPA s57(3) 'shall give the Tribunal all such assistance (including his opinion as to any issue falling to be determined by the Tribunal) as the Tribunal may require in connection with the investigation of any matter by the Tribunal'. However, in his first annual report, published October 2001, the Interception Commissioner, Sir Swinton Thomas, says (para 26)

    'Although Lord Justice Mummery, the President of the Tribunal, and I have consulted each other on matters.... it has not been necessary for me to give to the Tribunal any assistance on the formal basis envisaged by the section.' (8)

    The Intelligence Services Commissioner is, under RIPA s59(3), similarly required to assist the Tribunal in their investigations, though in his first report, published in October 2001, the Commissioner, Lord Justice Simon Brown, does not refer to providing assistance to the IPT. (9) A further Commissioner, known as the Investigatory Powers Commissioner for Northern Ireland, is also established under RIPA, and is similarly empowered to give the Tribunal such assistance as it may require in its investigations.(10)

    Insufficient Resources

    Concerns have already been expressed about the Tribunal: both the rules governing its procedure, especially the degree of secrecy under which it operates, and its ability to carry out its function due to the small number of its secretariat, have been questioned. The report of the Intelligence and Security Committee (11) says (para 20):

    'We noted that for a significant period in 2000 the Tribunal did not have sufficient secretariat to enable it even to open the mail, let alone process and investigate complaints. (12)

    During the debate on the report, (13) Alan Beith MP, a member of the ISC, said:

    'The several bodies involved are dependent on a tiny support structure which is quite incapable of carrying out the job.....They [The Tribunal mechanisms] are Britain's defence in relation to the European Convention on Human Rights (ECHR), so that an individual who believes that his civil liberties are being damaged has a mechanism through which he can appeal. If those involved in that mechanism cannot even open his letter - let alone process it or put it in front of the judicial authority who is to adjudicate upon it - we are not providing a safeguard that should be there. (14)

    The IPT secretariat currently consists of 3 full time staff, plus a part-time legally-qualified registrar. This may increase. (15)

    IPT Rules

    The Investigatory Powers Tribunal, its rule and procedures, are governed by RIPA s65-69. The rules governing IPT procedure, made under RIPA S69(1), are set out in a statutory instrument, SI 2000 No 2665 (16) which came into force October 2 2000. (17) These cover the Tribunal's jurisdiction, disclosure of information, making a complaint, forms of hearing, representation, evidence and remedies. The Tribunal has the power to determine its own procedure in relation to s7 proceedings (rule 9(1)). On disclosure, rule 6(1) says:

    The Tribunal shall carry out their functions in such a way as to secure that information is not disclosed to an extent, or in a manner, that is contrary to the public interest or prejudicial to national security, the prevention or detection of serious crime, the economic well-being of the United Kingdom or the continued discharge of the functions of any of the intelligence services.

    Indeed, under rule 6(2), the Tribunal may not disclose to the complainant or to any other person: 'the fact that the Tribunal have held, or propose to hold an oral hearing......' (except with the consent of the person required to attend the hearing) or 'any information or document disclosed or provided to the Tribunal in the course of that hearing', or the identity of any witness at that hearing..... (except with the consent of the witness or the person who disclosed or provided the information)

    Rule 6 was criticised by the Earl of Northesk in a debate on the IPT rules in the House of Lords (18) :

    'My reading of s6 of the Investigatory Powers Tribunal Rules is that, unless guilty parties consent, a tribunal will not be able to disclose a whole host of matters relating to the case even if it finds in favour of the claimant. Will that not act as a constraint on proper accountability in that guilty parties will be assured that their misconduct can be hushed up, effectively on their say-so?'

    Sections 9(3) and 9(4) of the IPT rules provide for separate oral hearings at which the complainant and the person or public authority (eg intelligence agency or police), whose conduct is subject to the complaint, may make representations. And rule 9(6) says 'the Tribunal's proceedings, including any oral hearings, shall be conducted in private'.

    'An odd system, distorted by the need for secrecy'

    At the time of their introduction, concerns were raised by members of the Standing Committee on Delegated Legislation, which considered the IPT Rules, on October 30 2000, (19) particularly about the degree of secrecy governing the Tribunal's proceedings.

    At the Standing Committee, Charles Clarke MP, then Home Office Minister of State, said:

    'The rules provide a credible and accessible means of redress, while protecting some very sensitive material ......it is difficult, but the rules strike a balance of which we can be proud.'

    In a further reference to this balance between individual rights and the need to protect highly sensitive information Clarke said:

    'To be frank, we are reposing a great deal in the quality of the chair of the tribunal, the judge, and that persons ability to make proper and balanced judgments....'

    On being asked by Michael Jack MP (Con.) about the tribunal's compatibility with human rights legislation, Clarke said:

    'According to advice that we have been given, these procedures fully satisfy the Human Rights Act requirement. A principal reason for that is that nothing in that Act disempowers the right of the state to protect national security and deal with serious and organised crime.....The tension between the need to protect national security and the rights of the individual.....is constant throughout this process.'

    Oliver Heald MP (Con.) drew attention to RIPA s69(6) which says:

    'In making rules under this section the Secretary of State shall have regard, in particular, to the need to secure that matters which are the subject of proceedings, complaints or references brought before or made to the Tribunal are properly heard and considered.'

    Mr Heald went on to raise concerns about the Tribunal hearings (of the complainant and the person or authority complained about) being separated:

    'If the complainant brought his complaint and neither the person complained against nor his representative could be present, there might be no proper cross-examination and people might get away with bringing a case that was not true or properly challenged. The same danger arises if the person complained against can go to a hearing at which neither the person complaining nor his representative is present and say whatever he wishes without being challenged.'

    Heald asked if there would be a right to cross-examine under rule 9(3) and 9(4):

    'That is fundamental to a proper hearing and consideration of a complaint. Secondly, how can a complainant correct inaccurate information that is given to the tribunal if it is not possible to cross-examine or hear what the other party says?.....There is a danger that proceedings will be so separate as regards each of the parties that the proper interplay, which is the purpose of having a hearing before an impartial body, will disappear. We will end up with an odd system that is greatly distorted by the need for secrecy; if it goes too far, it makes a mockery of the whole thing.'

    Michael Jack MP, on the same subject, said:

    'We are dealing with protecting individuals rights, and people usually have a chance to hear and comment on evidence given...In this tribunal there will be not a Chinese wall but a brick wall between the complainant and those responding in front of the adjudicating person or authority.'

    Charles Clarke MP confirmed that in rule 9(3) and (4):

    'the statutory instrument specifically separates the two hearings......therefore there is no obligation on the tribunal to give a right of cross-examination in such a situation.....I believe that an explicit obligation to allow cross-examination, or to provide the summary that the Hon Gentleman describes under rule 9(4)(c), would constrain the tribunal's efforts to balance the interests of the individual citizen and national security.'

    Further,

    'a right to be present or to cross-examine might result in a mischievous approach which could prove unacceptable to the country as a whole.'

    Even the provision of a summary is at the discretion of the Tribunal. On being questioned about the provision to the complainant of a summary of evidence (20) Clarke said:

    'The tribunal is certainly entitled to summarise information if it so wishes because it has that power under the Act. The tribunal will make its decision according to the balance in the individual case. That decision to summarise is constrained by rule 6 on disclosure of information...I am certain, however, that the tribunal will offer summaries if it believes that the balance that I have described can be maintained.'

    Mr Heald MP said:

    'Complainants have no way of finding out what was said unless a summary is available. I fully understand that a summary would need to be edited so that it did not contain genuinely top secret or prejudicial information, but if no summary is available to give the complainant some idea of what the other person says, it cannot be a proper hearing.'

    Clarke confirmed that the provision of summaries would be discretionary. The tribunal has the power to determine its own procedure (rule 9 (1).

    'The tribunal may decide to make summaries available, but it will be for the tribunal to judge whether to do so in the light of the competing interests we have discussed, subject only to the requirements of rule 6.'

    The RIPA does not make provision for a special advocate (a security-cleared barrister who would represent the interests of the claimant at tribunal hearings from which the claimant and his legal representative are excluded), although provision for special advocates had been made in the draft E Commerce Bill in 1999, and already exists for the Special Immigration Appeals Tribunal. When the decryption powers were removed from the E Commerce - later the Electronic Communications - Bill, and put into the RIP Bill, the provision for special advocates disappeared.

    Malcolm Kennedy's case

    Malcolm Kennedy believes his telephones are being monitored and interfered with. In seeking an explanation for this he has made numerous and persistent inquiries to many authorities. Kennedy had previously been thwarted from taking a case before the Interception of Communications Tribunal because of its limited remit. (21) He has also used the Data Protection Act 1998 to make subject access requests to various authorities, including MI5 and GCHQ, in an attempt to obtain personal data they hold on him. These have been unsuccessful, and Kennedy had initially hoped to challenge the certificates issued by MI5 and GCHQ (exempting them from the subject access provisions of the Data Protection Act) before the Information Tribunal. (See below on Baker case and exemption certificates.)

    However, because his key complaint concerns interception of communications, he is unable to do so: s17 of the RIP Act considerably restricts what can be said about interference with communications 'for the purposes of, or in connection with, any legal proceedings'; and this prevents the Information Tribunal from considering either the existence of an interception warrant or data obtained under a warrant. But under s18(1) (c) such restrictions do not apply to proceedings before the Investigatory Powers Tribunal, which is clearly intended to deal with all matters concerning interception and warrants. Therefore, Kennedy did have a valid claim before the IPT. Liberty is acting for Kennedy in his complaint to the tribunal; but before Kennedy's complaint proper can be heard, Liberty is challenging the IPT's rules and procedures, believing they do not comply with the European Convention on Human Rights, Article 6, the right to a fair trial (incorporated into English law with the HRA). (22) Liberty would like to establish that the Tribunal should normally hear such cases in the open, and that the rules restricting Kennedy's access to secret material should be relaxed. The IPT's first oral hearings concern these matters.

    Other cases reported to have made a complaint to the IPT include Liberty, the Irish Council for Civil Liberties and British-Irish Rights Watch, (23) partly over allegations that phone calls between Britain and Ireland, including legally privileged material confidential to the complainants, were routinely intercepted by an MoD installation at Capenhurst, Cheshire, and later by the Echelon system. The rights groups say that the RIP act fails to provide adequate safeguards to protect individual privacy, a right established by the HRA and ECHR. The Labour peer, Lord Ahmed, also complained that transcripts of his phone conversations were given to ministers. Unusually, in this case the government said that Lord Ahmed was not under surveillance, a departure from their normal policy of neither confirm nor deny with regard to such claims. (24) In a written answer Tony Blair stated that government policy remains that there be no tapping of telephones of members of the Houses of Commons and Lords, and with this exception it remains the normal policy of the government neither to confirm nor deny such allegations. (25)

    Since October 2000 it is believed that the IPT has received between 150-160 complaints and has determined about 70 cases; none have been upheld; and currently it is believed that about 50 cases are proceeding. The IPT decides how any particular case will proceed and whether it holds oral heaings.(26)

    Cases such as Kennedy's, which is challenging the statutory framework under which the tribunal operates, are treading uncharted territory and how they might proceed is difficult to predict but they may help to clarify a system which is complicated, and, at times seems only to put further obstacles in the path of a complainant.

    Currently no appeal from the IPT

    The RIP Act does not specifically provide for a right of appeal from the tribunal, a feature considered surprising by several lawyers; (27) the Home Office confirmed, when asked about appeals from the IPT, that 'there is currently no court of appeal'. The RIP Act, s67(8), specifically excludes such an appeal, but leaves it open for one to be provided. S67(8) says:

    Except to such extent as the Secretary of State may by order otherwise provide, determinations, awards, orders and other decisions of the Tribunal (including decisions as to whether they have jurisdiction) shall not be subject to appeal or be liable to be questioned in any court. (28)

    Ultimately, the points at issue may have to go to the European Court of Human Rights in Strasbourg for determination; however, all domestic remedies must be exhausted first, and the process is likely to take some time. Until then, the tribunal must give effect to the IPT rules as they stand; these can only be amended by Parliament.

    It is important that the new tribunal, and the way it operates, is seen to be fair. With its broad remit, the IPT is likely to receive many complaints. At this early stage it is impossible to comment on whether the tribunal, with its human rights dimension, will strike a different balance to the ones it replaces, but the tribunal rules, as they now stand, have been criticised - and are now being challenged - for not creating a fair environment for the complainant. As Andrew Tyrie MP (Con.) said in the Standing Committee (October 30 2000):

    'The existing tribunals have heard hundreds of cases, but not one complaint has ever been upheld. Is that a reflection of the fact that the services have got it right or of the fact that the tribunals that are to be abolished have not so far been doing their job very well?'

    Thanks for assistance to Caspar Bowden, Director of the Foundation for Information Policy Research (FIPR). FIPR's RIP information centre is at: www.fipr.org/rip/

    Thanks also to Russell Miller, lawyer, who runs Defendants' Information Service Services.

  2. 2: The Norman Baker case, the Information Tribunal, and MI5 certificates

    Challenging MI5's blanket exemption from the subject access provisions of the Data Protection Act 1998

    Obtaining personal data using the Data Protection Act 1998

    Under the Data Protection Act 1998 (section 7) an individual (or data subject) can apply to see what information, either on computer or in a filing system, an organisation (or data controller) is keeping on them. The right of subject access to information held in certain paper files became available from October 24 2001 (regardless of the date from which the information was held).

    Under S28 of the DPA, personal data is exempted from any of the provisions of the data protection principles, part II (subject access provisions), part III (notification) and part V (enforcement) of the DPA and section 55, if the exemption is required for the purpose of safeguarding national security [DPA S 28 (1)] as evidenced by a certificate of exemption signed by a Minister of the Crown. (29) In this case the applicant will be told that the Agency holds no personal data to which the applicant is entitled to have access, and that this response should not be taken to imply that any such data is or is not held by the organisation - the Neither Confirm Nor Deny policy (NCND).

    Exemption certificates authorising a blanket ban on access to personal data processed by the organisations were signed on behalf of the three intelligence agencies, MI5, MI6 and GCHQ.(30) Subject access requests made to the agencies have met with a response referring to these certificates, and claiming exemption from the subject access and other requirements of the Data Protection Act 'for the purpose of safeguarding national security'.

    The Norman Baker case

    In a test case brought by the human rights organisation, Liberty, Norman Baker MP successfully challenged MI5's certificate authorising the blanket ban before the Information (formerly Data Protection) Tribunal's National Security Appeals Panel, which is specially constituted to hear such cases, its members designated by the Lord Chancellor. (31) This tribunal hears appeals under DPA s28(4) to overturn a decision to issue a certificate and s28(6) for a determination that a certificate does not apply to the personal data in question, and can allow an appellant to give evidence before it and call witnesses.

    For appeals against the certificate brought under s28(4), the Information Tribunal has no remit to review a decision by a data controller not to release data, nor can it order disclosure of data. The Tribunal can only assess, applying the principles of judicial review, whether the Secretary of State had reasonable grounds for issuing the certificate. (32) If the tribunal finds that the Minister did not have reasonable grounds for issuing the certificate, the tribunal may allow the appeal and quash the certificate.

    In the Baker case, the first case to be heard by the National Security Appeal Panel of the tribunal, the respondent was the Home Secretary. (Jack Straw signed the MI5 certificate in July 2000 when Home Secretary). The case was heard in June 2001, and the Panel's decision published on 1 October 2001, ruling that MI5's blanket ban preventing applicants being told whether MI5 holds files on them is unlawful under the Data Protection Act: the Home Secretary had acted unreasonably in allowing the Security Service to refuse all requests for information via a blanket exemption from the provisions of S7(1)(a) of the DPA and respond with a NCND reply to all requests made under this section. (33)

    Individuals should now be able to access their files if the Security Service deems that the release of the information will not damage national security. (34)

    The Information Tribunal's ruling in the Baker case said:

    'The certificate........exempts the Service from the requirement under s7(1)(a) of the Act to inform the Appellant whether or not his personal data are being processed by it.....The Appellant, supported by the Information Commissioner, accepted - rightly in our view - that the NCND policy is justified in relation to s7(1)(a) requests.....in all cases where the Service lawfully determines that a positive response would be harmful to national security......the Appellant and the Information Commissioner contended that the Minister did not have reasonable grounds for issuing the certificate in such wide terms, which could permit the Service to give the NCND reply even in cases where a positive response would not be harmful to national security.....Our decision in this appeal is concerned only with the duty of a data controller under s7(1)(a) of the Act to inform an individual by whom a request is made whether or not his personal data are being processed......We therefore have addressed the narrow issue: did the Minister have reasonable grounds for issuing the Certificate in terms which exempt the Service from the obligation to respond positively to any request made to it under s7(1)(a) of the Act, regardless of whether or not national security would be harmed by a positive response in a particular case? We have concluded..... that the Minister did not have reasonable grounds for issuing the Certificate which has this unnecessarily wide effect.....We therefore, in the exercise of our discretion under section 28(5) of the Act, quash the Certificate dated 22 July 2000. This does not prevent the Secretary of State from issuing a Certificate in different terms which might be deployed in answer to the Appellant's request, whether directed specifically to that request or not, and the validity of which could be determined, if an issue arises, in separate proceedings.' (35)

    New certificate issued by MI5

    On December 10 2001 the Home Secretary, David Blunkett, signed a new certificate, which takes account of the Baker judgment and should mean that individuals will be able to access their MI5 files if the Security Service deems that their release in this particular case, will not harm national security. The new certificate (referenceDPA/s28/TSS/2), like the previous one, starts by stating :

    By section 28(1) of the Data Protection Act 1998 (the Act) it is provided that personal data are exempt from any of the provisions of (a) the data protection principles; (b) Parts II, III and V; 36 and (c) section 55 (37) of the Act if the the exemption from that provision is required for the purpose of safeguarding national security; by subsection 28(2) it is provided that a certificate signed by a Minister of the Crown certifying that the exemption from all or any of the provisions mentioned in subsection 28(1) is or at any time was required for the purpose there mentioned in respect of any personal data shall be conclusive evidence of that fact; by subsection 28(3) it is provided that a certificate under subsection 28(2) may identify the personal data to which it applies by means of a general description and may be expressed to have prospective effect.

    However, the new certificate, issued after the Baker judgment, then goes on to say:

    2. And considering the potentially serious adverse repercussions for the national security of the United Kingdom if the exemptions hereafter identified were not available. And for the reasons set out in document referenced DPA/S28/TSS/2-REASONS, (38) in summary that: (2.1) The work of the security and intelligence agencies of the Crown requires secrecy. (2.2) The general principle of neither confirming nor denying whether the Security Service processes data about an individual, or whether others are processing personal data for, on behalf of with a view to assist or in relation to the functions of the Security Service, is an essential part of that secrecy (2.3) In dealing with subject access requests under the Data Protection Act 1998, the Security Service will examine each individual request to determine: i) whether adherence to that general principle is required for the purpose of safeguarding national security; and ii) in the event that such adherence is not required, whether and to what extent the non-communication of any data or any description of data is required for the purpose of safeguarding national security (2.4) The very nature of the work of the Security Service requires exemption on national security grounds from those parts of the Act that would prevent it, for example, passing data outside the European Economic Area and that would allow access to the Security Services premises by third parties.

    The certificate, like the previous one, goes on to describe and list comprehensively the types of personal data processed by the Security Service that are exempted from the DPA's provisions, 'all for the purpose of safeguarding national security', but the Baker judgment is reflected in the new certificate where it says:

    ....provided that: (i) no data shall be exempt from the provisions of section 7(1)(a) of the Data Protection Act 1998 if the Security Service, after considering any request by a data subject for access to relevant personal data, determines that adherence to the principle of neither confirming nor denying whether the Security Service holds data about an individual is not required for the purpose of safeguarding national security; (ii) no data shall be exempt from the provisions of section 7(1)(b), (c) or (d) of the Data Protection Act 1998 if the Security Service, after considering any request by a data subject for access to relevant personal data, determines that non-communication of such data or any description of such data is not required for the purpose of safeguarding national security.

    Similar certificates, signed by Jack Straw, Foreign Secretary, on behalf of GCHQ and MI6, were issued on 8 December 2001. The earlier certificates, signed in July 2000, were withdrawn and revoked the same day in the wake of the Baker judgment and prior to an appeal hearing of the Information Tribunal, in a case where Mohamed Al Fayed was, among other things, challenging both MI5 and MI6 certificates. (39)

    A Policy Change?

    Although the new certificate opens the way for the Security Service to release personal data where it believes that national security will not be harmed, whether this will happen to any significant extent remains to be seen. The assessment of possible harm to national security will still be made by MI5. In Parliament, David Blunkett, Home Secretary, said, after referring to the new certificate:

    'I have placed a condition on the Security Service to report to me on their use of the certificate....In perhaps the great majority of cases the service will need to rely on the section 28 exemption to avoid damage to national security. That will include use of the long established neither confirm nor deny approach.....In response to a subject access application, the service will, consistent with section 28, consider whether the neither confirm nor deny approach needs to be followed, and, if not, to what extent the withholding of all or some information is still necessary to safeguard national security.' (40)

    Should a subject access request made since the new certificate was issued produce the same response as before - no data or insufficient data, and a reference to the exemption authorised by the new certificate - then the individual must take the same path as Norman Baker and challenge the new certificate, and whether it has been issued reasonably, before the Information Tribunals National Security Appeals Panel. The Tribunal could, conceivably, judge the new certificate to have been issued unreasonably and quash it.

    Malcolm Kennedy made a further subject access request to the Security Service after the new MI5 certificate was issued. In reply, Kennedy was told:

    It has been determined that the Security Service holds no personal data to which you are entitled to have access, except that which is enclosed with this letter.

    These consisted mainly of references to Kennedy's correspondence concerning his subject access requests; however, one reference is an extract from a letter 'between officials' dated August 29 2001, and concerning Kennedy's application to the Investigatory Powers Tribunal. It says:

    If no warrant, certificate or authorisation exists or you are happy that your organisation has taken no unauthorised action against this person, please send written confirmation of this.....

    This response is interesting because it indicates that there has been some shift in policy on the release of personal data at MI5 since the Baker judgment and the new certificate. An earlier subject access request by Kennedy to MI5 in July 2000 resulted in no information being released. It is also interesting that the tribunal asks for confirmation if no warrant etc exists, rather than asking if one exists. The letter goes on to say:

    This response should not be taken to imply that the Security Service does or does not hold any further data about you. As you are aware, a right of appeal exists under s28 of the Act......A certificate relating to the work of the Security Service was signed by the Home Secretary on 10 December 2001. Any person directly affected by the issuing of the certificate may appeal against the certificate to the Information Tribunal. It is also possible to appeal on the ground that the data that is sought does not fall within the scope of the certificate. (41)

    Kennedy, who has been trying to obtain answers to his questions from many different authorities for several years, says he feels that he has come up against a bureaucratic wall.

    Thanks for information to Dr David Turner.

Notes

1 See Lobster 39, Summer 2000, pp. 7-9, 'A Most Extraordinary Case' and Lobster 41, Summer 2001, pp. 5-9, 'The Malcolm Kennedy Case - Update'.

2 This is being written in May 2002.

3 www.legislation.hmso.gov.uk/acts/acts2000/20000023.htm

4 Under transitional arrangements, the other tribunals continue to exist for complaints before 2 October 2000, when the RIPA and the Human Rights Act 1998 (HRA) came into force.

5 Charles Clarke MP, then Minister of State, Home Office, at the Standing Committee on delegated Legislation, which considered the IPT Rules, (SI 2000 No 2665), 30 October 2000, www.parliament.the-stationery-office.co.uk/pa/cm199900/cmstand/deleg1/st001030/0 1030s01.htm

6 The Tribunal members are listed at www.homeoffice.gov.uk/pubapps/ipt.htm They are: Lord Justice Mummery (President); Sir Michael John Burton (VP); Sir David Calcutt; William G Carmichael; Sir Richard Gaskell; Sheriff Principal John C McInnes; Peter Scott; Robert Seabrook (all appointed October 2000 for 5 years); Sir John Pringle (appointed June 2001).

7 Report of the Chief Surveillance Commissioner for 2000-2001, Jan 2002, www.official-documents.co.uk/document/cm53/5360/cm5360.pdf

8 The Interception Commissioners functions (RIPA s57(2)) include keeping under review the exercise by the Secretary of State of his powers in relation to lawful and unlawful interception and the issuing, cancelling and renewing of warrants; the exercise of powers in relation to the acquisition and disclosure of communications data; and powers in relation to the investigation of encrypted data

9 The Intelligence Services Commissioners functions, set out in RIPA, s59(2), include keeping under review the exercise by the Secretary of State of his powers to issue, renew and cancel warrants for entry or interference with property or with wireless telegraphy, under s5-7 of the Intelligence Services Act 1994; and to keep under review the exercise by the Secretary of State of his powers and duties under Part II of RIPA in relation to the activities of the intelligence services - MI5, MI6 and GCHQ.

10 RIPA s61

11 The body established under the Intelligence Services Act 1994 to examine the expenditure,administration and policy of MI5, MI6 and GCHQ.

12 ISC Interim Report 2000-01 presented to Parliament in March 2001, www.archive.official-documents.co.uk/document/cm51/5126/5126.pdf and (in text) www.ccc.de:8080/mirrors/cryptome.org/uk-cm5126.htm

13 House of Commons Hansard, 29 March 2001, column 1150

14 http://www.publications.parliament.uk/pa/cm200001/cmhansrd/vo010329/debtext/10329-17. htm #10329-17_spnew2

15 Personal communication, May 2002

16 The Investigatory Powers Tribunal Rules 2000, http://www.hmso.gov.uk/si/si2000/20002665.htm

17 These govern the tribunal jurisdiction set out in RIPA s65(2) (a) and (b): proceedings bought under the Human Rights Act 1998 s7 and all complaints against the intelligence services and public authorities in respect of the use of powers in RIPA

18 Lords, Hansard, 27 October 2000, column 646

19 www.parliament.the-stationery-office.co.uk/pa/cm199900/ cmstand/deleg1/st001030/ 01030s01.htm

20 Under RIPA s69(4)(c)

21 Under the Interception of Communications Act 1985, (since repealed by RIPA), the ICT were limited to examining whether there was a relevant warrant, and, if so, whether there had been any contravention of s2-5 of IOCA, which dealt with the issuing renewal and duration of interception warrants

22 It is unlawful for a public authority to act in a way incompatible with a Convention right; tribunals are made a public authority under HRA s6(3)(a). Article 6 states that everyone is entitled to a fair and public hearing.....by an independent and impartial tribunal.....but the press and public may be excluded from all or part of the trial in the interests of morals, public order or national security.

23 Guardian 17 August 2001

24 Guardian 17 and 18 December 2001.

25 Hansard 19 December 2001, col 367W

26 The Interception Commissioners first report (October 2001) states that the IPT received11 new applications from the day of its formation on October 2 2000 to the end of December 2000.

27 Were such an appeal to be available, the higher courts - High Court, Court of Appeal and House of Lords - are able to make a declaration of incompatibility where they find that a provision of legislation is incompatible with a Convention right. It is then up to Parliament to amend the legislation

28 Liberty briefing for House of Lords second reading, RIP Bill, May 2000, says: There should be an express statutory right of appeal from the Tribunal to the High Court on a point of law.

29 DPA S 28 (2)

30 MI5's was signed on 22 July 2000 by Jack Straw, then Home Secretary; GCHQ's was signed on 30 July 2000 by Robin Cook, then Foreign Secretary.

31 DPA 1998, schedule 6 Info on the Information Tribunal and National Security Appeals Panel at www.lcd.gov.uk/foi/inftrib.htm

32 In cases involving s28(6) the tribunal does have a remit to consider whether the data in question is covered by the certificate. As yet no appeal has been heard on these grounds.

33 DPA S7(1)(a): an individual is entitled 'to be informed by any data controller whether personal data of which that individual is the data subject are being processed by or on behalf of that data controller'.

34 For Liberty's press release on the Baker case, 1 October 2001, see www.liberty-human-rights.org.uk

35 The Information Tribunal National Security Appeals Panel ruling in Norman Baker MP v Secretary of State for the Home department is at www.lcd.gov.uk/foi/bakerfin.pdf

36 Subject access; notification and enforcement provisions

37 The offence of unlawfully obtaining or disclosing personal data

38 A statement of the reasons for issuing the certificate; in House of Commons library.

39 Judgment in Mohamed Al Fayed v The Secretary of State for the Home Dept and Secretary of State for Foreign and Commonwealth Affairs www.lcd.gov.uk/foi/alfayedfin.pdf

40 Hansard, 22 January 2002, col 842W

41 Letter from Security Service to Malcolm Kennedy, 20 February 2002, in response to a subject access request made after the issuance of the new certificate.