My Lords, this is perhaps a fairly unique Second Reading, in that the Minister will be making the same number of speeches as the rest of your Lordships’ House. I apologise in advance for the fact that I will probably speak for longer than either the Minister has so far, or the noble Lord, Lord Pannick.
The primary purpose of the Bill is to permit a court in this country to require a person or company located overseas, such as an overseas service provider, to produce stored electronic information, as such a court could if the information were located or controlled in the UK. This is achieved in the Bill by creating a new overseas production order that has extraterritorial scope. However, this jurisdiction can be exercised only if an international co-operation arrangement or bilateral agreement enabling this to happen, and to which we are a party or in which we participate, has been agreed. UK law enforcement officers would apply to a judge for an order requiring the production of electronic evidence for the purposes of investigating or prosecuting serious crime, including terrorism offences. The effect of the overseas production order, if granted, would be to require an overseas provider to disclose electronic information held by them, provided that this is supported by an international co-operation agreement with the country concerned.
The present position in respect of electronic data that is outside the reach of domestic UK court orders and is needed for evidential purposes is that mutual legal assistance is available where a mutual legal assistance treaty has been signed. In 2016, the UK had bilateral mutual legal assistance treaties with some 40 countries and was also party to multilateral MLATs through bodies such as the EU and the Council of Europe. This present form of judicial co-operation means that a requesting country can seek assistance from an executing authority or country, and that authority or country is then responsible for collating the evidence using its own judicial or other processes and orders.
However, as the Minister said, the MLA process can be slow, requiring as it usually does significant government-to-government liaison, and may not be speedy enough in some cases to enable the evidence being sought to be obtained in the timespan required to contribute meaningfully to an investigation or help to secure a successful prosecution. Indeed, MLAT requests submitted to the United States take an average of approximately 10 months to complete. Sir David Anderson, the then Independent Reviewer of Terrorism Legislation, said in a 2015 report,
“there is little dispute that the MLAT route is currently ineffective”.
With electronic information becoming increasingly important in the investigation and prosecution of criminal offences, this is regarded as an increasingly serious lacuna in the pursuit of those committing serious offences, since the companies providing services that generate
or store electronic data or do both are often located outside this country. This means that the data they generate or store is currently outside the reach or range of the orders of our courts, which lack extraterritorial scope and cannot be used to require overseas providers to provide timely information.
The impact assessment for this Bill states:
“The issues with access to electronic data held by overseas providers and the use of MLA has been recognised for a while with discussions taking place between the UK and other countries to explore options to address the issues with the MLA process”.
We know from the impact assessment that one of those other countries is the United States, but which are the other countries with whom we have been discussing this issue?
Apparently our law enforcement and security agencies have indicated that US communication services are used by 90% of their suspects and that, in almost every terrorism investigation, those they investigate use services provided by US communications service providers. As far as the United States is concerned, the impact assessment tells us that a bilateral data access agreement is being finalised with the UK, but that,
“in anticipation and preparation for it, the US passed its Clarifying Lawful Overseas Use of Data (CLOUD) Act in March 2018, enabling the US legislative change required to give effect to this agreement”.
The CLOUD Act provides authorisation for a new form of international agreement to be concluded by the United States through which foreign Governments can seek data directly from US companies without such requests having to be reviewed individually by the US authorities. However, the CLOUD Act also requires that when the US concludes an agreement with another country, such as the UK, that country must allow the US reciprocal rights of data access.
Since bilateral agreements with another country or countries will need to be concluded for the provisions of this Bill to be implemented, presumably we shall be required to provide the same access arrangements to electronic data in this country as we are seeking from them—namely, that an order made in their courts will be capable, if necessary, of being enforced here with apparently little or no judicial oversight in this country. The Explanatory Notes say that the electronic data in question may include the “content of private communications” being made available to the state, and that:
“These intrusions into ECHR rights can be justified as necessary in a democratic society for the prevention of disorder and crime and in the interests of national security and public safety, and are proportionate in light of the requirements that must be met before a judge can make an overseas production order, and the other safeguards set out in the Bill. To the extent that the electronic data made available may include journalistic material, the requirement that an order is made by a judge provides prior judicial oversight for the exercise of the power, and accordingly an Article 10 compliant safeguard”.
Those words might not be accepted without question by everyone.
Clause 4 sets out the conditions and restrictions under which an overseas production order may be made. These include that the judge must be satisfied,
“that there are reasonable grounds for believing that an indictable offence has been committed and proceedings in respect of the offence have been instituted or the offence is being investigated”.
Alternatively, the judge must be satisfied that,
“the order is sought for the purposes of a terrorist investigation”.
According to the Explanatory Notes:
“This reflects the criteria under which production orders may already be sought against those in the UK”,
under the Terrorism Act 2000. The judge must also be satisfied,
“that there are reasonable grounds for believing that all or part of the electronic data”,
applied for will be of “substantial value” to the investigation or proceedings, and that it is “in the public interest” that this data is made available to the investigation or proceedings.
In considering whether something is in the public interest, the judge must consider the benefit to the proceedings or investigation that this electronic data is likely to have and,
“the circumstances under which the person against whom the order is sought has possession or control of any of the data”.
Further additional requirements that must be met in order for an overseas production order to be made can be specified by the Secretary of State through regulation under the terms of the Bill. Some of the factors on which the judge has to be satisfied before granting an order are potentially subjective, including whether an order being sought is for the purpose of what could be regarded as a terrorist investigation, whether the data being applied for will be of substantial value to the investigation or proceedings, and that it is in the public interest that the data is made available.
The UK has to be a party to an international co-operation agreement for the terms of the Bill to apply. However, will that arrangement or agreement with another country—and there could be up to 40—have to incorporate the same standards and criteria, and interpretation of those criteria, that would apply in our courts before making an order when a court in that other country makes an overseas production order for a British national or company based here to produce stored electronic data or give access to it? If that is the case—and the Bill has a potential problem if it is not—how will we be able to satisfy ourselves that the other country making such an order will, for example, be interpreting the requirements relating to “substantial value”, “public interest”, “terrorist investigation” and “excepted electronic data” in the same way as we would anticipate our courts interpreting those words in determining whether or not the case has been made for granting an overseas production order?
If we believe that a country with which we have an international co-operation agreement or bilateral agreement has not been applying an appropriate interpretation of the criteria for determining whether to make an overseas production order, can we step in and stop it being enforced against the named person or company in this country? If so, who or what body or authority in the UK can nullify the production order in question? If that cannot be done, is that not a potential concern about the proposed bilateral arrangements set out in the Bill, particularly as they are geared to giving greater speed to the process than the MLA route? Is there any right of appeal in this country against an overseas production order applicable here but made in another country with which we have a bilateral co-operation agreement?
If the Government’s view is that, under the new overseas production orders, there will be no change, in either direction, in the interpretation of the criteria or basis for making or declining overseas production orders for electronic data compared with the current mutual legal assistance arrangements, surely that cannot definitely be the case in the future, because at present it is the court in the country in which the order for electronic data has to be executed that makes the order, whereas under the new arrangements in the Bill it will be the court in the country where the order is being sought that will make the order and determine whether or not the case for the overseas production order has been established. What would be the position if the overseas production order for the electronic data in question was being sought in respect of a case or investigation where the outcome for a defendant, if found guilty, could be the death penalty, as might apply in the United States? Would we allow the electronic data to be handed over or accessed in such circumstances, as we would apparently be required to under the terms of the Bill and any bilateral agreement?
Can the Minister say within what timescale it is expected that overseas production orders will produce the required electronic data or access to it, compared with the time taken through the present mutual legal assistance process? While I appreciate that many service providers and technology companies in other countries, including the US, are likely to provide the electronic data being sought once the overseas production order has been made by a UK court—and, no doubt, vice versa as well—can she confirm what will happen if they decline to do so, since neither the US CLOUD Act nor any international agreement made under it would create a legal obligation for US service providers to comply with a data request from a foreign Government, including that of the UK?
The Explanatory Notes suggest that non-compliance with an overseas production order made by a UK judge could give rise to contempt of court proceedings but, if I am correct, some further detail from the Government as to how this course of action would in practice work and be effective in this situation would be helpful. Likewise, can the Government explain what action could or would be taken if a person or company in this country named in a production order from a country with which we have a bilateral agreement declined to hand over or give access to the electronic data sought under that order?
The Bill, as we know, seeks to provide a speedier alternative to the mutual legal assistance route in respect of electronic data by enabling UK domestic courts to issue a production order rather than, as now, requesting a foreign court to do so following an MLA request. Under the required international agreement with the country concerned, this would almost certainly be a two-way process. Under the current MLA process, first, how many orders have we been seeking per year in respect of electronic data which have required the assistance of another country under MLA in making and executing those orders, and from which countries have we required such assistance? Secondly, how many orders per year sought by other countries have we been asked to make and execute under MLA arrangements in respect of electronic data, and by which other countries?
What percentage of overseas orders in both directions under MLA are currently in respect of electronic data per year? What is the anticipated increase in each direction for orders for electronic data under the new arrangements for overseas production orders set out in the Bill, since the Explanatory Notes suggest that applications for overseas production orders for electronic data have been suppressed because of the time delay in executing such orders under the MLA process?
As the noble Lord, Lord Paddick, said, in April this year the European Commission published proposals for EU legislation to create a European production order as part of a package of measures on electronic evidence. The proposed European production order would allow a judicial authority in one EU member state to request electronic evidence directly from a service provider offering services in the EU and established or represented in another member state, regardless of the location of data. Where does the proposed European production order fit in relation to the new overseas production order process set out in the Bill? Do the Government intend to opt into the European production order measure or regulation? Finally, I say simply that while we support the objectives of the Bill, we want responses to the potential concerns we have raised about the possible application of its provisions.
4.24 pm