My Lords, I agree that this has been a very thoughtful debate. I hope that, at the end of this, the noble Baroness, Lady Chakrabarti, will not find me guilty of “Baroness-splaining”. This is such an important issue. As the right reverend Prelate pointed out, for young people, their mobile phones are their life and contain things that certainly their parents should not see, nor others either.
In Committee, I gave assurance that the Government were considering very carefully the Delegated Powers and Regulatory Reform Committee recommendation to the effect that provisions regarding the extraction of confidential information from electronic devices should be set out in the Bill rather than left to regulations, as Clause 42 currently provides. In our response to the DPRRC, which we sent to the committee last week, we confirmed that we accept the recommendation. Amendments 47, 49 and 52 to 55 make the necessary changes to Chapter 3 of Part 2 of the Bill to include provisions dealing with this issue.
These amendments are designed to ensure that additional safeguards will apply where an electronic device may contain confidential information, because authorised persons will be required to go through a separate assessment of the appropriateness of using the power where there is a risk that confidential information may be held on a device. To answer the question from the noble Baroness, Lady Hamwee, confidential information for these purposes includes legally privileged, journalistic and other types of protected materials, but I think that is what she suspected.
The noble Baroness, Lady Jones of Moulsecoomb, asked whether information extracted from a mobile phone would be disclosed to the defence. These provisions do not alter disclosure rules, which will continue to apply as now.
The amendments place an obligation on authorised persons to make a risk assessment, based on information that they have available, to decide how likely it is that they will come across confidential information on the device that they wish to examine. Having done so, they must turn their mind to the potential volume of confidential information held on the device and its potential relevance to the purposes set out in Clauses 36(2) and 40(2), for which the power can be used, in order to come to a view as to whether it is proportionate to use the power. This is intended to ensure particular consideration is given to the potential handling of inherently sensitive information. This will be reinforced by best practice guidance, to be set out in the code of practice under Clause 41. Authorised persons will be required to have regard to the code in exercising the powers under this chapter. We consider that this approach provides that balance between enabling extraction to go ahead in appropriate cases and safeguarding against improper access to confidential material.
Turning to the amendments in the name of the noble Baroness, Lady Chakrabarti, the House will recall that substantial changes were made to these provisions in Committee to further strengthen the safeguards for device users. These changes have been warmly welcomed by the Victims’ Commissioner. We believe, and I think noble Lords alluded to this, that any further issues can and should be addressed through the code of practice—more on that later—which will provide authorised people with detailed guidance on the lawful use of these powers.
Amendments 43 and 44 would afford a device user the option of observing the extraction taking place, unless that is impracticable or inappropriate. I can see the appeal of that, but different authorised people will have different tools available to them to carry out extraction, and these may be held in parts of a police
station or law enforcement premises where only members of staff can be present. It could also be held in third-party laboratories which are not equipped to host members of the public. We think that these restrictions will make this obligation impractical in many cases, and we do not think that an obligation to allow a device user to observe this process is workable.
Amendment 44 would also place a legal limit on the length of time that an authorised person can keep a device in their possession. Authorised persons already keep all devices for the minimum amount of time necessary, but the precise length of time is determined by a number of factors, and the officer to whom the individual gives their device gives an indication of how long this period will be. If for any reason this length of time changes, individuals are kept informed. I have highlighted in my notes that the rape review action plan makes clear our ambition to ensure that no victim is left without a phone for more than 24 hours.
Amendment 45 returns to a debate that we had in Committee about whether the necessity test in subsection (5)(c) of Clause 36 should use the language of “strict necessity”, as in the Data Protection Act, in these clauses. As I have said previously, the powers in Clauses 36 and 40 must be read alongside existing obligations under the Data Protection Act or, indeed, the UK GDPR. Looking at the requirements in more detail, Part 3 of the DPA 2018 contains specific provisions relating to processing personal data for a law enforcement purpose. The “law enforcement purposes” are defined, in Section 31 of that Act, as
“the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.”
To process personal data lawfully under Part 3 of the Data Protection Act, it must either be with the consent of the data subject or strictly necessary for a law enforcement purpose. In the case of the latter, one of the conditions in Schedule 8 to the Act must also be met. For example, the processing must be necessary for the protection of someone’s vital interests or necessary for the safeguarding of children or individuals at risk. The draft code of practice makes clear that “strict necessity” is the standard that must be met when exercising these powers for a law enforcement purpose and that “consent” is not an appropriate lawful basis.
The UK GDPR provides the regime that must be complied with for all other data processing; that is to say, processing for a purpose other than a law enforcement purpose. The regime is likely to apply where the powers are being used for the purpose of locating a missing person, protecting a child or an at-risk adult from neglect or physical, mental or emotional harm, or the investigation of death where there is no suspicion of criminal activity. It is not therefore appropriate to set one standard of data processing in these clauses where these different regimes apply. As I have previously indicated, the obligations under the DPA and the UK GDPR continue to apply, and we think that the code of practice is the appropriate tool to communicate these responsibilities to authorised persons.
Amendment 46 would remove the provision that allows for authorised persons to use these powers where other means of obtaining the information exist
but it is not reasonably practical to use them. It is necessary that this provision remains, as there may be instances where alternative means are available, but they require excessive resource—for example, either time or costs. The draft code of practice makes clear that the authorised person must assess whether other means available would be unreasonable in the circumstances and that delay alone is not sufficient justification not to pursue an alternative method unless there is a real and immediate risk of harm.
Amendment 48 would create a formal process for an individual to request a review from a senior officer of the necessity and proportionality of using the powers. We agree that all individuals must be given all relevant details about any requests for personal information and have included the obligation to share these details in writing. The data processing notice used by the police includes details of how to challenge a request, but, in all cases, individuals should be asked to volunteer their device and agree to the extraction of information from it only as a last resort, and requests must be necessary and proportionate.
As part of the rape review action plan, Thames Valley Police has begun a pilot to introduce the ability for victims in rape cases to request a review when the police make a request for personal information during the investigation stage. This is not confined to requests for digital evidence. We will continue to engage with interest with colleagues in the NPCC and Ministry of Justice who are working with Thames Valley Police. Following the pilot, if appropriate, we can address this issue further in revisions to the code of practice.
Amendment 50 in the name of the noble Lord, Lord Paddick, would ensure that the matters set out in subsection (3) of Clause 38 are explained to a device user orally as well as in writing. The clause requires notice to be given in writing to ensure that this information is formally recorded and can be referred to at a later stage of an investigation or inquiry if needed. We think that the code of practice is the best place to provide that additional guidance to authorised persons on how best to communicate this information to an individual before they agree to the extraction of information.
5.15 pm
The noble Lord, Lord Paddick, challenged whether there would indeed be no adverse consequences for a victim if they refused to allow access to their phone. He pointed to the scenario of the defence in a rape trial where consent was at issue seeking to draw an adverse inference if the alleged victim had refused to hand over his or her phone. These provisions in the Bill are not about what may or may not happen at trial. Any request to extract information from a device should be a last resort, and the authorised person must be satisfied that the request is necessary and proportionate. If a victim chooses not to provide agreement, we are quite clear that that by itself is not sufficient grounds for the police or CPS to stop the investigation. I think the noble Lord, Lord Carlile, alluded to that. As with any other evidence type, the investigator would continue to seek other evidence that may assist the investigation.
The provisions also require the authorised person to consider other less intrusive methods, and if the victim does not wish to provide their device but the investigator believes there is relevant evidence on it that would progress the investigation—for example, text messages or emails—the police can use other powers, such as those contained in PACE, to obtain the suspect’s device and extract information from it. We see far too many victims withdraw from an investigation at an early stage, especially in rape and sexual offences cases, and while victims already have the right to refuse to agree to provide their device, the Bill seeks to ensure that victims are aware that they have that right. We expect that, as a result of the powers and safeguards we are introducing to ensure all requests are necessary and proportionate, more victims will feel confident reporting these terrible crimes in the confidence that a refusal to provide a device will not automatically stop the investigation.
The noble Lord, Lord Ponsonby, separately raised the issue of third-party material, which is the subject of Amendment 52A. As I said in Committee, the Government recognise that there is a real issue with requests being made for third-party material relating to victims, which sometimes cannot be justified as relevant to a reasonable line of inquiry. Unjustified and intrusive requests can have a significant impact on the confidence of victims who report sexual offences and may put off more from doing so.
I am very grateful to the Victims’ Commissioner and her team for suggesting an amendment to this Bill, but we do not think that we can simply apply the legislative framework relating to extraction of information from electronic devices to third-party material. Although we agree that these clauses provide key principles that could apply to investigators requesting third-party material, access to such material is a broader issue. We need to consider very carefully, in consultation with partners, how a legal framework could operate.
None the less, the Government recognise that legislation may well be part of the solution, and I can commit to actively exploring statutory options. While we consider such options, the police and the CPS must prioritise non-legislative solutions to ensure that practice among investigators and prosecutors improves sooner rather than later, as it is critical that requests for third-party material are necessary and proportionate and form part of a reasonable line of inquiry.
I thank again all those who contributed to the shaping of these provisions, particularly the Victims’ Commissioner and others representing the views and needs of victims, such as the organisations that the noble Baroness, Lady Chakrabarti, mentioned. In addition to strengthening the safeguards that appear in the Bill, including now in relation to confidential material, I again remind the House that the exercise of these powers will be supported by a code of practice which will be the subject of a formal consultation once the Bill achieves Royal Assent. This will provide that further opportunity for interested parties to contribute to the guidance that will govern the daily use of the powers, and I encourage them all to participate.
I say formally that, as part of the consultation, I shall be very pleased and ready to meet the noble Baroness, Lady Chakrabarti, and the organisations
that she mentioned today to hear their views first-hand, because it is very important that we get this right. I shall ask my office to set up such a meeting following the launch of the consultation.
In conclusion, I hope noble Lords agree that we have the balance right at this stage between the safeguards to appear in the Bill and the matters that are appropriately addressed in the accompanying code of practice. I hope, on that basis, and on the understanding that we continuing to examine the issue of third-party material, the House will support the government amendments in this group and be content not to move other amendments.