Draft Regulation of Investigatory Powers (Scotland) Bill
I bring the meeting to order. People are still coming back, but I want to get cracking, as we have kept Professor Miller waiting for an inordinately long time. As he was a member of the consultative steering group, he has a professional, perhaps fatherly, interest in how matters are progressing, even if he is not directly involved in them.
I welcome Professor Miller and thank him for being patient enough to listen to our discussion. We now have to do one of our many mental leaps and return to the draft regulation of investigatory powers bill. Unfortunately, because we had originally invited the Minister for Justice to give evidence this morning, we had arranged the agenda so that his evidence on the two issues would be back to back. If we had realised in sufficient time what would happen, we might have changed things to give you a shorter wait and us a shorter jump.
I invite you to make a short opening statement. It will be useful if you set out your overall view of the draft Scottish bill, but we expect that you will have to refer to the UK bill. Because there are two bills, it will be helpful if members make it very clear which bill they are talking about; otherwise, we will get into a mess.
Professor Alan Miller (Scottish Human Rights Centre):
Given the morning that you have just had, the last thing that you want is for me to say that, on the one hand, the bill is not that bad but, on the other, it is not that great. However, that is often all that one can say about certain things in life.
On the one hand, I do not think that the draft bill deserves excessive criticism. It should be welcomed. Its stated aim is to provide a legal framework for police surveillance to attempt to achieve ECHR compatibility, so it will be an improvement on the present situation. I think that that is recognised by everyone. The draft bill tries to find a fair balance between individual privacy rights and the public interest.
On the other hand, we all know that, to all intents and purposes, this is a UK bill. We should be aware that the UK has a poor record on the issue of surveillance and ECHR compatibility. Members should also be aware that the ECHR is really only a safety net; it is the lowest common denominator among the states of the Council of Europe. By no stretch of the imagination could it be considered a lofty aspiration or the highest standard for the protection of human rights in its jurisdiction that a country could attain. Therefore, a certain amount of vigilance is required over the bill.
A central question that concerns the committee and the Parliament is whether the Scottish part of the bill is compatible with the ECHR. In the time that you have to consider the draft bill, how do you begin to determine whether it is compatible? At face value, it is arguable that the draft bill could be interpreted in a way that is compatible with the ECHR. That may not be enough to satisfy the test of compatibility. I will explain why not, and give the reasons why we have to scrutinise this or any other bill from an ECHR perspective.
The European convention on human rights is case-driven. It deals with the facts and circumstances of cases that come before a court. It deals not necessarily with the fine print of legislation, but with how legislation is applied in the real world once it is passed. You may want to pay attention to the question of whether the draft bill is sufficiently clear. For example, does it give adequately defined grounds for lawful surveillance so that it will prevent the police from arbitrarily breaching privacy rights under article 8? Will it be enough to prevent the police breaching article 8 by acting disproportionately—operating surveillance when it is not strictly necessary?
The real test of compatibility is to anticipate how the legislation will be applied in real cases and whether the courts will be satisfied that the legislation was sufficient or whether it was too broad and allowed too much discretion and potential abuse by the state. I think that there may be room for concern that, in parts, it is too broad, too vague and there may be inadequate procedural safeguards. Therefore it may lack the quality of law required to make it compatible with the ECHR.
For example, I refer members to section 6 on intrusive surveillance. Under section 6(2)(a), the ground for authorisation to be given is
"for the purpose of preventing or detecting serious crime".
What is serious crime? Section 27(6) states the definition of serious crime. Section 27(7)(b) states
"that the conduct involves the use of violence, results in substantial financial gain"—
and this is the important part—
"or is conduct by a large number of persons in pursuit of a common purpose."
Is there a potential danger that that definition could be open to an interpretation that could lead to intrusive surveillance of, for example, trade unionists involved in industrial action or of environmental protesters on some cause or another who may be doing no more than peacefully protesting, may be engaged in lawful conduct and have no criminal purpose? They would be doing no more than exercising their human rights under article 10 of the ECHR on free speech or article 11 on freedom of association. That is a potential danger because of the inadequate definition.
Although I recognise that we can only deal with the Scottish part II of this bill, it should be said, in passing, that a similar problem may exist in the UK bill. It will apply to Scotland to a certain extent when agencies such as HM Customs and Excise, the Ministry of Defence and the security services carry out surveillance under the UK bill in Scotland. They have wider grounds, which would include national security and the economic well-being of the UK. That definition may also be too broad and open to a certain amount of abuse. It might provide more of a safeguard if serious crime was better defined and dealt with criminal offences that relate to national security, such as espionage, terrorism and conspiracy. The economic well-being of the UK might be more strictly defined to include criminal offences such as fraud, embezzlement, counterfeiting and so on. Adequacy of definition is one area of concern that members might want to consider.
The other two points that I will make are on the adequacy of procedural safeguards. First, it may not be strictly necessary under the ECHR, but the Strasbourg court's case law is clear that it is preferable, and safer, to have a greater degree of independent control over the authorisation procedures, especially as the more serious the interference with someone's privacy and the more intrusive the surveillance, the more stringent the safeguards will be required to be.
Section 10 of the draft bill relates to the authorisation required for intrusive surveillance. That surveillance is not allowed to take effect, other than in emergency situations, before it has been approved by a surveillance commissioner, because it is so intrusive—more so than other forms of surveillance, which are called directed surveillance. It may be a problem, in the real world, when this begins to operate, as some forms of covert human intelligence sources involve, for example, infiltration by undercover agents who befriend someone to find out information and engage in their conduct. They engage in the person's conduct as part of their investigation. There is a scale. We could anticipate cases where a very severe form of interference with privacy may take place, which might well be sufficient to mean that there should be some degree of similar protection.
A surveillance commissioner should be required to authorise that form of covert human intelligence investigation. For example, if one of your constituents is a drug dealer and an undercover agent is sent to befriend the person and get information, it is quite obvious that this is done and, if nothing comes up, that is fine. However, the person may be innocent. The police may have had misinformation or may be targeting this person for other reasons. It could be such an intrusion to find out all sorts of intimate information about that person's relationships, their families and their business that it would be safer and inspire more public confidence if a degree of authorisation was required by a surveillance commissioner.
I have a second point on the adequacy of the safeguards. This may not be strictly necessary under the convention, but the convention is only a safety net. Without greater judicial control and without prior authorisation from commissioners for the more serious forms of surveillance it might be more difficult to gain public confidence, especially in the light of the fact that there is no provision in the bill for subsequent notification to be given to an individual after the event that he or she has been subject to surveillance. It may well be that, when such notification could be given without it jeopardising the objectives of surveillance, it might reduce the element of chance in the matter. If the person accidentally finds out, through a leak or a cock-up, that they have been subject to surveillance, only then can they challenge the lawful nature of that surveillance and make a complaint to the tribunal. It may well be that some thought should be given to notification after the event.
There must be a balanced approach. Let us say that a drug dealer is subject to this form of surveillance and nothing comes up, but the police are still suspicious. You could understand that they would not want to be under a compulsion to notify that drug dealer, "By the way, we did not get anything for the past three months, but we have to tell you now." That would clearly not be in the public interest. However, it might be a trade unionist, a Greenpeace activist or an ordinary citizen about whom a lot of information had been obtained and there was no basis for the surveillance. This person was a completely innocent constituent. Is there not an issue that they should be made aware that they had been subject to surveillance? Not only should information that came up be destroyed, but the lawfulness of it should be retrospectively challenged by that constituent to ask, "Why was I put under surveillance in the first place?"
I ask the committee to accept that my comments are preliminary. We are all in the same position. There will be a conference on 13 June at which colleagues and I, having had more time to consider those proposals, will examine in more detail the ECHR compatibility of this bill. I hope that, by then, we will have some idea of the practice in other countries in Europe and beyond. The convener of this committee has been invited to take part in that. I hope that 13 June is not too late and that the committee's chance to make informed comment will not have passed. That will be a useful forum for a more detailed consideration with regard to compatibility.
I am a bit perturbed to hear Professor Miller's comment that the UK has a poor record in this. Given the number of people who come to the UK to seek refuge, such as asylum seekers, it would seem that the UK must have a pretty good record. Why did you make that comment?
Because of the hard evidence from cases that have been taken to the European Court of Human Rights in Strasbourg from the UK. Those cases have led to this bill being introduced and to the bill repealing parts of the Interception of Communications Act 1985, which was the result of a UK case that was lost at Strasbourg.
There was a case last year, from Britain, when the police drilled a hole in a wall and placed a bug so that they could listen to the conversation in a neighbouring house. That was done according to secret Home Office guidelines. That was claimed to be a breach of article 8 of the convention, and the case was upheld when it was taken to Strasbourg. That is part of the reason why we are now sitting round discussing the draft bill.
Back in the 1980s, there was a similar case—that of Malone—which resulted in the introduction of the Interception of Communications Act 1985, tribunals and so on. The track record of the European Court of Human Rights in Strasbourg is there for all to see, and it has found that Britain has not complied with the convention in this area on several occasions. Britain is not alone—other countries are also in that position—but the UK does not have a very proud record.
I suggest that, given the sensitivity of the subject, that is probably quite a good record, if the UK has been taken to the European Court of Human Rights on only one or two occasions. Perhaps other countries are not quite as open as the UK is in relation to these measures.
That apart, you referred to lack of quality in the law, and to the fact that human rights are all important. When you talk about human rights, how do you balance those of the vast majority of citizens who never fall under the finger of suspicion with those of people of whom there is good reason to be suspicious and for whom the draft bill is designed, with respect to intrusion into their affairs?
The ECHR provides precisely that—it provides for the idea of proportionality. One must have a reasonable balance between the public interest—the aim that one is trying to serve, such as prevention of crime and so on—and the privacy rights of the individual. That is the quality of the democracy in which we all want to live. States have the task of finding that balance, which is then tested by the courts in accordance with the convention. The convention is a balancing exercise—it is a framework within which balance is addressed.
What are the principal changes that make the draft bill different, in your mind, from existing practice?
The minister made fair comment this morning. The draft bill will not give the police greater powers. Rather, it will regulate those powers in a framework that attempts to be compatible with the ECHR and, to a large extent, I think that it will be compatible. That is why I say that, on the one hand, the draft bill should be welcomed, as it is an attempt to improve the situation and, in significant areas, it does so. However, there is still room for some concern as to whether the draft bill has the necessary qualities of being sufficiently strictly defined and of containing enough procedural safeguards, such as having a greater involvement of judicial authorisation in particular.
In that context, the draft bill is, undoubtedly, a step forward.
I am grateful to you for your paper, much of which you have addressed, and for your comments on how people know that they are under surveillance. Phil Gallie appears to be quite content with that, but I am clear that I have been under surveillance at some point. My telephone lines in the Parliament have been investigated, and I still await a satisfactory explanation. Yes, Phil—some of us are worried about surveillance, not just of organisations but of political parties.
Professor Miller, you remarked that the provisions of the draft bill, in regard to groups of people for example, were vague and fluffy. What do those provisions mean? There are grave concerns about that.
I want to raise the issue of codes of practice. While that issue may be a red herring, would it be relevant for us to have sight of the codes of practice along with the bill, given that they have statutory import?
Yes, I think so. While I might have picked up the minister's comments wrongly, I think that he confirmed that Parliament would be able to scrutinise the codes of practice. They are important because it would be difficult to have enabling legislation without seeing how it is to be applied in the real world. That is what the nub of the test will be. If the legislation that provides for those codes of practice is too vague and too broad, the potential for abuse exists.
For example, one case—not from the UK—that went to the European Court of Human Rights involved the bugging of a lawyer's telephone line. His line was bugged not because he was suspected of anything—my goodness—but because one of his clients was under suspicion. Much of the confidential discussion that the lawyer had in the course of his professional practice then became known to the state and, therefore, confidentiality was breached. While the relevant legislation said that it would respect the confidentiality of professionals and so on, there were no mechanisms, regulations or codes that sorted out how that confidentiality would be respected. How does one discriminate between a conversation that should be known to the state and one that should not be? That is why codes of practice are important.
We have been given a time scale of six to eight weeks for the codes of practice; we must see them when we are considering amendments to the bill at stage 2.
Yes.
On the Scottish human rights—not, not Scottish. I think that I am inventing it, although that would not be a bad idea. On a Scottish human rights commission—
Do you mean the Scottish Human Rights Centre, or—
Professor Miller's paper says:
"Canada, Australia and, close to home, Northern Ireland and soon the Republic of Ireland have human rights commissions to assist legislators and the public in this respect and a decision is still awaited as to whether there is to be a Scottish Human Rights Commission".
Do you think that this kind of legislation will operate properly only if we have a Scottish human rights commission?
With hindsight, many people will agree that, when we embarked on constitutional change—the Scotland Act 1998 and the ECHR—we should have established an independent, authoritative human rights commission, which could give independent advice to the Executive and identify problems in advance. It could also be a resource for Parliament in situations such as we are facing with the draft bill, and for local authorities, which, come October, will have to ensure that their actions are compatible with the ECHR and which will want to know what best practice is. Not least, it could be a resource for the public, who have been left out of the debate. Inevitably, public authorities tend to look after their own houses and to get them in order. However, the public have not been given any real understanding of the significance for them of the rights that they are being given under the Human Rights Act 1998.
Therefore, the experience of other countries, such as Canada and Australia or, closer to home, Northern Ireland, is that a commission is indispensable when undertaking constitutional change. Certainly, the United Nations recommended that such a commission should go hand in glove with constitutional change.
You made an important point when you said that people do not know when they have been under intrusive surveillance—Phil Gallie might have been for years. It is not good enough that one has somehow to stumble accidentally upon it. I understand that the role of a Scottish human rights commission in part would be to advise the individual, if the bill were to contain provisions to deal with that problem.
A delicate, difficult balance must be struck. For example, Germany has a subsequent notification procedure. A surveillance commissioner may think, "Well, there are still reasonable grounds to suspect that this person is involved in serious crime. We didn't get the information this time, so I'm not going to tip him off." That is a commonsense approach.
I understand that.
However, there might be other instances where it is clear that the person under surveillance is innocent and always has been. Their privacy has been interfered with, and that person can claim that they should have been made aware of the surveillance, and should be able to challenge that decision retrospectively.
I have three questions.
You referred to the conduct of
"a large number of persons in pursuit of a common purpose".
Surely one must read section 27(7) in the context of section 27(6). Section 27(6) refers to
"the crime that satisfies the test in subsection (7)(a) or (b)".
I understand precisely what you meant, but I can also see the other meaning that could be construed by reading those subsections together. Perhaps the bill should read "common criminal purpose" or, by deleting "common", should simply read "criminal purpose", such as a large number of persons who are conspiring to rob a bank, for example, or to plant a bomb or some such. Rather than it being a matter of principle, I think that it might be more a matter of drafting.
Do you have any views on the destruction of evidence after an authorisation has been found to be improper? My personal view is that such records should be destroyed—there should be an imperative to that effect, so that evidence is not left lying around when unsatisfactory authorisation has been granted.
Will you also address the question of redress? There is the tribunal, but I cannot find a process for redress. There could be serious circumstances in which someone is severely prejudiced. The bill does not give any indication of the proper process for recompense.
Those are significant points. One can look to other criminal law provisions on the destruction of evidence. If someone who has been arrested and prosecuted is DNA profiled, fingerprinted and all that, and is eventually acquitted, the evidence must be destroyed. That is part of the law. Why therefore should the same not apply? The same balance might have to be struck.
In making decisions, a commissioner should be under a stronger obligation to ensure that, if there is no on-going interest in a person or in maintaining the information and no other objective of the surveillance to be realised—as in the case of the drug dealer they did not get one time—the information is subject to destruction.
However, at the same time, we do not want to tie the commissioner's hands completely if there is a legitimate, on-going interest in a person. Simply because they did not get the information during the three months does not mean that the information they did get, which could assist later, should have to be destroyed.
I heard what was said about redress. I read somewhere—I think that it was in the UK bill—that the intention is that the tribunal will be given the powers under section 7 of the Human Rights Act 1998. That means that the tribunal will be given sufficient powers to provide a remedy to someone whose challenge is that their rights of privacy under the European convention on human rights have been breached as a result of surveillance. There are various claims, damages, findings and orders that the tribunal could make.
I have heard concerns that the nature of the tribunal is such that it might not be compatible with the ECHR, in the sense that its scope to assess whether surveillance was properly authorised is limited. The tribunal cannot examine the merits—the facts and circumstances—of a decision, only the procedure and the form that the surveillance took. That in itself might be a breach of article 6 of the convention, on the right to a fair and public hearing. The tribunal might be challenged if it cannot look into the meat of the decision rather than just checking that the proper procedures were carried out.
Forgive me if I have missed this in the UK bill, but if questions of redress sit in the UK bill, should they be repeated in the Scottish bill?
That is probably not necessary. The UK bill provides for the tribunal and the Scottish bill provides for access to that tribunal. I might be being too complacent, but I do not think that there need be a problem.
It is apparent to me that we should have had Professor Miller in before the Executive. That was a bit unfortunate. I found what he said very useful. It made me wake up to what the bill is really about. His evidence was very useful.
I have two questions. First, would cases where surveillance is authorised for one purpose, but information is found for another purpose—say, another crime is committed—be covered by the act, or is that covered by the rules of evidence?
The member touches on a point that was not explored this morning. If evidence is obtained as a result of surveillance and a person is subsequently prosecuted, and there is a request to introduce the evidence in court against the person, there are a whole range of issues about whether the evidence was lawfully obtained. The defence needs to know the details of the surveillance operation and about all the information that was obtained. There can be a challenge based on whether the surveillance should lawfully have been authorised in the first place.
We have concerned ourselves only with the immediate breach of someone's privacy rights, but there are other issues relating to the trial and the role played, for example, by an undercover agent. Mr Gallie raised a point about witnesses needing protection and being forced to be exposed in court. Other concerns have been raised about entrapment, for example, where an undercover agent induces someone to commit an offence that they would not otherwise have committed.
There was a case in Linlithgow a few months ago. It was a drugs bust in a club and an undercover woman agent induced someone to procure drugs for her. He was then charged and prosecuted. The court clarified the situation in Scotland with reference to the convention. When an undercover agent goes beyond passive information gathering and induces the target to do something that they would not otherwise have done, that is entrapment, which is a breach of the European convention. There are difficult judgments to be made in the course of surveillance operations.
I heard what you said about the UK's record. We will not examine that today, but it worries me, because the paragraph to which you drew attention uses the kind of language that could be used to justify, for example, the tapping of phones. There was one famous, high-profile case in which Ford, I think, tapped the union's phone because it was felt to be a matter of national importance, as the car industry set the rate for other workers around the country. I am therefore well aware that the UK's record has stretched the point quite a bit.
Notwithstanding what Euan Robson pointed out, why is that sentence in there? What was it designed to do?
The wording is open to interpretation and could be used to justify surveillance of people who might be involved in forms of protest, be they environmentalists or animal liberation activists. We are all familiar with such protest movements, which can on occasion result in criminal activity. The danger is that the wording is not defined strictly enough for us to be confident that the legislation will not be open to abuse once passed.
I am sorry. I was going to bring Phil Gallie back in, but I have just been advised that another meeting is booked for this room and that we have overrun our time. I am afraid that members will have to follow up questions with Professor Miller themselves. I did not know about the other meeting.
There were some petitions on the agenda—we will not be able to deal with them. I have asked for them to be put at the top of the agenda for the meeting on Monday afternoon next week. We will definitely deal with them then.
I thank Professor Miller. He will probably hear from us again.
Before everyone rushes off, I ask members to look at their diaries and let the clerk know when we can arrange the private meeting with officials from the finance department that the minister offered us this morning.
Meeting closed at 12:37.