Why DRIP matters

Today the government is going to force the Data Retention and Investigatory Powers (“DRIP”) Bill through the House of Commons.

The intention is that it will be an Act of Parliament by the end of the week.

Why should this matter?

And what is worth looking out for?

First, the DRIP Bill is not really “emergency” legislation.

Part of it (though not the majority of it) has been occasioned by a decision of the European Court of Justice (the EU court, not the ECHR court) in April.  The effect of that decision is that the UK’s legal regime for insisting that communications companies retain data became vulnerable to legal challenge.  So one thing DRIP is doing is shifting the legal regime from regulations made under the European Communities Act to a new Act of Parliament.  This shift should keep the relevant law safe(r) from being quashed by a UK court for non-compliance with EC law.

Note the dates: an April ECJ decision with a time-lag of three months before the government decides it is an “emergency” needing legislation made in a week.

In fact, this legislation could (and should) have been brought forward in the last three months and not the week before Parliament goes into recess.

But even taking this (supposed) emergency at its highest, the majority of DRIP has nothing directly to do with the April ECJ decision at all.

Most of DRIP is not about data retention (the “DR” of the acronym) but investigatory powers (the “IP”).

What the government has done is slip in on the pretext of “emergency” legislation substantial changes to a separate but related area of law: interception warrants.

In essence, interception warrants are legal instruments which the government serves to obtain content from service providers.

What DRIP does is to expand the scope of interception warrants in two significant ways.

First, clause 4 of DRIP makes interception warrants enforceable against non-UK entities as well as UK entities.

So what?

Well, this matters because unless the interception warrants are enforceable against non-UK entities there is no actual obligation for non-UK providers to provide the information requested.

In practice (until the Snowden revelations), non-UK providers routinely provided the information requested. A mere interception warrant was enough.  But more recently the non-UK providers – and especially their compliance departments – have become more jumpy, and they are insisting on the practice of providing information be given an actual legal basis.

What this means, of course, is that the current practice  of non-UK  providers actually has no legal basis.  It is unlawful.  They may co-operate with the warrants, but they cannot say they are compelled to do so.

The effect of Clause 4 of DRIP is to make any non-UK providers which do not provide information with an interception warrant subject to the same (potential) coercion of civil and criminal sanctions as UK-providers.

This is not because any  non-UK providers are threatening to withhold information – they want to co-operate – but they need to be able to point to a law saying they have to do so.

As such, clause 4 is really about the convenience of corporate interests.  Put crudely: they want their arses covered, and the government is using an emergency legislative procedure to enable them to have this pleasure.

Second, clause 5 of DRIP expands the relevant definition of “telecommunications service” for interception warrants to include, “any case where a service consists in or includes facilitating the creation, management or storage of communications transmitted, or that may be transmitted, by means of such a system“.

What does this mean?

And, more importantly for any key legal definition, what does it not mean?

Well, I am a communications lawyer, and I am as bewildered as you are.

The intention of the government is that this will now cover web-based email – gmail and hotmail and others.  But it could mean almost anything on the web: things stored on the cloud and so on.

Again, the real intention here is corporate arse-covering: this is information which is no doubt provided already in practice, and the post-Snowden compliance monitors are insisting that there is a sound legal basis for this information to be requested.

There may be a political case for the expansion of the legal scope of interception warrants as envisaged by clauses 4 and 5 of DRIP.  But the proper process for this is for there to be consultation and then the anxious scrutiny of all the provisions, as part of a Bill being dealt with in the normal way.

There is no case at all for these provisions to be forced through at break-neck speed.  Clauses 4 and 5 are not even connected to April’s ECJ decision; there is no good reason at all for them to be in DRIP.

If MPs and peers are responsible law-makers then they should insist that clauses 4 and 5 are removed so that they can be carefully considered.  Alternatively, MPs and peers should also insist on a “sunset” clause repealing the “emergency” Act in six months (not in two or so years as currently envisaged) so that there can be proper consideration on a non-emergency basis.

Detailed legislation extending the rights of the government to interfere with individual rights should be properly examined scrutinised, and the interests of all those affected should be balanced in public debate.  It should not be rushed legislation to appease the compliance departments of  international corporations.

Under clauses 4 and 5, the UK government will be able to legally insist on more data than ever before from corporations around the world; such significant amendments should not be done in a hurry.

And all because this may well be the current practice (that is, without a lawful basis), this is no good reason to make lawful something which is unlawful – and certainly not without careful deliberation.  This not “clarifying” a legal “grey area” – it is changing the law to turn something black in to something white.

This week will see whether Parliament is able to check a government misusing emergency legislation to substantially change the law on interception on the irrelevant basis of an April decision of the ECJ.  There is “all party” support.

There is a lot at stake: this is an area where the law has to be got right.  Bad law imposes illiberal burdens, and bad law may not be enforceable or may not have the intended effect.

By forcing through this legislation without proper consultation and scrutiny it is the government which is acting irresponsibly – and not the Bill’s critics.

Leave a Comment