Lord Anderson of Ipswich (CB)

My Lords, the amendments in this group are designed to probe a proposed extension of counterterrorism and national security powers, usable only at ports, airports and places near the land border with Ireland, that are among the very strongest of all those powers vested in the police. I have consistently supported those powers, controversial though they once were, and I support the extension of them to data on the cloud by Clause 137. The issue raised by these amendments is whether those powers and their extension should be attended by improved but streamlined safeguards. My amendments suggest two simple and modest ways of achieving this. Schedule 7 to the Terrorism Act 2000 and Schedule 3 to the National Security Act 2023 authorise counterterrorism police to stop any person passing through a port or airport, on a no-suspicion basis, for the purpose of determining whether they are or have been involved in terrorism or hostile activity. Such persons may be searched; they may be detained and questioned for up to six hours; they are denied the right of silence in the face of the officers’ questions; indeed, they are liable to be prosecuted if they refuse to speak. All these powers are exercisable, I repeat, on a no-suspicion basis. There are some thousands of Schedule 7 examinations every year—well down from the peak, but still a significant number. That is not all: any “thing” that a traveller has with them can be seized and inspected, again without any need for suspicion. That power has its origins in the historical power to rummage through hand baggage, and there are all kinds of “things” in there. Thanks to modern technology, such “things” now include laptops and mobile phones. Under the existing law, the contents of these electronic devices may be copied and retained for as long as the examining officer believes that they may be needed for use as evidence in criminal proceedings, or in connection with deportation. That is fair enough in my book. In addition, however, and relevant to my proposed amendments, the contents may be copied and retained “for as long as is necessary for the purpose of determining” whether a person is or has been involved in terrorism or hostile activity. Clause 137 would extend this power so that it applies not only to data that can be extracted from the phone itself but—as touched on in the previous group—to data that is accessible from the phone and stored on the cloud. This includes, for example, the entirety of a person’s Gmail account and all their iCloud photos. The operational logic of the extension is faultless: cloud storage is a fact of life. I have no problem with Clauses 130 to 134, which apply the same principle to powers that are already well attended by safeguards. But Clause 137 gives us an opportunity to reflect, not least in the light of comments from the courts, on whether the Government and your Lordships are content for data that has been seized without the need for suspicion—and which, as the noble Lord, Lord Clement-Jones, said in the previously group, increasingly encapsulates every aspect of a person’s private life—should be retained by the police without clearer parameters. We are urged to take that opportunity to reflect by Jonathan Hall KC, my successor but one as the Independent Reviewer of Terrorism Legislation. In a note published last October, he suggested that Parliament might want to consider: what safeguards will prevent excessive data being extracted and copied; how journalistic and legally privileged material on an online account will be protected; and, given the quantity of personal data that members of the public knowingly or unknowingly hold on the cloud, accessible from their device, whether, as he put it, “merely travelling through a port or border” is “a sufficient reason to surrender so much of their privacy”. Jonathan Hall does not say for how long data is, in practice, retained for the purpose of determining whether a person is involved in terrorism or hostile activity. The experience of the old management of police information, or MoPI, regime suggests, however, that personal data may be retained in police systems for very long periods indeed, particularly when the grounds for doing so are very broadly and vaguely expressed. As one would expect, powers as strong as these have attracted legal challenge. The leading case was brought by Mrs Beghal, who was questioned under Schedule 7 at East Midlands Airport in 2011. The essentials of Schedule 7, as it then stood, were found, in 2015, to be compatible with the European convention by a majority of the Supreme Court. Lord Kerr, followed by a unanimous first section of the European Court of Human Rights, found otherwise. Fortunately, for those tasked with defending the power in the courts, Mrs Beghal was not subject to the inspection, copying, or retention of data on her phone, let alone, of course, on the cloud, but the Supreme Court was sufficiently troubled by this aspect of the power to address the issue anyway. It did not object to the suspicionless seizure, copying and retention of data belonging to a person going through a port or airport, but it did express the view, by way of obiter dictum, in paragraph 58 of its judgment that retention beyond an initial period for the purposes of determining whether a person is involved in terrorism should require objective grounds for suspicion. My Amendment 390 would act on that dictum of the Supreme Court in relation to the existing Schedule 7 power and the proposed amendment to it. It would fix the initial period during which no suspicion is required at three months. This might be considered rather generous to the police, given that the Supreme Court appears provisionally to have had a period closer to seven days in mind. Should Amendment 390 find favour with your Lordships, a similar amendment to Schedule 3 to the National Security Act could be tabled alongside it on Report. My Amendment 391 is directed exclusively to the National Security Act 2023. Its Schedule 3 allows an even broader basis for retaining cloud data than the Terrorism Act. As proposed by the Government, it will be sufficient reason for retaining such data that “the constable believes it necessary … in the interests of national security” or the “economic well-being of the United Kingdom”— national security being a concept that is famously undefined in our legislation. The test of subjective belief on the part of a constable in relation to these weighty matters is about the least onerous threshold that could be imagined. Amendment 391 would replace it with an objective test—the same objective test proposed in relation to the alternative ground for retention in new paragraph 22B(a) in the Bill. This is keyhole surgery of the most minor kind, but I suggest it is the least this situation requires. These are probing amendments, but they go some way to meeting the challenge we have been posed by the independent reviewer. They invite discussion of a question that is surely significant by any measure: are we or are we not prepared to contemplate meaningful limits on police retention of the most extensive private details of the lives of people who have done nothing more suspicious than pass through a port or airport? I beg to move.