It is a great pleasure to appear before you for the first time, Dr Murrison. I do not want to detain the Committee too long, but I have a couple of questions.
Obviously, I am familiar with this legislation, having served at the Home Office. We should be under no illusion: the powers that we are extending today are actually very intrusive. While the Minister is absolutely right, for example, that there is not a single murder in this country that is not solved without this kind of data, the extension of these powers to the organisations named in the regulations is broadly what was predicted by critics of the Investigatory Powers Bill when it was introduced in 2016. Slowly but surely, they said, everybody would grab these powers just in case they needed them. As Members of Parliament, whose job it is to balance the rights of the public against the Government’s ability to intrude on them, we need to think carefully about whether what we are doing today is proportionate.
My first question, which troubled me when I was at the Home Office, is about the internal conflict for the commissioner. The way that the Act is drawn, the commissioner both authorises and supervises. Although the commissioner is responsible to Parliament and produces reports to it, I am not entirely sure that the commissioner should effectively be both judge and jury on whether an organisation should have authorisation and therefore, presumably, whether its internal structures for controlling and managing the data are satisfactory. One would have thought that in normal circumstances there would be some separate authorisation system that was then assessed to be adequate by the commissioner. That conflict causes me some problems, and I would be interested in the Minister’s comments on it.
My second question is about the use case, which was raised by both the hon. Member for South West Devon and the hon. Member for Sutton and Cheam. It seems odd that some ambulance services are saying, “We don’t actually need this,” but others are saying that they do. What is special about the East Midlands ambulance service that means it needs to retain this power? It would be interesting to understand the use cases for all these organisations. For example, why is location and time data for telephone communications useful to the Intellectual Property Office? I do not quite see it myself. I might be missing something—I am not an expert in intellectual property—but it would be helpful to see the use case that I presume it made to the commissioner for the authorisation. Has that been published?
The guidance states that there has been a consultation with the commissioner. I presume that the consultation has been published, although I have not been able to find it. If it has, does it contain information about how the commissioner tested the use cases? Has the commissioner tested the proportionality—that is what we are making a judgment on here—of the case made by each organisation? Are there real examples that Members can look at and say, for example, “Okay, we understand that East Midlands needs it because it is particularly prone to fraud in which this kind of data is useful for prevention and detection, but the other ambulance services aren’t”?
Similarly, for the other organisations, I can see why location data would matter for DVSA, but I have never heard of the integrated corporate services counter fraud expert services team. I do not know what it does; I would love to know. It would be great if either now or afterwards we could get some information on what it feels like in the real world so Members can make a proportionate judgment, albeit after the fact.
On authorisation levels, the Minister said that there is no requirement because the organisations are all going for authorisation direct from the IPC, but in the regulations, in the column that is amended in the legislation, it gives authorisations at particular levels. For example, it states that in the East Midlands ambulance service, a duty manager of an ambulance control room is able to authorise a request. In the Department for Business and Trade,
“so far as relating to the Insolvency Service”
it specifies:
“Grade 7 in the Investigation and Enforcement Services Directorate”.
Will the Minister explain why he is happy with that level of internal organisation? To me it feels a little low that a request so intrusive and, in certain circumstances, speculative could be authorised by a no doubt hard-working and dedicated duty manager of an ambulance control room, rather than somebody who we might imagine was part of a senior management team of an organisation who is able to take a strategic view about whether a request was proportionate.
As I say, I understand the need for the legislation. It was introduced in 2016 in my first year in the House; I was not the Minister at the time, but obviously I voted for it. It seemed to be the right kind of construct, but we always knew the day would come when we expanded it. The undertaking given then by the Government was that MPs would exercise their judgment about the proportionality of these organisations beyond the police, counter-terrorism and normal enforcement organisations that were really the primary targets of the legislation.