Snooping by police to be monitored by independent authority

A new independent surveillance procedure to prevent police officers granting themselves permission to access personal emails and records of web-browsing history is being established by the government.

The Home Office project, about which MPs have yet to be informed, follows a highly critical judgment handed down by the European court of justice (ECJ) last year, which demanded stricter legal safeguards for the handling of communications data by law enforcement agencies. Information about the new body only surfaced in an online tender document.

The communications data independent authorising body appears to have been created in response to the judicial decision, according to Labour’s deputy leader, Tom Watson, and human rights groups which were involved with the ECJ case in Luxembourg.

The European Union’s highest court ruled last December that “general and indiscriminate retention” of emails and electronic communications by governments was illegal. It declared that prior authorisation by a court or independent body to access retained data was required for each official request.

The legal challenge was originally taken against the Data Retention and Investigatory Powers Act (Dripa) 2014 by Watson and the Conservative MP David Davis, before he became Brexit secretary. It questioned the legality of bulk interception of call records and online messages by GCHQ, the government’s monitoring agency.

Dripa has since been replaced by the Investigatory Powers Act (IPA) but ministers now seem to have accepted that the Luxembourg judgment also applies to the new legislation.

Earlier this month, a £4m contract for implementing delivery of the IPA was published on the government’s digital marketplace website. It said: “Passage of the Investigatory Powers Act has created significant business change impacts across government, law enforcement, and intelligence agencies. The ECJ has recently upheld an appeal which challenges the current UK communications data retention and acquisition regime.”

Users, it said, would include “law enforcement agencies, government departments/public bodies, intelligence agencies, the Investigatory Powers Commission (IPC) and a new communications data independent authorising body. Both bodies are yet to be stood up but the IPC is more mature in design and planning”.

Responding to the first public mention of the “communications data independent authorising body”, Watson sent a letter last week to the prime minister, Theresa May, which has been seen by the Guardian.

It said: “This is a reference to the Watson case and therefore demonstrates that some work is being carried out in response to the [ECJ] judgment. You will be aware that I requested a review of the implications of the ECJ judgment on the IPA. Please can you confirm whether a full review has been undertaken and provide details of the new authorising body, including its remit, resourcing, staffing and proposed procedures.”

Watson asked May to make a full statement to parliament. “This is important in ensuring that the government is properly accountable and to maintain confidence in the communications data retention and acquisition regime,” he said.

The online tender was also spotted by the Open Rights Group, one of the organisations involved in the Luxembourg court hearing last spring.

Jim Killock, its executive director, said: “The ECJ ruling was clear in stating that blanket data retention is not permissible. While it’s welcome that the government appears to be addressing the issue of independent authorisation, it cannot cherry pick which parts of the ruling it wants to accept. To do so could jeopardise the future of UK business. The government needs to explain how they will meet the other criteria of the ruling.”

Responding to Watson’s letter, a Home Office spokesperson said: “We were disappointed with the judgment from the European court of justice and are carefully considering its implications.”