1. This consultation seeks views on two revised codes of practice and one new code. The first revised code deals with Covert Human Intelligence Sources ( CHIS) and the other with Covert Surveillance and Property Interference. Changes made to the revised codes are highlighted yellow for ease of reference ( PDF version only). The new code of practice deals with Targeted Equipment Interference.
2. The revised codes include a number of changes made by the Investigatory Powers Act 2016 ( IPA). These relate mainly to a new safeguards and oversight regime, including a new Investigatory Powers Commissioner which replaces the Intelligence Services Commissioner, the Interception of Communications Commissioner and the Chief Surveillance Commissioner. Additionally, further clarification is being provided on issues such as online surveillance and the use of aerial surveillance.
3. The Targeted Equipment Interference code is a new code and sets out the procedures which the Police Service of Scotland and the Police Investigations and Review Commissioner must follow if using these powers. The statutory powers are included at Part 5 of the Investigatory Powers Act 2016.
4. Section 24  of the Regulation of Investigatory Powers (Scotland) Act 2000 ( RIP(S)A) requires the Scottish Ministers to issue one or more codes of practice on the use of investigatory powers, so far as they relate to Scottish public authorities.
5. The Scottish Government supports law enforcement and public authorities having access to the powers they require in order to keep our communities safe, while also recognising that these powers must be balanced with strong oversight and protections for civil liberties. The main purpose of these codes is to help Scottish public authorities assess and understand whether, and in what circumstances, it is appropriate to use investigatory powers. These codes also allow other interested persons to understand the procedures that must be followed by the relevant public authorities.
Covert Human Intelligence Sources, Covert Surveillance and Property Interference
6. RIP(S)A (which regulates covert surveillance and CHIS) and the Police Act 1997 (which regulates property interference) (1997 Act) provide specified public authorities with a regulatory framework within which certain activities can be undertaken lawfully. They do this by requiring a public authority to set out fully the reasons why the activity is necessary and to demonstrate that such a course of action is proportionate to what it seeks to achieve. Using this framework requires the public authority to give full consideration to the potential infringements on an individual's human rights, particularly under Article 8 of the European Convention of Human Rights ( ECHR), the right to respect for private and family life.
7. In terms of directed surveillance and the use of a CHIS, RIP(S)A provides that activity is only necessary if it is:
- for the purpose of preventing or detecting crime or of preventing disorder;
- in the interests of public safety; or,
- for the purpose of protecting public health.
8. For intrusive surveillance, RIP(S)A provides a single purpose of preventing or detecting serious crime. Authorisations to interfere with property under the 1997 Act may also only be made for the purpose of preventing or detecting serious crime.
9. Activity must also be proportionate to what is sought to be achieved. This includes balancing any intrusion not only against the individual, but against others who might be affected by the activity. If the information sought could be gained using less intrusive means then the activity will be deemed to be disproportionate and should not be authorised.
Targeted Equipment Interference
10. The Investigatory Powers Act 2016 ( IPA) provides a new framework to enable specified public authorities, including Police Scotland and the Police Investigations and Review Commissioner, to authorise targeted equipment interference when the ECHR or the Computer Misuse Act 1990 are likely to be engaged. While much of this activity could previously be authorised under the 1997 Act, the IPA seeks to provide clarity by setting out in more specific terms the circumstances in which targeted interference with equipment may be authorised. In tandem with this, the Scottish Government has provided a new code of practice to cover this particular activity.
11. In line with the framework for other investigatory powers, the targeted equipment interference framework requires the public authority to set out fully the reasons why it is necessary and to demonstrate that such a course of action is proportionate to what it seeks to achieve. Using this framework requires the public authority to give full consideration to the potential infringements on an individual's human rights, particularly under Article 8 of the ECHR.
12. Part 5 of the IPA provides the framework under which targeted equipment interference warrants are issued authorising targeted interference with equipment for the purpose of obtaining communications, equipment data or other information.
13. Targeted equipment interference warrants may authorise both physical interference ( e.g. covertly downloading data from a device to which physical access has been gained) and remote interference ( e.g. installing a piece of software on to a device over a wired and/or wireless network in order to remotely extract information from the device).
14. A targeted equipment interference warrant provides lawful authority to carry out the acquisition of communications stored in or by a telecommunications system.
15. In the case of both Scottish public authorities, targeted equipment interference will only be necessary if it is for the purpose of preventing or detecting serious crime. In addition, Police Scotland may make an application for the purpose of preventing death or any injury or damage to a person's physical or mental health, or of mitigating any injury or damage to a person's physical or mental health.
16. Secondly, the relevant law enforcement chief must consider that it is proportionate. The relevant considerations are the same as those which have been detailed at paragraph 9.
17. The IPA provides a range of safeguards in relation to legally privileged information, journalistic material and sources, and the handling, retention and disclosure of material.
18. It also contains a new general privacy protection, which provides additional protections for communications with sensitive professions where there is a reasonable expectation that the communications have a high degree of privacy, or should be kept confidential. This includes communications with members of a relevant legislature, lawyers, journalists and members of the medical profession.
19. These protections are detailed in the Targeted Equipment Interference code of practice and, where relevant, are included in the revised codes.
Oversight: the Investigatory Powers Commissioner and Judicial Commissioners
20. One of the main changes resulting from the IPA is the introduction of a new oversight regime to be headed by the Investigatory Powers Commissioner ( IPC). This will replace the Intelligence Services Commissioner, the Interception of Communications Commissioner and the Chief Surveillance Commissioner, providing broader oversight and consistency of approach.
21. The IPC will be supported by a number of Judicial Commissioners and will be responsible for ensuring that the various public authorities comply with the respective legislation. The IPC and the Judicial Commissioners will require to hold or have held high judicial office within the meaning of the Constitutional Reform Act 2005. For the purposes of Scotland this could be the High Court, Court of Session or UK Supreme Court. The IPC will have robust and wide ranging powers, including undertaking audits, inspections and investigations, and will be able to inform individuals who have been the subject of serious errors by public authorities using investigatory powers. The IPC will provide information to the Scottish Parliament and the public on the need for, and use of, investigatory powers, ensuring accountability. It may also refer to the Investigatory Powers Tribunal any issue relating to the use of investigatory powers, if they believe it to be unlawful.
22. Certain powers covered by the codes - e.g. intrusive surveillance, targeted equipment interference and certain types of property interference - will require to be approved by a Judicial Commissioner before they can take effect.
23. The three codes of practice reflect changes made by the IPA, as described in the previous sections, which relate mainly to a new safeguard and oversight regime and the clarification of existing law relating to targeted equipment interference. For ease of reference, changes made to the revised codes dealing with CHIS and Covert Surveillance and Property Interference are highlighted yellow ( PDF version only).
Email: Carmen Murray, email@example.com
Phone: 0300 244 4000 – Central Enquiry Unit
The Scottish Government
St Andrew's House