03/02/2020 Privacy International v Secretary of State for Foreign And Commonwealth Affairs & Ors (Rev 2) [2016] UKIPTrib 15_110-CH (17 October 2016) •    In addition, Intelligence Service staff must take particular care when deciding whether to seek access to BCD and must consider whether there might be unintended consequences of such access to BCD and whether the public interest is best served by seeking such access; •    In all cases where Intelligence Service staff intentionally seek to access and retain BCD relating to the communications of individuals known to be members of the professions referred to above, they must record the fact that such communications data has been accessed and retained and must flag this to the Interception of Communications Commissioner at the next inspection; •    In the exceptional event that Intelligence Service staff were to seek access to BCD specifically in order to determine a journalist's source, they should only do this if the proposal had been approved beforehand at Director level. Any communications data obtained and retained as a result of such access must be reported to the Interception of Communications Commissioner at the next inspection; •    Users must be trained on their professional and legal responsibilities, and refresher training and/or updated guidance must be provided when systems or policies are updated; •    A range of audit functions must be put in place: users should be made aware that their access to BCD will be monitored and that they must always be able to justify their activity on the systems; •    Appropriate disciplinary action will be taken in the event of inappropriate behaviour being identified; •    Users must be warned, through the use of internal procedures and guidance, about the consequences of any unjustified access to data, which can include dismissal and prosecution. •    In the exceptional event that Intelligence Service staff were to abuse their access to BCD – for example, by seeking to access the communications data of an individual without a valid business need – the relevant Intelligence Service must report the incident to the Interception of Communications Commissioner at the next inspection." Disclosure 40. The disclosure of BCD outside the Agency which holds can only occur if certain conditions are complied with: "4.4.1 The disclosure of BCD must be carefully managed to ensure that it only takes place when it is justified on the basis of the relevant statutory disclosure gateway. The disclosure of an entire bulk communications dataset, or a subset, outside the Intelligence Service may only be authorised by a Senior Official or the Secretary of State. 4.4.2 Disclosure of individual items of BCD outside the relevant Intelligence Service may only be made if the following conditions are met: - that the objective of the disclosure falls within the Service's statutory functions or is for the additional limited purposes set out in sections 2(2)(a) and 4(2)(a) of the ISA 1994 and section 2(2)(a) of the SSA 1989; - that it is necessary to disclose the information in question in order to achieve that objective; - that the disclosure is proportionate to the objective; - that only as much of the information will be disclosed as is necessary to achieve that objective." 41. Again, guidance is given to staff on the requirements of necessity and proportionality, in terms similar to those relating to acquisition, but with specific reference to disclosure: "When will disclosure be necessary? www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKIPTrib/2016/15_110-CH.html&query=([2016])+AND+(UKIPTrib)+AND+(15_110-CH) 36/53