03/02/2020 Privacy International v Secretary of State for Foreign And Commonwealth Affairs & Ors (Rev 2) [2016] UKIPTrib 15_110-CH (17 October 2016) 72. This is the other underlying question, and it is not a straightforward picture. We shall consider the position separately in respect of BCD and BPD. 73. What is clear is that, as set out in the Agreed Facts in paragraph 19 above, there was no statutory oversight of BPD prior to March 2015, when the Prime Minister gave his Direction as set out in paragraph 13 above, and that there has never been any statutory oversight of BCD, save in respect (in both cases) of data obtained under RIPA, which would fall under the  responsibility of the I C C under ss.57 and 58 of RIPA, or under the ISA 1994, in which case the I S Commissioner had responsibility for its oversight under ss.59 and 60 of RIPA. 74. Mr. de la Mare submits that any but statutory supervision is wholly ineffective, because of the absence of the statutory powers and duties contained in those sections. We are not persuaded that that is a sufficient answer to the Respondents' case that there was in fact effective independent oversight by the Commissioners which indeed led to the disclosure of errors from time to time, which they caused to be remedied. It is necessary to look at what in fact occurred. 75. As for BCD, dealing with the successive I C Cs, Sir Swinton Thomas carried out some oversight from 2006, and as from the appointment of his successor, Sir Paul Kennedy, and then Sir Anthony May, there were six-monthly reviews of the databases and of their use. They were provided with a list setting out details of all s.94 Directions and any that had been cancelled, although in the July Review the current I C C, Sir Stanley Burnton, criticises the lack of codified procedures and a sufficiently accessible and particularised list. 76. Sir Mark Waller as I S Commissioner also included a review of BCD within his responsibility upon his six-monthly visits, and he reviewed the use of the datasets and the case for their acquisition and retention, including necessity, proportionality and the risk of collateral intrusion.  He included consideration of BCD in all his Reports between 2011 and 2015.  Those Reports and the witness evidence from the SIAs show that he was concerned to carry out a perceptive examination and analysis both of the directions and the use of the data, but he did not carry out a detailed audit. 77. Both Commissioners approved and subsequently reviewed the ('under the waterline') GCHQ Compliance Guide relating to s.94 Directions. 78. From March 2015 Sir Anthony May was asked to take over full responsibility for oversight of BCD, and agreed to do so as from July 2015, provided that he was given additional staff and enabled to carry out the work properly, and it was only by December 2015 that his successor Sir Stanley Burnton was in a position to do so.  At this stage his inspectors were provided with full access to the MI5 electronic systems which processed authorisations for access to the database and communications data requests made to the PECNs, and they undertook query-based searches and random sampling of the MI5 system for authorising access to the database and reviewed requests for authorisations relating to the database, and that process, as we have been informed by the I C C's office, continues in place. 79. Sir Stanley Burnton recorded his conclusion in paragraph 2.5 of the July Review that, leaving aside the involvement of the I S Commissioner, oversight by the I C C of BCD prior to 2015 was "limited because it was only concerned with the authorisations to access the communications data obtained pursuant to the directions. The oversight was not concerned with, for example, the giving of the section 94 directions by the Secretary of State (including the necessity and proportionality judgments by the agency or Secretary of State) or the arrangements for the retention, storage and destruction of the data." 80. There were internal audits pursuant to the internal Compliance Guidance, and there was a regular review of the Directions by the Home Secretary (MI5) and the Foreign Secretary (GCHQ).  However, we are not satisfied that, particularly given the fragmented nature of the responsibility apparently shared between the Commissioners, there can be said to have been an adequate oversight of the BCD system, until after July 2015. In the absence of the necessary oversight and supervision by the I C C, the secondary roles of this Tribunal and the ISC were no replacement. 81. We turn to BPD, in respect of which it is plain that it was determined as a result of the 2010 report by Mr. Hannigan referred to in paragraph 70 above (and as later recorded in the Introduction to the Joint www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKIPTrib/2016/15_110-CH.html&query=([2016])+AND+(UKIPTrib)+AND+(15_110-CH) 23/53