03/02/2020 Privacy International v Secretary of State for Foreign And Commonwealth Affairs & Ors (Rev 2) [2016] UKIPTrib 15_110-CH (17 October 2016) under s.94 for a Code of Practice to be issued, and his formal recommendations are those set out at section 12, and we repeat what we said in paragraph 86 above as to the relevance of improvements, or proposed improvements. 90. It is important to note that the July Review was not addressing compliance with Article 8 (because of the fact that this application to this Tribunal was outstanding), nor are all the formal recommendations in section 12 material to the issues which we have to consider. Many of those recommendations as to the process to be followed are designed to ensure that adequate records are kept, and notifications made, so that the Commissioner can properly review the operation of the s.94 regime. Other recommendations are intended to ensure that the scope of the requirements imposed on the PECNs are clear. However the issue for us to consider is whether any of the recommendations indicate that there are not currently effective safeguards against arbitrary or abusive use of the s.94 power. The fact that the Commissioner has himself identified administrative improvements that should be made is indicative of the effective operation of oversight of the SIAs in this area. 91. The most significant of the points emerging from the July Review and from the Claimant's submissions relating to it are these: (i) There is no present limit on the duration of a s. 94 direction, i.e. to the period during which the PECNs should continue to comply with it and provide data.  The Commissioner did not make a recommendation that there should be a maximum duration imposed on directions made under s.94, but advised at paragraph 4.14 its proposed inclusion in a code of practice; such a requirement was not included in his recommendations in section 12. However, we are satisfied that under the Handling Arrangements (and as appears in the Agreed Facts, at paragraph 19(a)(v)) there are adequate restrictions imposed on the SIAs in relation to the duration for which the data can be retained (thus protecting the interests of the persons whose communications data has been obtained), and there are also provisions for a review of the directions. (ii) The Commissioner did recommend that there should be standardised processes for the review of directions, and the reporting of errors. We consider that the comprehensive Handling Arrangements, combined with proper oversight by the Commissioners, do adequately provide effective safeguards. (iii) There are recommendations by the Commissioner as to what should be included in a s.94 direction. A further specification may in due course be introduced, but in our Judgment, given the adequacy of the safeguards provided by the published Handling Arrangements, such is not necessary for compliance with Article 8. The I C C concluded (at paragraph 11.10) that the relevant agencies had introduced comprehensive procedures, in accordance with the Handling Arrangements, to ensure that they only acquired and retained bulk communications data, and then accessed and undertook analysis of that data, in order to pursue their functions under SSA 1989 or ISA 1994. The essential protection against a potential abuse of power under s.94, namely a requirement that the BCD may only be obtained and used for proper purposes, is thus provided by law, and subject to effective oversight. 92. MI5 and GCHQ differ in the systems they operate so far as access to BCD is concerned.  Neither of them adopt the need for a warrant, as will be provided by the new Bill, if enacted.  The Claimant submits that there is inappropriate reliance by GCHQ upon the RIPA safeguards relating to intercept, which they operate, without appreciating the difference, namely the absence of the specific safeguards effected by ss.15 and 16 of RIPA.  MI5 adopt (as discussed in paragraph 54 above) a system analogous to that under ss.21 and 22 of RIPA, but did not, a matter of severe criticism by the I C C, have a system with a sufficiently independent designated person such as would comply with the Communications Data Code of Practice.  This is a matter which, while not accepting such criticism, the Respondents have met by agreeing, by a letter dated 7th July 2016 written by MI5 to the Home Secretary, to introduce a new procedure. While it is not yet known whether this will be satisfactory to the I C C, this indicates the effectiveness of the I C C's oversight. www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKIPTrib/2016/15_110-CH.html&query=([2016])+AND+(UKIPTrib)+AND+(15_110-CH) 26/53