03/02/2020 Privacy International v Secretary of State for Foreign And Commonwealth Affairs & Ors (Rev 2) [2016] UKIPTrib 15_110-CH (17 October 2016) (a) Detailed internal guidance on the requirements of necessity and proportionality (having regard to the privacy of those whose data is contained in the BPD) including the need to consider other, less intrusive, methods of obtaining the information; (b) Specific consideration of sensitive data and confidential data;  (c) A clear policy on the storage of and access to BPD; (d) Specific retention periods and retention/deletion policies which apply to BPD;  (e) Policies on the handling and disclosure of BPD;  (f) Clear guidance on the serious consequences of failure to comply with the Handling Arrangements, which include disciplinary action, including potentially dismissal, and prosecution;  (g) Training;    (h) Oversight, both internal and external."  Prior to avowal 67. The two significant questions to be asked in relation to the period prior to avowal, in the light of the principles of ECHR jurisprudence which we have set out, are as follows: (i)  Given that there were 'under the waterline' rules and arrangements, was there sufficient foreseeability or accessibility, or 'signposting', to comply with the requirements which we have set out above, as to (a) the existence of BCD and BPD, (b) the nature of the controls over them? (ii)  Whereas in Kennedy the ECtHR , and in Liberty/Privacy and Greennet the Tribunal, was satisfied as to the degree and effectiveness of oversight by independent Commissioners, does the same apply here, or if there be an inadequacy of supervision, what is the effect on our conclusion? Foreseeability 68. As to foreseeability, we refer to what we said in Greennet with regard to Computer Network Exploitation (CNE):  "81 ... [I]t is clear that prior to February 2015 there was no admission that property interference by GCHQ (governed by the Property Code) extended to CNE by the use of a s. 5 warrant ... Nevertheless it was quite clear that at least since 1994 the powers of GCHQ have extended to computer interference (under s. 3 of ISA).  It was thus apparent in the public domain that there was likely to be interference with computers, 'hacking' being an ever more familiar activity, namely interference with property by GCHQ (and see in particular the 1990 Hansard references ...), and that if it occurred it would be covered by the Property Code.  Use of it was thus foreseeable, even if the precise form of it and the existence of its use was not admitted." 69. The Respondents submitted in paragraph 66 of their Skeleton Argument that:  "This applies with equal force to the present case where: (a) although the use of s. 94 to obtain BCD had  not been publicly avowed, it was nonetheless foreseeable,  because (i) GCHQ and MI5's acquisition of communications  data in more general terms was publicly known (albeit  pursuant to a warrant issued under s. 8(4) of RIPA  or by an authorisation under Part 1 Chapter II of RIPA).  There was therefore nothing secret about the essential  activity of acquisition of such data by those agencies;  and (ii) www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKIPTrib/2016/15_110-CH.html&query=([2016])+AND+(UKIPTrib)+AND+(15_110-CH) 21/53