03/02/2020 Privacy International v Secretary of State for Foreign And Commonwealth Affairs & Ors (Rev 2) [2016] UKIPTrib 15_110-CH (17 October 2016) 93. In considering acquisition of BCD, and access to such data held, the essential requirement in this context is that the BCD is acquired only for proper purposes, where the acquisition of the data is necessary and proportionate. The Handling Arrangements are clear in this respect (see Appendix A at paragraphs 35 and 39). As noted above, the I C C, having reviewed the directions which have been made under s.94, was satisfied that they had all been issued for proper purposes. In relation to BPD, the statutory duties imposed on the SIAs govern the obtaining of all information, with or without a warrant, so that information used to constitute BPDs can only be obtained for proper purposes. If the data is required to be obtained by the exercise of any statutory power (e.g. under RIPA or ISA) then the relevant statute will provide the necessary protection. If no statutory power is required to be exercised, for example if the information may be purchased commercially, then the relevant issue is how such data is retained and used. The material potential intrusion on privacy arises from the retention and use of such data, and it is at that point that safeguards must be applied. As noted above, the Handling Arrangements are clear as to the conditions under which any BPD may be obtained or accessed, and the operation of those arrangements is subject to independent oversight 94. Whatever the failings in the system of oversight obtaining prior to avowal of these powers, the system now in operation does, in our judgment, operate effectively. The I C C has conducted a review of the s. 94 powers. The lines of demarcation between the two Commissioners in relation to the use of BCD have been agreed. The I S Commissioner has, as referred to in paragraph 81 above, recently published his annual Report for 2015, which contains a review of the BPD regime. The fact that these reviews are not uncritical, and, particularly on the part of the I C C, contain recommendations for improvement, indicates that the system of oversight is effective. 95. The only area in which we need to give further consideration relates to the provisions for safeguards and limitations in the event of transfer by the SIAs to other bodies, such as their foreign partners and UK Law Enforcement Agencies.  There are detailed provisions in the Handling Arrangements which would appear to allow for the placing of restrictions in relation to such transfer upon the subsequent use and retention of the data by those parties.  It is unclear to us whether such restrictions are in fact placed, and in paragraph 48.2 of their Note of 29 July 2016 the Respondents submit that the Tribunal is not in a position to decide this issue.  We would like to do so and invite further submissions. 96. This leaves the question, in relation to BPD, of the period between Avowal in March 2015 and 4 November 2015 when the Handling Arrangements were published, given our conclusion that in relation to BPD, unlike BCD, the independent oversight was and continued to be adequate, and in any event so far as Avowal is concerned, the earlier date applied to BPD but not to BCD. The question is whether during the period between March and November 2015 there was compliance with Article 8 in respect of the BPD regime, when there was not publication of the Handling Arrangements until 4 November 2015. 97. A joint SIA Bulk Personal Data Policy came into force in February 2015, which was to very similar effect as the subsequently published 4 November joint Handling Arrangements, so far as concerned arrangements for acquisition, use, sharing, retention and deletion/destruction; and in addition the relevant provisions of GCHQ's Compliance Guide and the underlying forms and guidance continued in effect, as did the MI5 Bulk Personal Data Guidance, with new versions of various forms continuing to be issued thereafter.  MI6 also continued to be subject to similar Guidance.  Of course none of these were in the public domain, but formed the basis for the fully considered open and closed handling arrangements once issued on 4 November 2015. 98. The issue for us is to decide whether the absence of publication of these arrangements ('below the waterline'), which were at all times subject to the approval and supervision of the I S Commissioner, renders the BPD non-compliant with Article 8 prior to 4 November 2015.  We have referred to the ISC, and quoted from its Report in some detail in paragraph 65 above, from which it is plain that it contained considerable open description, not only of the existence of the BPD process and system, but of the way it operated and the controls to which it was subject. 99. The ISC had a concern, which it expressed, that the supervision was non-statutory, and that of course was immediately resolved in March 2015, and that there was no express legislation in respect of BPD.  The only other concern which it expressed (paragraph 163 of the Report) is that to which we have www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKIPTrib/2016/15_110-CH.html&query=([2016])+AND+(UKIPTrib)+AND+(15_110-CH) 27/53