03/02/2020 Privacy International v Secretary of State for Foreign And Commonwealth Affairs & Ors (Rev 2) [2016] UKIPTrib 15_110-CH (17 October 2016) "(1) A Bulk Personal Dataset ... is a  dataset that contains personal data about individuals, the majority of whom are unlikely to be of intelligence interest, and that is incorporated into an analytical system and used for intelligence purposes.  Typically such datasets are very large, and too large to be processed manually. (2) The [SIAs] obtain and exploit BPD for several purposes: - to help identify subjects of interest or unknown people that surface in the course of investigations; - to establish links between individuals and groups; - or else to improve understanding of targets' behaviour and connections; - and to verify information obtained through other sources. (3) BPD obtained and exploited by the [SIAs] includes a number of broad categories of data.  By way of example only these include: biographical and travel (e.g. passport databases); communications (e.g. telephone directory); and financial (e.g. finance related activity of individuals). (4) While each of these datasets in themselves may be innocuous, intelligence value is added in the interaction between multiple datasets.  One consequence of this is that intrusion into privacy can increase. (5) BPD is operationally essential to the [SIAs] and growing in importance and scale of holdings.  Examples of the vital importance of BPD to intelligence operations include ... identifying foreign fighters [and] preventing access to firearms." 6. The ISC in its March 2015 Report gave the following description of BPD:"157. Whereas the [SIAs'] capabilities to intercept communications and acquire Communications Data are regulated by [the Regulation of Investigatory Powers Act 2000] (RIPA) the rules governing the use of Bulk Personal Datasets are not defined in legislation.  Instead, the [SIAs] derive the authority to acquire and use Bulk Personal Datasets from the general powers to obtain and disclose information (in support of their organisation's functions) that are afforded to the heads of each of the [SIAs] under the Intelligence Services Act 1994 [ISA 1994] and the Security Service Act 1989 [SSA 1989] ... 159. While Ministers are not required to authorise the acquisition or use of Bulk Personal Datasets in any way, the Home Secretary explained that he had some involvement: "[MI5] do come to me and I receive submissions on acquisition on bulk datasets and the holding of bulk datasets."  In relation to the Bulk Personal Datasets held by GCHQ and [MI6], the Foreign Secretary explained to the Committee that, "There is not a formal process by which we have looked [at those datasets]."... He explained ... "... I have ... asked for twice yearly reporting of the holdings of bulk personal data by the [SIAs]." 160.  In terms of independent review, the Intelligence Services Commissioner has nonstatutory responsibility for overseeing the [SIAs'] holdings of Bulk Personal Datasets (since 2010) ... The Commissioner explained to the Committee that he retrospectively reviews the [SIAs'] holdings of Bulk Personal Datasets as part of his six-monthly inspection visits.  This includes reviewing the intelligence case for holding specific datasets, necessity and proportionality considerations, the possible misuse of data and how that is prevented." 7. The MI5 witness explained in his evidence as follows:"44) MI5 acknowledges that it holds the following categories of BPD: www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKIPTrib/2016/15_110-CH.html&query=([2016])+AND+(UKIPTrib)+AND+(15_110-CH) 3/53