03/02/2020 Privacy International v Secretary of State for Foreign And Commonwealth Affairs & Ors (Rev 2) [2016] UKIPTrib 15_110-CH (17 October 2016) GCHQ Compliance Guide 51. The relevant sections of the GCHQ Compliance Guide relating to the period from June 2014, which have been disclosed by the Respondents in these proceedings, continued after November 2015. In the October 2015 version of the Compliance Guide, the section dealing with review and retention provided that continued retention beyond the prescribed default periods must be subject to formal approval. Although the previous version of the Compliance Guide required that such retention should be reviewed and rejustified, in most cases annually, it had not previously been subject to the requirement of formal approval. MI5 internal arrangements 52. MI5 continues to have internal guidance in addition to the Section 94 Handling Arrangements. In particular: (a) From November 2015 the "Communications Data – Guidance on Justifications and Priorities" guidance was amended so that: (a) Specific attention was drawn (and a link provided to) the MI5 Section 94 Handling Arrangements which came into force on 4 November 2015; and (b) Detailed guidance was provided in respect of communications data applications relating to members of sensitive professions. Acquisition and Disclosure of Communications Data Codes of Practice 53. The authorisation process for access to the Section 94 database was, from the outset, the same as for requests to CSPs for CD under Part 1 Chapter II of RIPA. As a matter of practice and policy, MI5 has applied the applicable Codes of Conduct for the acquisition of communications data to the regime that it has operated for the database. In particular, investigators would – when completing requests for CD – be expected to comply with applicable parts of the Code of Practice relating to the acquisition of CD. Acquisition and Disclosure of Communications Data Code of Practice 2007 54. The Acquisition and Disclosure of Communications Data Code of Practice 2007 ("the 2007 CD Code") related to the powers and duties conferred under Part 1 Chapter II of RIPA. 55. Relevant provisions of the 2007 CD Code include: (a) Provisions emphasising and explaining the requirements of necessity and proportionality: (a) "The acquisition of communications data under the Act will be a justifiable interference with an individual's human rights under Article 8 of the European Convention on Human Rights only if the conduct being authorised or required to take place is both necessary and proportionate and in accordance with law." (§2.1) (b) "Consideration must also be given to any actual or potential infringement of the privacy of individuals who are not the subject of the investigation or operation. An application for the acquisition of communications data should draw attention to any circumstances which give rise to a meaningful degree of collateral intrusion." (§2.6) (c) Further explanation of proportionality at §§2.7-2.8. (b) The procedure for making an application: at §§3.3-3.6, §§3.56-3.62. (c) The role of "Designated Persons": (a) "Exercise of the powers in the Act to acquire communications data is restricted to designated persons in relevant public authorities. A designated person is someone holding www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKIPTrib/2016/15_110-CH.html&query=([2016])+AND+(UKIPTrib)+AND+(15_110-CH) 39/53