03/02/2020 Privacy International v Secretary of State for Foreign And Commonwealth Affairs & Ors (Rev 2) [2016] UKIPTrib 15_110-CH (17 October 2016) (v) MI5 generally retains BCD for one year. (vi) BCD contains communications data in the form of "traffic data" and "service use information" (as defined in s.21(4) of RIPA), or the "who, where, when and how of a  communication."  BCD may have contained subscriber information and may include locational data from mobile and fixed telephone lines and internet devices:  GCHQ's BCD collection includes bulk internet communications data, which may include the "who, where, when and how," of a communication on the internet, including automated communications between machines. (vii) S.94 Directions have not been, and cannot be, used to authorise the interception of the content of communications. (viii) BCD contains large amounts of data, most of which relates to individuals who are unlikely to be of any intelligence interest. (ix) BCD may be disclosed to persons outside the agency holding the BCD (subject to safeguards contained in the relevant Handling Arrangements). (x) Prior to the publication of the Investigatory Powers Bill, the use of s.94 to collect BCD was not publicly acknowledged. (xi) There have been instances of non-compliance with internal procedures and safeguards in relation to access of BCD databases at GCHQ and MI5, revealed in the various Commissioners' Reports. (b) BPD (i) GCHQ, MI5 and MI6 collect and hold BPDs, on their respective analytical systems . (ii) BPDs consist of large amounts of personal data:  the majority of individuals whose personal data is contained in a BPD will be of no intelligence interest. (iii) Multiple BPDs are analysed together to obtain search results. (iv) BPD may be acquired through overt and covert channels. (v) BPD can contain sensitive personal data as defined under s.2 of the Data Protection Act 1998 and/or information covered by legal professional privilege, journalistic material and financial data. (vi) GCHQ, MI5 and MI6 share BPDs, and BPDs may be shared with their foreign partners and/or may be disclosed to persons outside the agencies, as described in their Handling Arrangements. (vii) MI5, GCHQ and MI6 each acquire BPDs from other Government departments. (viii) GCHQ, MI5 and MI6 do not currently hold and have never held a BPD of medical records, although medical data may appear in BPDs. (ix) There have been instances of non compliance with BPD safeguards at GCHQ, MI5 and MI6, as disclosed in the various Commissioners' Reports. (x) There was no statutory oversight of BPD's by the I S Commissioner prior to the March 2015 ISC Report. (xi) Prior to the publication of that ISC Report, the holding of BPDs was not publicly acknowledged. www.bailii.org/cgi-bin/format.cgi?doc=/uk/cases/UKIPTrib/2016/15_110-CH.html&query=([2016])+AND+(UKIPTrib)+AND+(15_110-CH) 8/53