Bulk Personal Datasets (BPDs)
The existing Part 7 regime in the IPA 2016 required the intelligence services to apply the same standard of safeguards to the retention and examination of all Bulk Personal Datasets regardless of the level of intrusion associated with doing so. Whilst some BPDs may contain sensitive personal information in respect of which stringent safeguards are necessary, the current Part 7 safeguards go beyond what the ECHR requires 1 for certain datasets that have low or no reasonable expectation of privacy.
	In order to be compatible with the ECHR, the statutory regime provides for adequate and effective safeguards against abuse. In the context of pre-IPA 2016 bulk interception, the Grand Chamber of the European Court of Human Rights dealt with this point in Big Brother Watch v UK 2 at §361:
"361. In assessing whether the respondent State acted within its margin of appreciation (see paragraph 347 above), the Court would need to take account of a wider range of criteria than the six Weber safeguards. More specifically, in addressing jointly "in accordance with the law" and "necessity" as is the established approach in this area ([…]), the Court will examine whether the domestic legal framework clearly defined:
1. the grounds on which bulk interception may be authorised;
2. the circumstances in which an individual’s communications may be intercepted;
3. the procedure to be followed for granting authorisation;
4. the procedures to be followed for selecting, examining and using intercept material;
5. the precautions to be taken when communicating the material to other parties;
6. the limits on the duration of interception, the storage of intercept material and the circumstances in which such material must be erased and destroyed;
7. the procedures and modalities for supervision by an independent authority of compliance with the above safeguards and its powers to address non-compliance;
8. the procedures for independent ex post facto review of such compliance and the powers vested in the competent body in addressing instances of non-compliance."
	It is also instructive to have regard to the pre-IPA 2016 decision of the Investigatory Powers Tribunal in Privacy International v Secretary of State for Foreign and Commonwealth Affairs.3 This case specifically concerned the acquisition and retention of bulk communications data and bulk personal datasets under the Telecommunications Act 1984 (to note: not datasets that could be said to be low/no datasets). As to safeguards and foreseeability, at §62 the Tribunal set out the following:
"62. Accordingly, by reference to our considered assessment of the ECHR jurisprudence, we can summarise in short terms what we conclude the proper approach is:
(i) There must not be an unfettered discretion for executive action. There must be controls on the arbitrariness of that action. We must be satisfied that there exist adequate and effective guarantees against abuse.
(ii) The nature of the rules fettering such discretion and laying down safeguards must be clear and the ambit of them must be in the public domain so far as possible; there must be an adequate indication or signposting, so that the existence of interference with privacy may in general terms be foreseeable.
(iii) Foreseeability is only expected to a degree that is reasonable in the circumstances, being in particular the circumstances of national security, and the foreseeability requirement cannot mean that an individual should be enabled to foresee when the authorities are likely to resort to secret measures, so that he can adapt his conduct accordingly.
(iv) It is not necessary for the detailed procedures and conditions which are to be observed to be incorporated in rules of substantive law.
(v) It is permissible for the Tribunal to consider rules, requirements or arrangements which are ‘below the waterline’ i.e. which are not publicly accessible, provided that what is disclosed sufficiently indicates the scope of the discretion and the manner of its exercise.
(vi) The degree and effectiveness of the supervision or oversight of the executive by independent Commissioners is of great importance, and can, for example in such a case as Kennedy, be a decisive factor."
	The changes made in this Act introduce a new regime, alongside the current Part 7 which is concerned with datasets in respect of which there is a low or no reasonable expectation of privacy. This test is one that is to be applied in all of the circumstances. 4 The new regime in the Act sets out certain factors, germane to the context, to which intelligence services must have particular regard when assessing the expectation of privacy. Authorisations for the retention, or retention and examination, of such a dataset may be granted by the head of an intelligence service, or a person acting on their behalf. The new regime includes a system of prior judicial approval to provide reassurance that assessments being made are appropriate. As with the other powers in the IPA 2016, there is also ex-post facto oversight by the IPC, and the redress mechanism of the Investigatory Powers Tribunal.
	The Act also makes minor changes to Part 7, extending the duration of BPD warrants from six months to twelve months. The changes also provide that certain functions that hitherto had to be performed by the head of the intelligence service – an agency head – can now formally be carried out on his or her behalf by a Crown Servant, in common with other functions in the IPA 2016 (such as applying for a warrant).