In April 2016 the human rights organisation Privacy International obtained a cache of documents which shed light on the British intelligence agencies’ bulk personal datasets, the collections of personal information about large numbers of people, the great majority of whom are of no interest to the agencies at all. The documents included admissions by government lawyers that much of the data had been supplied voluntarily by the organisations holding it. I spoke to Sputnik about them, and the interview is below.
What I said in 2016
“I suspect that some of the information was being supplied by email providers or organisations that handled emails as well.” Those organisations were likely to include the companies that run corporate email, since it was otherwise hard to see where legally privileged information or journalists’ communications could have been obtained on a voluntary basis, possibly in blatant breach of the Data Protection Act. “I’m also concerned about the level of scrutiny carried out by unknown and unnamed officials, something that reminds me of dark days and even dark regimes.” What had been disclosed was not documents about particular individuals but the policies that governed the collection of the data: “by reading those documents we can understand what type of information was being handled and how it was delivered.” Cohen Davis was then one of a minority of law firms using encrypted email with clients as a matter of routine, and the possibility that privileged communications between solicitor and client sat in a government dataset was, and is, the part of this that a lawyer cannot let pass.
What happened next
Privacy International’s challenge succeeded in part. In October 2016 the Investigatory Powers Tribunal ruled that the agencies’ collection of bulk personal datasets and bulk communications data had been unlawful for years, until the regimes were avowed and put under proper oversight in 2015. A month later Parliament passed the Investigatory Powers Act 2016, Part 7 of which put bulk personal datasets on a statutory footing for the first time: the agencies may retain and examine them only under a warrant approved by a Judicial Commissioner, and section 222 requires the Commissioner’s specific approval before anything subject to legal privilege is examined. The Investigatory Powers (Amendment) Act 2024 then loosened the regime for datasets in which, the Act says, people have little or no expectation of privacy, such as published material, allowing them to be held under a lighter form of authorisation. The argument this interview was part of, whether a democracy should let its agencies hold files on everyone in case some of them matter, was settled by Parliament in the agencies’ favour, with judges as the safeguard. Whether that safeguard is enough is a question I come back to in my 2026 series on how Britain regulates the internet.
First published 25 April 2016. Reviewed and updated 28 September 2026.