Digital Extraction Code of Practice consultation – Police Crime Sentencing and Courts Act 2022

Submitted on 19 July 2022

• See the government’s consultation response.
• See the Home Office consultation document (now closed).

About the Victims’ Commissioner

The Victims’ Commissioner for England and Wales is dedicated to promoting the interests of victims and witnesses.

The role of Victims’ Commissioner is set down in the Domestic Violence, Crime and Victims Act 2004:

• promote the interests of victims and witnesses;
• take such steps as she considers appropriate with a view to encouraging good practice in the treatment of victims and witnesses;
• keep under review the operation of the code of practice issued under section 32

The Commissioner is appointed by Ministers but is independent of government.  She is committed to representing all victims and witnesses and has a particular focus on those who are most vulnerable. She seeks to be transparent in all her activities, placing her correspondence with ministers and criminal justice agencies onto her website (https://victimscommissioner.org.uk/).  She is committed to make sure the voice of the victim is heard in all policy and practice across the criminal justice system.

Preamble

I was delighted when government listened to me and others and included amendments to the digital extraction clauses in the Police Crime Sentencing and Courts Bill (now Act 2021) which improved on my original amendment drafts and will provide victims with greater protection against intrusion of their Article 8 rights when they report serious sexual violence.  This draft Code of Practice (dCoP) is intended to provide detailed guidance on the lawful use of these powers and to ensure the highest standards of professionalism and compliance with this legislation. It is certainly a good start but, in my opinion, it could be improved.  It requires detailed guidance for officers and in its current iteration only serves to reinforce the legislation without much practical detail. The aim of the legislation and the Code is to bring about a change in current practice so that in particular rape complainants are no longer subject to the gross invasion of privacy that they have had to suffer in recent years simply because they have made an allegation. The dCoP will not, as stands, achieve this aim but with additional information and by input from victims’ groups it has potential to make this change.

Of course, it is imperative that government then also addresses the situation with regard to so-called third-party material so that whilst victims’ private lives are better protected from intrusion by this legislation; they are still suffering vast intrusion via material in the hands of third parties.

I am pleased that the secretary of state has made this a public consultation rather than just consulting those he is bound to consult under the legislation. It is vital we get the Code right to ensure that victims are adequately protected.

I have addressed your specific questions below, but I have some overarching comments.

Whilst the dCoP does cover the basics of the legislation, there is little in the way of specific guidance here. It is vital that the Code of Practice makes really clear the expectations of government in the application of the legislation, examples and scenarios are often very helpful in doing this, there are none here.  There are also more specific issues around some of the dCoP for example whilst reference is made to the National Police Chiefs Council (NPCC) data processing notice (DPN) there is nothing in the dCoP which compels its use by all forces, the Code is the perfect vehicle to make clear to forces that they should be using the NPCC notice, indeed greater specificity in the written notice is also required.

There should be greater detail and better safeguards around what constitutes agreement and indeed how that is recorded, strict-necessity and proportionality which could include examples of other means of obtaining the data, there should for example be a reminder that screen shots have long been held to be admissible.

The section on vulnerability is potentially problematic (see below) and should be re-drafted in conjunction with experts in serious sexual violence and in the listed vulnerabilities.

I would also encourage some cross referencing/ navigation within the document so for example in the section about obtaining consent in Part 3 there should be a link to the later section in Part 5 where this is referenced, so it is clear where there is overlap for authorised persons using the Code.

I have long advocated for free independent legal advice and advocacy for victims when their Article 8 rights are in play and do so again in this submission. This is a legal process which most ordinary people are ill equipped to navigate, just as suspects are entitled to free representation from a lawyer at the police station to ensure their rights are protected, so too should victims be afforded this help.  This representation should obviously be by lawyers, the consideration of the tests within the Criminal Procedure and Investigations Act 1996 and its Code (CPIA), the case precedents on these points, in particular in respect of third-party material the case of R v Alibhai [2004] EWCA Crim 681 (Alibhai) referred to by the Information Commissioner in his recent opinion and the balancing of Article 6 with Article 8 rights being complex questions of law. 

A final overarching point which has been made by The Centre for Women’s Justice (CWJ), Rape Crisis England and Wales (RCEW) et al in their response to this consultation is that the dCoP is constructed around the Human Rights Act 1998 and the Data Protection Act 2018 as the foundational framework for extraction, at the time of writing the government intends to repeal the Human Rights Act 1998 and to ‘reform’ the Data Protection Act 2018, which leaves victims and victims’ groups with a high degree of uncertainty in reading and commenting upon this dCoP.

As Victims’ Commissioner I have limited my comments to the operation of section 37 for law enforcement purposes as it impacts victims.

The Consultation Questions

Part 1 of the code provides information on when the section 37 and 41 powers can be used and the criteria that must be met before doing so.

Q1. To what extent do you agree or disagree with the guidance the code of practice provides on the circumstances in which the powers can be used and the requirements that must be met?

a) for Section 37?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

This section should be read with caution as although it does outline the current position, we know that government is looking to repeal or otherwise amend the relevant legislation.

In paragraphs 12-14 the effect of the dCoP is outlined which specifies that although failure to follow the code doesn’t leave the individual authorised person liable to criminal or civil proceedings, the Code is admissible evidence and could be used in criminal or civil proceedings to help determine the question in the case, there is an example of admissibility, but this should be expanded to include other possible outcomes such as judicial review.

There should also be more detail on the specific likely outcomes for officers failing to comply, so that it is clear government’s intention that the Code will be followed.

Part 2 of the code provides an overview of how the new powers interact with the data protection regimes of the Data Protection Act and the UK General Data Protection Regulation (UK GDPR), and human rights legislation.

Q2. To what extent do you agree or disagree with the guidance that the code of practice provides on the exercise of the powers in accordance with data protection and human rights legislation?

a) for Section 37?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

This section should be read with caution as although it does outline the current position, we know that government is looking to repeal or otherwise amend the relevant legislation.

I would signpost the response of the Information Commissioner’s office who have greater expertise in this area. I am pleased to see Article 8 rights front and centre though, as it is the routine infringement of victims’ Article 8 rights that led to the government introducing these balancing amendments into this legislation.

Part 3 of the code provides information on when and for what purposes the section 37 and 41 powers can be used, and guidance on reasonable belief, necessity, and proportionality requirements.

Q3. To what extent do you agree or disagree with the guidance offered in the code on assessing necessity, proportionality, relevance to reasonable line of enquiry or reasonable belief when determining when the powers in sections 37 and 41 should be used?

a) for Section 37?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer, including any alternative approaches or changes to the guidance you think are needed

This is section requires further work.

Firstly, I would urge government to use examples that clearly demonstrate to the user of the Code how they might assess what is reasonable, necessary and proportionate or otherwise. So, for example this section doesn’t explicitly state that downloading and scrutinising the entirety of a victim’s phone is very unlikely to meet these tests; that should be explicit. Although the principle of reasonable line of enquiry will differ from case to case as will proportionality and necessity some clear examples could help enormously here. 

Secondly, it should be made very clear what kind of alternative means of obtaining material should be considered.

Thirdly, over and above the first point I agree with CWJ, RCEW et al the safeguards contained in the dCoP to prevent excessive download are inadequate. The test of ‘unless reasonably practicable’ is not the proportionality test set out in data protection legislation which insists that information extracted is minimised and could mean that the entirety of a victim’s device is downloaded due to the limitations in technology of that particular police force.

Allied to this para 52 also outlines that as part of the necessity and proportionality test the authorised person must be satisfied that the purpose cannot be achieved through less intrusive means. It helpfully lists other methods which may avoid extracting excess information but later at paragraph 48 this is qualified with:

“The authorised person should consider the value of the information extracted for the relevant purpose and where possible ensure that the amount of information extracted is minimised.”                                                                                                                                                                                                                                                                                                                                                                     

The test is not ‘where possible’ information extracted should be minimised. The legal requirement in the DPA should be more clearly stated.

Paragraph 49 reiterates the ‘unless reasonably practicable’ test in the legislation, I have been troubled by this since the original drafts. This is incompatible with the legal framework in the DPA. It is not mentioned anywhere in the key case of R v Carl Bater-James and Sultan Mohammed [2020] EWCA Crim 790. Processing on a less intrusive basis is always the aim to meet the requirement that processing is strictly necessary and proportionate, and a lack of practicability is not a reason to opt out of this aim.  The Code must be clear that the least intrusive means of processing is necessary to meet the strict necessity and proportionality tests.

I do not disagree with the suggestion from CWJ, RCEW et al in their submission that there should be a review mechanism in this regard, but I am firm that victims require free legal representation as outlined further below.

Part 4 of the code provides guidance on the criteria that must be met for a person to be treated as having voluntarily provided a device and agreed to the extraction of information from it.

Q4. To what extent do you agree or disagree with the guidance the code of practice provides on how authorities meet the requirements stated in section 37(1) in the Act, to ensure a person has voluntarily provided their device and agreed to the extraction of information from it?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

I have concentrated the bulk of my response here as it is in the operation of section 37 that victims are most implicated.  I have provided specific comments on numbered paragraphs below but overarchingly this section needs more detail and contains some missed opportunities.

I also endorse the comments of CWJ, RCEW et al in their submission about the written agreement and notice. These must contain full details including what specific information is sought and how it pertains to a reasonable line of enquiry, what less excessive means have been considered and a rationale of why the information extraction is deemed necessary and proportionate. The notice should further contain information about how collateral information will be managed, when the device is likely to be returned and how a complaint can be made if a request is thought to be excessive.

Voluntary provision, agreement and undue pressure

83. There is mention here of consent in writing, I think this dCoP is a missed opportunity to mandate that forces should be using the current NPCC data processing notice (DPN).  The current position is that whilst forces are encouraged to use this, they do not have to and the NPCC have no powers to compel them to do so.  The Code should create an expectation on forces that this will be standard practice. 

Additionally, I have been working with the NPCC on the current DPN and have urged them to create both an ‘easy read’ and an ‘easier to read’ version of the DPN.  This legal document is quite impenetrable for most people, especially when you consider the average reading age in the UK is 9 years, hence an easier to read version is necessary especially as currently very few victims if any have access to legal advice to assist them with this decision. Indeed, very few have access to non-legal support such as an Independent sexual violence adviser (ISVA).

The easy read version is necessary for those victims who have learning disabilities or difficulties, in order that they can be participants in the process, notwithstanding that they may not be able to give consent themselves – see comments below on adults without capacity and vulnerability.

Indeed, there is an easy read and an easier to read (aimed at young people) summary of rights for suspects under the Police and Criminal Evidence Act 1984 and its Code which should be provided to them as a matter of course it is only right and fair that victims are given a similar opportunity to understand what their rights are in situations where they are asked to waive them or partially waive them.

85. I would argue that truly informed consent to this legal process cannot be given in the absence of free independent legal advice from a qualified lawyer.  I know government is looking at this possibility following the End-to-End Rape Review (EERR), I take this opportunity to once again urge government to expedite this and to include access to legal advice and advocacy in the Code. The impenetrability of the consent form serves to demonstrate just how complicated this is for a non-legally qualified person let alone one who has experienced trauma to navigate.

87. The written notice is key and of course the NPCC DPN mentioned above does contain a section for officers to make clear their reasoning for pursuing such information but I have heard from stakeholders that where this new DPN is in use it is not always being filled out before being presented to victims for a signature, some officers are presenting a blank form and advising victims that they will fill it in after the event.  This clearly links to the point above (85) about informed consent.  It needs to be explicit in the Code that signed blank forms do not prove informed consent, indeed arguably the opposite.  Forms must be completed as outlined in point 87 prior to the authorised person seeking consent.

88. They should be informed about their opportunities to change their minds and withdrawal of consent.

90. As above I would assert this is a missed opportunity and the Code should explicitly state that forces are expected to use the current NPCC DPN.

Confirmation of voluntary provision and agreement

92. This section in lieu of further detail is dangerous. The Code should mandate provision of an easy read notice, this section should link to the section on vulnerability, and I am disappointed that there is no mention of intermediaries in this section or indeed at all.  There is no mention here of people who do not speak English or have English as a second language, this is a serious oversight, and the Code should be clear that in such circumstances an interpreter must be provided including a BSL interpreter for anyone who is deaf. I would urge government to ensure they work with those who represent victims who may fall into this category so that they are truly participants in the process and to ensure necessary safeguards for their Article 8 rights.

93. It seems very difficult to prove a lack of coercion via a record made by the authorised person.  I would urge that proper safeguards are put in place for those who are unable to provide written consent due to literacy or learning difficulties or having English as a second language. The already existing power imbalance between most victims and the authorised person is clearly heightened for those who fall into these categories and this again illustrates why free independent legal advice is in the interests not just of victims but also of the authorised person who can then demonstrate clearly that there has been no coercion.

Part 5 of the code provides guidance on what authorised persons should consider using the section 37 power with persons who may be vulnerable due to the trauma they have experienced, and who may need more support to make an informed decision as to whether they volunteer their device and agree to the data extraction from it.

Q5. To what extent do you agree or disagree with the guidance that the code of practice provides on how to recognise when a person is vulnerable?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

In my opinion this section requires quite a lot of further work, I think that it is vital government works with sector experts to make sure this section protects vulnerable victims from being coerced into providing information and to ensure their Article 8 rights are protected.  It attempts to offer greater protection for people who have experienced trauma but is too vague.  The list of potential vulnerabilities is lengthy but there is no explanation of the ways in which these vulnerabilities may overlap, interact or how they may mean a different approach is needed.  For example, the approach an authorised person may need to take with someone who is vulnerable due to trauma may be different to the approach they take with someone who is vulnerable because of a learning disability, which depending on the severity may mean they also fall into the category of being an adult without capacity.

I also have concerns about the lack of explanation of how trauma can impact decision making ability and what that means in the context of consent.

I am also concerned about the ways in which vulnerability is currently sometimes used as a reason to discontinue an investigation or not to charge an offence.  For example, I hear anecdotally that the mental health of a victim (particularly in rape cases) is sometimes cited as a reason to discontinue the case or is assessed to undermine the victim’s credibility as a witness. I worry that vulnerability may be seen as a reason to obtain more material from a victim and the implications this has for this process of seeking agreement. It would be terrible if the Code of Practice exacerbated this already problematic practice.

Q6. To what extent do you agree or disagree with the guidance that the code of practice provides on how a vulnerable person should be supported?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

Although it is undoubtedly positive that the dCoP allows for people considered vulnerable to be given extra support there are issues here:

Para 114. Lists people who could provide support to a vulnerable personwhich can include both specialist services and a friend or relative, whilst where there is no support service or ISVA available a friend or relative is preferable to no support.  The nature of that support is likely to be very different from the support an ISVA or specialist service could give, and all of these support options are not equal to proper legal advice and representation.  I would again use this opportunity to argue that it is imperative victims be given access to free independent legal advice.

Additionally, depending on the relationship to the victim (See para 131) the supporter may in fact not always have the victim’s wishes or even best interests as their primary concern.  I can foresee a situation where the supporter may think they are acting in the victim’s best interest by encouraging them to agree to a download when in fact this is not what the victim would want or may lead to the victim incriminating themselves in some way, although I understand that it is impossible for the Code to cover every possible scenario, it is why I think that this section would greatly benefit from input from sexual violence sector experts and other experts who represent the types of vulnerable people listed.

Para 124 Additionally, as stated elsewhere the code should mandate easy read and easier to read version of the DPN.

Para 129 There is an opportunity here to list alternative means of obtaining material such as screen shots.

Para 131 I have concerns about alternative coercive powers being used against victims in circumstances where they do not see themselves as victims, this should only occur as an absolute last resort.  This should be made very clear in the Code.

Para 132 Although it is true that some victims may feel more comfortable at home for some victims the idea of police being in their home could be highly upsetting and/or intimidating.  It is important that the needs and wishes of victims are properly considered here.

Para 133 Although I understand that the government made a commitment in the EERR to return phones to rape victims within 24 hours, I have cautioned against speed being the main target here lest it encourages more wholesale downloads as this is quicker/ easier for the police. It would be encouraging to see a link here guidance on targeted downloads such as the College of Policing Guidance Authorised Professional Practice Guidance.

Part 6 of the code provides information on who is deemed to be a child or an adult without capacity for the purposes of the powers, who can make a decision on their behalf, and how they should be engaged with and supported during the process.

Q7. To what extent do you agree or disagree with the guidance the code of practice provides on who is considered a child, how authorities must where possible involve and support them, and who can make decisions on their behalf?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

I again would urge consultation with experts on children’s rights and safeguarding.

Para 145 There should be some discussion of what happens in circumstances that an allegation has been made against someone within the organisation, there is a clear conflict of interest if for example an allegation is made by a child against a worker at their care home and another worker is asked to provide agreement on their behalf.

Para 147 – 151 The police should not be able to ask another police officer to act as responsible person when they are looking to use the power for the purpose of preventing, detecting, investigating or prosecuting crime even in circumstances where the officer performs a different function.

Q8. To what extent do you agree or disagree with the guidance the code of practice provides on who is considered an adult without capacity, how authorities must where possible involve and support them, and who can make decisions on their behalf?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

I again would urge consultation with experts on adults without capacity and safeguarding. I spoke with Stay Safe East (SSE) who unfortunately do not have the resource to be able to respond to this consultation, they raised serious concerns about social workers and parents/ guardians/ carers acting as ‘consenting adult’. Government must work with expert groups such as SSE to ensure this Code is as comprehensive as possible and that appropriate safeguards are in place to avoid any abuse of power or over intrusion on this cohort.

Ruth Bashall (Policy and Projects Adviser from Stay Safe East) has concerns about contexts where the parent/family member/guardian is the abuser which she feels are not adequately addressed in the code.

She says, whilst the dCoP talks about adults without capacity, the legislation is clear that very few people have no capacity at all and in this scenario of the police wanting to access someone’s phone, if the person completely lacks capacity to consent, it is unlikely (though possible) that they would have the capacity to use a mobile phone independently. This means that the vulnerability section is vitally important as in her opinion this will reflect the majority of victims in the adult with learning disabilities category.   

It is important that family members are only involved once it has clearly been established that they are not the source of or linked to the abuse.

It should not be left to a family member to explain what is in fact a complex legal situation.  This should be undertaken as a form of assisted/supported decision making by an advocate who has the skills to evaluate whether the victim understands the implications of consenting (ISVA, IDVA, learning disability advocate if appropriate, IMHA etc.).  This would also help make sure that the victim is signposted to specialist support or advocacy support for further support.

Ruth feels strongly that using someone other than family, guardian or social worker (whom many disabled people don’t trust) should be the default position.

I would also signpost the appropriate adult scheme which operates for suspects.  Though not without its faults this has safeguards in place to help avoid conflicts of interest and could be used as a basis for drawing up a similar framework for this victim cohort.

My comments above for Q7 also apply here.

Part 7 of the code provides guidance on applicable devices, ensuring that the extraction of information is not excessive and that the intrusion into the device user’s privacy and the privacy of others is minimised.

Q9. To what extent do you agree or disagree with the guidance the code of practice provides on applicable devices for extraction, and the recommendation that selective extraction should be used where possible to minimise intrusion into the device user’s privacy?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

In addition to my earlier comments in Part 3 some of which are pertinent here, I would emphasise referencing other guidance such as the College of Policing guidance mentioned above would helpful.  I also think this is a good place to add that speed should not come at the sacrifice of specificity.

Part 8 of the code sets out how authorised persons should consider confidential information when using these powers, including what confidential information is, guidance on how to assess the risk of obtaining confidential information and guidance on how to proceed depending on that risk assessment.

Q10. To what extent do you agree or disagree that with the approach the code of practice provides on how to assess and manage the risk of obtaining confidential material, and how to proceed when it is unintentionally obtained?

Strongly agree, Agree, Neither agree nor disagree, Disagree, Strongly disagree

Please explain the reason for your answer

I assume that you are referencing here para’s 54 onwards in Part 3 as I cannot find a Part 8.  If this is correct, I have no further comments.

Thinking now about the overall approach to the exercise of the powers that is recommended in the code.

Q11. In your view is the suggested approach to use of the powers detailed in the code one that can be implemented operationally?

Yes or No

Please explain the reason for your answer

The overall approach is a good start but will not as outlines above bring about the culture change needed here.

Q12. Are there any gaps in the guidance that should be addressed?

Yes or No

Please explain the reason for your answer

Please see other comments above

Q13. Does the code contain links to all relevant material that an authorised person would need in order to ensure lawful use of the powers?

Yes or No

There should also be links to the NPCC DPN, the College of Policing Guidance Authorised Professional Practice Guidance.

For further information please email victims.commissioner@victimscommissioner.org.uk.