The Investigatory Powers Act 2016 and Connected Vehicles: a New Form of Panspectric Veillance Looming?

Connected and autonomous vehicles (CAVs) are anticipated to be the greatest disruption to travel seen in at least a generation.¹ Through the use of a variety of on-board sensors and cameras, CAVs are able to drive independently. These vehicles collect, process, and produce data from the vehicle’s cameras, LiDAR,² and RADAR³ sensors, along with the neural networks and emerging vehicular clouds where ‘vehicles can communicate with one another, form self-organized vehicular ad-hoc networks, collect real-time sensing data, conduct intensive computation, and disseminate information’.⁴ While the true ‘full self-driving’ features of CAVs are only beginning to be tested through access given to a restricted group of members of the public (based on their safety records),⁵ the data generated by CAVs to enable their (current) semi-autonomous⁶ features have already led to concerns being raised relating to users and non-users’ privacy,⁷ and these are advancing with each further step along the autonomous vehicle, Society of Automotive Engineers (SAE), scale.⁸

The Investigatory Powers Act (IPA) 2016 aimed to bring communications data retention within a single, clear piece of legislation.⁹ Section 87 of the IPA 2016 enables the Secretary of State, subject to approval, to issue to telecommunications operators and communication service providers (CSPs) a notice compelling them to retain, for a period of up to 12 months,¹⁰ communications data. These data may be retained for a purpose as outlined in section 61(7) which includes (a) in the interests of national security; (b) for the purpose of preventing or detecting crime or of preventing disorder; (d) in the interests of public safety; and (g) for the purpose of preventing (or mitigating against) death or injury or any damage to a person’s physical or mental health.¹¹ Consequently, intelligence agencies and law enforcement bodies are able to conduct targeted interception of communications,¹² and in certain instances without a warrant.¹³ It should be noted from the outset that the obligation to retain is not exclusive¹⁴ to the Secretary of State and Judicial Commissioner,¹⁵ but also a variety of relevant public authorities under the guise of the state. The Government sought to introduce authorizations through an Investigatory Powers Commissioner (IPC)¹⁶ to ensure independence in the process. This, however, overlooks the fact that the IPC is also the reviewer and auditor of said authorizations.¹⁷

As will be demonstrated throughout this paper, the IPA 2016 contains many examples of imprecise definitions of many significant aspects of its content, thereby expanding its reach to affect a wide group of devices such as phones, computers, refrigerators, and CAVs. Whether this is intentional or otherwise will be tested latterly by the courts, however, to begin with just one example, a significant difference between IPA 2016 and the (previous incarnation) Data Retention and Investigatory Powers Act (DRIPA) 2014 is the omission of the word ‘public’ in telecommunications operators, which thereby extended the application of the data retention obligations to private sector entities including hosted services offering communications to businesses, or those running cloud-based communications services on behalf of businesses.¹⁸ Indeed a conclusion may be drawn that the government was slowly reintroducing, by stealth, the wide reaching application of its failed Draft Communications Data Bill.¹⁹

Collectively, the generation of data and their intrinsic link to those people who use and, in some cases, come into contact with these items, along with their collection and potential for (ab)use requires examination. In the academic literature, so far these discussions have been largely restricted to the ethics of the use of the data produced, along with some discussion of drivers’ privacy.²⁰ What is clear from the application of the IPA 2016 and the emerging use of CAVs is the potential infringement of individuals’ human rights through creating what has been termed by Portela and Cruz-Cunha ‘panspectric veillance’.²¹ Here people are, unbeknown to them, subject to surveillance. CAVs produce vast quantities of data,²² and there is increasing evidence of data breaches occurring with the transmission of these data (despite promises of the adoption of privacy-by-design features being embedded in the vehicles).²³ Given the latitude in definitions, the extent of the (at least somewhat unconstrained)²⁴ powers, and the limited safeguards present in the IPA 2016, the state is able to access ever more data about people, their movements, their connections, their habits and their interests than ever before.

Our aim is to raise the potential problems that the IPA 2016 presents for individuals’ privacy, especially in the context of CAV use, how the definitions within the Act are sufficiently expansive to encompass CAV OEMs as being susceptible to data retention notices, and their culmination in the breaches of individuals’ privacy through the IPA 2016 and CAVs. We conclude that caution might have to be exercised by users in the deployment of CAVs, and that the IPA 2016 itself should be reconsidered to avoid breaches of the European Convention on Human Rights (ECHR) and individuals’ privacy generally.

This paper critiques the extent and application of the IPA 2016 with the increasing prevalence of CAVs, the data they produce and are thus available for retention purposes. The definitions within the IPA 2016 and the applicability to CAV OEMs will be considered later, but we begin here with a general outline of the problem of legislating with definitional certainty and law’s race to keep up with technological change. From the outset it must be acknowledged that there is great skill in the drafting of well-written and clearly articulated legislation. Indeed, as noted by Dickerson, it embodies the most rigorous form of writing outside of mathematics.²⁵ Furthermore, as discussed in this journal by Watson-Brown,²⁶ plain English being used in legislation is of supreme importance in legal drafting, yet often remains definitionally elusive. He rightly notes the distinction between simplicity of language and effective communication, ensuring that

This led to Watson-Brown’s critique of Coode’s formula for legislation,²⁸ a formula which should consist of the description of the legal subject, enunciation of the legal action, and when the law is not of universal application, the following dimensions should be added to the formula: the description of the case to which the legal action is confined. And finally, the conditions on performance of which the legal action operates. However, Watson-Brown, at page 18, observes that such a formulaic approach leads to materials which are difficult to understand, with the reader being ‘confronted with a series of conditional propositions before knowing who is to do what’. The IPA 2016 is, by necessity, a complex piece of legislation. It facilitates the retention of data, the requests for and interception of communications data, allows for the bulk warrants for communications data and equipment interference. Yet many of its definitions and powers are not completely defined and are open for interpretation. Given the scope for increased surveillance, which was the purpose of the Act, clarity of definitions to articulate the extent of the powers, especially those which operate extra-territorially and may cause jurisdictional problems, are of the upmost significance. It is also the breadth of the IPA 2016 which impacts on the clarity and increasing scope of the legislation. It was in the Regulation of Investigatory Powers Act 2000, to DRIPA 2014 and most recently the IPA 2016, where the obligation to retain has expanded from telephone companies and Internet Service Providers (ISPs) to include websites, cloud-based services, controllers of networks, devices, apps, software, hardware, and internet of things (IoT) objects. The obligation to retain could be interpreted to apply to almost anything that communicates, and its application to normal and seemingly mundane items, especially those which people have frequent contact with—their mobile telephone and their car (for instance), has implications for their privacy and wider human rights.

This brings us to an issue Moses,²⁹ among others, has examined, the reasons and responses to law’s race to keep up to date with technological change. Laws in this area can move quickly, and developments have been identified above, but ultimately technology and its increasingly data driven and connected nature can supersede the laws which interact, affect, and/or govern it. Due to the perception that law may struggle at times to realize the implications of future changes, suggestions have been advanced around improved statutory drafting techniques and technology-neutral legislation which operates effectively in different technological contexts. Yet technological-neutral drafting is likely to be successful for existing technologies and less so for changing technological environments. This debate is not new. In the jurisprudence of the United States, such discussions were raised in respect of the legal problems affecting emerging technologies in the rail industry in 1858,³⁰ and human interactions with computerized automated systems have been discussed by Teubner.³¹ Yet it is the reason for the legal problems and how they arise in respect of technological change, understood from the perspective of legislating, which requires examination. In respect of the analysis we provide of the IPA 2016 and its extension through the data...