UK intelligence agencies seek to weaken data protection safeguards

UK intelligence agencies are requesting the government to ease surveillance laws to facilitate the training of AI models. GCHQ, MI5, and MI6 argue that the current safeguards hinder their ability to use large amounts of personal data required for AI analysis. The agencies have been employing AI technologies to analyze data sets, including bulk personal data sets (BPDs), which may contain sensitive information about individuals not of interest to the security services.

Currently, a judge’s approval is necessary for the examination and retention of BPDs, a process deemed “disproportionately burdensome” for publicly available datasets with minimal privacy expectations. Following a review of the Investigatory Powers Act, intelligence agencies propose replacing these safeguards with self-authorization. They claim that the bureaucratic processes impede talent recruitment and retention, particularly data scientists who face difficulties in obtaining warrants for standard open-source training data.

To address the issue, a new category of BPD is proposed, including data with low or no expectation of privacy, such as news articles, academic papers, public records, audiobooks, podcasts, and content from online video sharing platforms. Removing the need for a warrant to analyze these “low/no datasets” would expedite their use.

However, the final determination of datasets falling under this category should be made by ministers and judges, not the intelligence community. Data protection requirements under the Data Protection Act would still apply to these datasets, with additional authorization and safeguards. Civil liberties organizations, including Liberty and Privacy International, resist any proposal that weakens existing BPD safeguards, expressing concerns about privacy rights and accountability.