Draft Regulations laid before Parliament under section 267(3)(b) of the Investigatory Powers Act 2016 for approval by resolution of each House of Parliament.
Draft Statutory Instruments
Investigatory Powers
Made
***
Coming into force in accordance with regulation 1
The Secretary of State makes the following Regulations in exercise of the powers conferred by section 46(2) of the Investigatory Powers Act 2016(1).
In accordance with section 267(3)(b) of that Act, a draft of these Regulations was laid before Parliament and approved by a resolution of each House of Parliament.
1. These Regulations may be cited as the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 and come into force on the day on which section 46 of the Act (interception by businesses etc. for monitoring and record-keeping purposes) comes into force for all purposes.
2. In these Regulations—
“the Act” means the Investigatory Powers Act 2016;
“communications relevant to the carrying on of relevant activities” means—
communications by means of which transactions are entered into in the course of the relevant activities, or
other communications relating to the relevant activities or taking place in the course of the carrying on of those activities;
“regulatory or self-regulatory practices or procedures” means—
practices or procedures compliance with which is required or recommended by, or by virtue of—
any provision of the law of a member State or other state within the European Economic Area, or
any standard or code of practice established by or on behalf of a body established in a member State or other state in the European Economic Area which includes amongst its objectives the publication of standards or codes of practice for the carrying on of relevant activities, or
practices or procedures which are otherwise applied for the purpose of ensuring compliance with anything so required or recommended;
“system controller” means, in relation to a particular telecommunication system, a person with a right to control its operation or use.
3.—(1) Conduct is authorised for the purpose of section 46(1) of the Act if—
(a)it consists of the interception of a communication, in the course of its transmission by means of a telecommunication system, which is effected by or with the express consent of the system controller;
(b)it is conduct to which paragraph (2), (3) or (4) applies, and
(c)the requirements in regulation 4 are met.
(2) This paragraph applies to the monitoring or keeping a record of communications—
(a)in order to establish the existence of facts;
(b)in order to ascertain compliance with regulatory or self-regulatory practices or procedures which are applicable, in the carrying on of relevant activities, to—
(i)the system controller, or
(ii)another person where that person is supervised by the system controller in respect of those practices or procedures;
(c)in order to ascertain or demonstrate the standards which are achieved or ought to be achieved by persons using the telecommunication system in the course of their duties;
(d)in the interests of national security;
(e)for the purpose of preventing or detecting crime;
(f)for the purpose of investigating or detecting the unauthorised use of that or any other telecommunication system;
(g)in order to secure, or as an inherent part of, the effective operation of the telecommunication system.
(3) This paragraph applies to the monitoring of communications for the purpose of determining whether they are communications relevant to the carrying on of relevant activities.
(4) This paragraph applies to the monitoring of communications made to a confidential counselling or support service which is free of charge (other than the cost, if any, of the communication) and operated in such a way that users may remain anonymous if they so choose.
4.—(1) Conduct is authorised by regulation 3 only if—
(a)the interception is effected solely for the purpose of monitoring or (where appropriate) keeping a record of communications relevant to the carrying on of relevant activities by the system controller;
(b)the telecommunication system is provided for use wholly or partly in connection with those relevant activities;
(c)the system controller has made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted, and
(d)in a case to which regulation 3(2)(d) applies, the person by or on whose behalf the interception is effected is one of the persons listed in section 18(1)(a) to (g) of the Act.
(2) In addition to the requirements in paragraph (1), conduct for a purpose falling within regulation 3(2)(a) to (c) is authorised only to the extent permitted by Article 5 of Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector(2).
Name
Minister of State
Home Office
Date
(This note is not part of the Regulations)
Section 3 of the Investigatory Powers Act 2016 (c. 25) (“the Act”) makes it an offence if a person intentionally intercepts a communication in the course of its transmission by means of a telecommunication system without lawful authority. Chapter 2 of Part 2 of the Act provides a number of ways in which the interception of communications may have lawful authority. They include section 46(1) of the Act, which gives the Secretary of State the power to make regulations authorising conduct which appears to the Secretary of State to constitute a legitimate practice reasonably required for the purpose, in connection with the carrying on of any relevant activities, of the monitoring or keeping a record of certain communications. “Relevant activities” are defined in section 46(4) of the Act, and include any business.
Regulation 3 sets out the conduct that is authorised by these Regulations. Conduct is authorised by these Regulations if it consists of the interception of a communication for one of the purposes listed in paragraphs (2), (3) or (5) of regulation 3. The interception must be effected by or with the express consent of a person who has the right to control the operation or use of the telecommunication system by means of which the communication is being transmitted.
Regulation 4 imposes further limits on the conduct that can be authorised by regulation 3.
A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sectors is foreseen.
O.J. No. L24, 30.1.1998, p.1, amended by O.J. L337, 18.12.2009, p.11.