Commentary on Sections
Part 2: Regulation of surveillance
Chapter 1: Regulation of CCTV and other surveillance camera technology
Section 29: Code of practice for surveillance camera systems
149.Subsection (1) requires the Secretary of State to prepare a code of practice in relation to surveillance camera systems. The term ‘surveillance camera systems’ is defined in subsection (6), which includes Closed Circuit Television (“CCTV”) and Automatic Number Plate Recognition (“ANPR”) systems. Subsection (2) stipulates that the code must include guidance in relation to the development or use of such systems, or the use and processing of images derived from them. The latter could include, for example, what images are retained; how they are stored and for how long; and to what uses they might subsequently be put.
150.Subsection (3) lists more detailed issues that may be included in the code. These include advice about factors to consider when deciding whether the use of such equipment is appropriate (subsection (3)(a)); standards for equipment and operators (subsection (3)(c),(f) and (g)); and the provision of information to the public about aspects of such systems, including complaints procedures (subsection (3)(e) and (i)).
151.Subsection (4) provides that the code need not provide guidance in relation to every type of surveillance camera system. This is intended primarily to avoid a requirement to provide comprehensive guidance in relation to niche or emerging technologies not yet likely to have widespread application. It further provides that the extent of any guidance provided need not be identical in respect of each type of system, or may be suitably tailored to the type and usage of the system in question.
152.Subsection (5) requires the Secretary of State when preparing a code of practice to consult certain specified bodies and office holders, namely: the representative bodies of persons required to have regard to the code (as provided for in section 33(1)); the Association of Chief Police Officers; the Information Commissioner (responsible for the oversight of the Data Protection Act 1998; the Chief Surveillance Commissioner (appointed under Part 3 of the Police Act 1997 and responsible for oversight of the conduct of covert surveillance and covert human intelligence sources under that Act and the Regulation of Investigatory Powers Act 2000; the Surveillance Camera Commissioner (see section 34); and the Welsh Ministers. Other persons may be added to this list at the discretion of the Secretary of State.
Section 30: Issuing of the code
153.This section sets out the parliamentary procedure for approving the first surveillance camera code made under the preceding section. Subsection (1) requires the Secretary of State to lay the proposed code before Parliament together with a draft order bringing the code into force. Such an order is subject to the affirmative resolution procedure (subsection (2)). If the draft order bringing into force the first code of practice is not approved the Secretary of State is required to prepare a revised code; the draft order bringing such a revised code into force is again subject to the affirmative procedure (subsection (4 )).
154.Subsection (7) disapplies the hybridity procedure should such procedure apply to the order made under this section. Some statutory instruments which need to be approved by both Houses are ruled to be hybrid instruments because they affect some members of a group (be it individuals or bodies) more than others in the same group. Hybrid instruments are subject to a special procedure which gives those who are especially affected by them the opportunity to present their arguments against the statutory instrument to the Hybrid Instruments Committee and then, possibly, to a Select Committee charged with reporting on its merits. The hybrid instrument procedure is unique to the House of Lords and the process must be completed before the instrument can be approved by both Houses.
Section 31: Alteration or replacement of the code
155.This section places a duty on the Secretary of State to keep the surveillance camera code of practice under review; the Secretary of State may, in the light of such a review, amend the existing code or substitute a new code (subsection (1)). Subsection (2) requires that in making any alteration to the code or when introducing a new code the Secretary of State must again consult the persons listed in section 29(5). Subsections (3) to (9) makes provision relating to the issuing of a replacement or amended code. In particular, either House of Parliament has 40 days (excluding any period during which Parliament is not sitting for more than four days) in which to pass a resolution refusing to approve the code. If such a resolution is passed then the Secretary of State may prepare another code of practice or amended code of practice for resubmission. Where no resolution is passed, the replacement or amended code will come into force at the end of the 40-day period.
Section 32: Publication of code
156.This section requires the Secretary of State to publish the surveillance camera code of practice once approved under section 30, and any subsequent revisions to that code or any replacement code.
Section 33: Effect of code
157.Subsection (1) provides that certain specified bodies or organisations (referred to as a “relevant authority”) must have regard to the code if they operate or intend to operate any surveillance camera systems covered by the code. The bodies designated in the first instance as relevant authorities are set out in subsection (5), namely local authorities, police and crime commissioners and chief officers of police.
158.Subsection (5)(k) provides that the Secretary of State may, by order (subject to the affirmative resolution procedure (subsection (9))), designate other individuals or bodies, or descriptions thereof, as “relevant authorities” for the purposes of this section, thus requiring such designated bodies also to have regard to the code. Such an order may provide that a person designated as a relevant authority by virtue of such order is only required to have regard to the surveillance camera code of practice when discharging specified functions or acting in a specified capacity (subsection (6) and (7)). This is intended to provide for those instances where certain bodies have a dual role or multiple roles or, for example, exercise both public functions and private sector functions, and where the duty to have regard to the code may therefore be limited to the exercise of one, or one part of, their functions. Before making such an order the Secretary of State must consult the persons to be affected by it, or their representative body, together with other specified persons (subsection (8)). Subsection (10) disapplies the hybridity procedure should such procedure apply to an order made under subsection (5)(k).
159.Subsection (2) provides that a failure to adhere to any aspects of the code of practice would not, of itself, render a person liable to civil or criminal proceedings. However, the surveillance camera code is admissible in criminal or civil proceedings (subsection (3)) and a court or tribunal may take into account any failure of a relevant authority to comply with the duty to have regard to the code (subsection (4)).
Section 34: Commissioner in relation to code
160.Subsection (1) requires the Secretary of State to appoint a Surveillance Camera Commissioner. Subsection (2) sets out the Commissioner’s responsibilities, namely promoting and encouraging compliance with the surveillance camera code of practice amongst users; reviewing how the code is working; and providing advice about the code (which may include, for example, advice to users of surveillance systems, members of the public, and Ministers as necessary). Subsection (3) makes provision for the terms of the Commissioner’s appointment and for the payment of allowances to the Commissioner and of his or her expenses. Subsection (4) enables the Secretary of State to provide staff, accommodation, equipment and other facilities to support the work of the Commissioner.
Section 35: Reports by Commissioner
161.Section 35 requires the Commissioner to send an annual report to the Secretary of State who must, in turn, lay the report before Parliament. The Commissioner must publish the report (subsection (1)).
Section 36: Interpretation: Chapter 1
162.Section 36 contains definitions of the terms “the Commissioner”, “surveillance camera code” and “surveillance camera systems” as used in this Chapter.
Chapter 2 of Part 2: Safeguards for certain surveillance under RIPA
Section 37: Judicial approval for obtaining or disclosing communications data
163.Section 37 inserts new sections 23A and 23B into the Regulation of Investigatory Powers Act 2000 (“RIPA”) which provide a procedure by which local authority authorisations or notices to obtain “communications data”, or renewals of those authorisations or notices, can only come into effect if approved by a relevant judicial authority. In England and Wales, the judicial authority is a justice of the peace (Magistrates’ Court), in Northern Ireland it is a district judge (magistrates’ court) and in Scotland, a sheriff. The section also provides a mechanism by which the requirement for judicial approval may be applied to authorisations or notices granted by officials in other public authorities by order made by the Secretary of State.
164.Communications data is defined in section 21 of RIPA. In summary it is information such as telephone numbers dialled, times of calls, details of callers and receivers, and website addresses. In the case of postal items, communications data includes anything written on the outside of the item. Under Chapter 2 of Part 1 of RIPA, conduct consisting in the acquisition or disclosure of communications data is rendered lawful if it is authorised or carried out pursuant to an authorisation or notice granted or given in accordance with the provisions in sections 22 and 23 of RIPA.
165.Authorisations must not be granted or renewed, and notices must not be given or renewed, save by a person of a description designated by order under section 25(2) of RIPA. The designated person must not grant or renew an authorisation, or give or renew a notice, unless they believe that it is necessary to obtain the data on grounds specified in section 22 of RIPA, and that obtaining the data in question is proportionate to what is sought to be achieved by obtaining the data. By section 25(3), the Secretary of State may by order impose restrictions on the types of authorisations or notices that may be granted by individuals within specified public authorities, and on the circumstances in which, and the purposes for which, authorisations may be granted or notices given by those individuals. In the case of local authorities, such designated persons must be staff of at least Director, Head of Service or Service Manager grade or equivalent. These designated persons may not grant authorisations or notices save for the purpose of preventing or detecting crime or preventing disorder (see the Regulation of Investigatory Powers (Communications Data) Order 2010 (SI 2010/480)).
166.New section 23A(1) of RIPA provides that new section 23A applies where a “relevant person” has granted or renewed an authorisation, or given or renewed a notice under section 22 of RIPA. New section 23A(6) defines a “relevant person” for these purposes as either a designated person within a local authority in England, Wales or Scotland, or a designated person in Northern Ireland where the grant, renewal or authorisation relates to an excepted or reserved matter. A relevant person may also be any other person of a description prescribed by order of the Secretary of State. Such an order cannot make provision in relation to a matter that has been transferred to the competence of the Northern Ireland Assembly. An order made by the Secretary of State to prescribe additional relevant persons to whom the judicial approval requirement will apply would be subject to the affirmative resolution procedure (new section 23A(7)). By this mechanism the requirement to obtain judicial approval for the use of the powers to obtain or disclose communications data will only initially apply to local authorities, but the Secretary of State will subsequently be able to extend the requirement to other public bodies able to exercise these powers.
167.New section 23A(2) provides that an authorisation or notice granted or renewed under the relevant provisions in section 22 of RIPA will not take effect until the “relevant judicial authority” has given its approval. The relevant judicial authority is defined in new section 23A(6).
168.New section 23A(3) sets out the test for the judicial approval of a local authority authorisation, or renewal of an authorisation, to obtain communications data. The relevant judicial authority must be satisfied that not only were there reasonable grounds for the designated person to believe that obtaining communications data was necessary and proportionate (subsection (3)(a)(i)), but that there also remain reasonable grounds for believing so (subsection (3)(b)). The judicial authority must also be satisfied that the “relevant conditions”, which relate to the authorisation or notice, were met (subsection (3)(a)(ii)). New section 23A(4) sets out the same test for the judicial approval of the giving and renewal of notices to obtain communications data.
169.New section 23A(5) lists the relevant conditions that must be met if the relevant judicial authority is to approve the making or renewing of an authorisation or notice. For local authorities, in England, Wales and Scotland (and in Northern Ireland where the authorisation or notice is granted or given for the purpose relating to an excepted or reserved matter), these conditions are: (a) whether the person making the authorisation was of the correct office, rank or position and was accordingly a designated person within the meaning of Chapter 2 of Part 1 of RIPA; (b) whether the authorisation or notice was in breach of any other restrictions imposed by the Secretary of State by virtue of the power at section 25(3); and (c) whether the authorisation or notice satisfied any other conditions set out in an order (subject to the negative resolution procedure) made by the Secretary of State. In relation to conditions (a) and (b), the Regulation of Investigatory Powers (Communications Data) Order 2010 (SI 2010/480) applies. For authorisations or notices granted or given by public authorities other than local authorities to which the judicial approval requirement may in the future be applied, the relevant conditions are those that will be set out in an order (subject to the negative resolution procedure) made by the Secretary of State. New section 23A(6) defines various terms used in new section 23A.
170.New section 23B sets out the procedure for obtaining judicial approval for an authorisation, or notice, to obtain communications data.
171.New section 23B(1) provides that the public authority to which the relevant person (authorising officer) belongs may apply for approval from the relevant judicial authority for an authorisation or a notice to obtain communications data. The relevant person is not required to apply in person; the same procedure applies to renewals.
172.New section 23B(2) provides that notice of such applications need not be given to either the subject of the authorisation or notice or to their legal representatives; this reflects the covert nature of the exercise of the investigatory powers under RIPA.
173.New section 23B(3) allows the relevant judicial authority on refusing an approval of an authorisation or a notice to quash that authorisation or notice.
Section 38: Judicial approval for directed surveillance and covert human intelligence sources
174.Subsection (1) inserts new sections 32A and 32B into RIPA which provide a procedure by which local authority authorisations in England, Wales and Northern Ireland for the use of directed surveillance and the conduct and use of covert human intelligence sources (“CHIS”) can only come into effect if approved by a relevant judicial authority. In England and Wales the judicial authority is a justice of the peace (Magistrates’ Court). In Northern Ireland it is a district judge (magistrates’ court). The requirements also apply to renewals of authorisations. The section further provides a mechanism by which the requirement for judicial approval may be applied to authorisations granted by officials in other public authorities by order made by the Secretary of State.
175.Directed surveillance is defined in section 26(2) of RIPA as covert surveillance otherwise than by way of an immediate response to events or circumstances for the purpose of a specific investigation which is likely to obtain private information and which is not intrusive surveillance (that is, it is not surveillance carried out in relation to anything taking place on residential premises or in any private vehicle). A CHIS is defined in section 26(8) of RIPA as a person who establishes or maintains a personal or other relationship with another for, amongst other things, the covert purpose of using such a relationship to obtain or disclose information to others.
176.Under Part 2 of RIPA, directed surveillance or the conduct and use of a CHIS is rendered lawful if it is authorised and carried out pursuant to an authorisation granted under section 28 of RIPA (for directed surveillance) or section 29 of RIPA (for CHIS). An authorisation may not be granted except by a person designated by order made under section 30(1) of RIPA. The designated person must not grant or renew the authorisation unless they believe that the conduct is necessary on grounds specified in section 28(3) or section 29(3) of RIPA, and that the conduct is proportionate to what is sought to be achieved by carrying it out. By section 30(3), the Secretary of State may by order impose restrictions on the types of authorisations that may be granted by individuals within specified public authorities, and on the circumstances in which and the purposes for which authorisations may be granted or renewed by those individuals. In the case of local authorities, such designated persons must be staff of at least Director, Head of Service or Service Manager grade or equivalent. These designated persons must not grant or renew the authorisations save for the purposes of preventing or detecting serious crime or preventing disorder (see the Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Services) Order 2010 (SI 2010/521)).
177.New section 32A(1) provides that new section 32(A) applies where a “relevant person” has granted an authorisation under section 28 (authorisation of directed surveillance) or section 29 (authorisation of CHIS) of RIPA. New section 32A(7) defines a relevant person for these purposes as either a designated person in a local authority in England and Wales, or a designated person in Northern Ireland where the grant relates to an excepted or reserved matter. A relevant person may also be any other person of a description prescribed by order of the Secretary of State. Such an order cannot make provision in relation to a matter that has been transferred to the competence of the Northern Ireland Assembly. An order made by the Secretary of State to prescribe additional relevant persons to whom the judicial approval requirement will apply would be subject to the affirmative resolution procedure (new section 32A(8)). By this mechanism the requirement to obtain judicial approval for the use of the powers in respect of directed surveillance or CHIS will only initially apply to local authorities, but the Secretary of State will subsequently be able to extend the requirement to obtain judicial approval to other public bodies able to exercise these powers.
178.New section 32A(2) provides that an authorisation granted under the relevant provisions in section 28 or section 29 of RIPA will not take effect until the “relevant judicial authority” has given its approval. The relevant judicial authority for these purposes is defined in new section 32A(7).
179.New section 32A(3) sets out the test for the judicial approval of an authorisation in respect of directed surveillance. The relevant judicial authority must be satisfied that not only were there reasonable grounds for the designated person within the local authority to believe that using directed surveillance was necessary and proportionate (subsection (3)(a)(i)), but that there also remain reasonable grounds for believing so (subsection (3)(b)). The relevant judicial authority must also be satisfied that any other “relevant conditions” which relate to the authorisation were met (subsection (3)(a)(ii)).
180.New section 32A(4) lists the relevant conditions which must be met if the relevant judicial authority is to approve the granting of an authorisation in respect of directed surveillance. For local authorities in England and Wales (and in Northern Ireland where the authorisation or notice is granted or given for a purpose relating to an excepted or reserved matter) the conditions are: (a) whether the person making the authorisation was of the correct office, rank or position and was accordingly a designated person for the purposes of section 29 of RIPA; (b) whether the authorisation was in breach of any other restrictions imposed by the Secretary of State by virtue of the power at section 30(3); and (c) whether the authorisation or notice satisfied any other conditions set out in an order (subject to the negative resolution procedure) made by the Secretary of State. In relation to conditions (a) and (b), the Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) Order 2010 (SI 2010/521) applies. For authorisations granted by public authorities other than local authorities to which the judicial approval requirement may in the future be applied, the relevant conditions are those that will be set out in an order (subject to the negative resolution procedure) made by the Secretary of State.
181.New section 32A(5) sets out the test for the judicial approval of the granting of an authorisation to use CHIS. The relevant judicial authority must be satisfied that there were reasonable grounds for the designated person within the local authority to believe that using a CHIS was necessary and proportionate in that case, and that there remain reasonable grounds for believing so. The relevant judicial authority will also need to be satisfied that when the authorisation was granted there were reasonable grounds for believing, and there remain reasonable grounds for believing, that the arrangements for the source’s case satisfied the requirements of section 29(5) of RIPA (which includes arrangements relating to the oversight of the source, the welfare of the source and record keeping) and any additional requirements that have been imposed by order made by the Secretary of State under section 29(7)(b) of RIPA were satisfied. The judicial authority must also be satisfied that the “relevant conditions” which relate to the authorisation were met (subsection (5)(a)(ii)).
182.New section 32A(6) lists the other relevant conditions that must be met if the relevant judicial authority is to approve the granting of an authorisation in respect of the use of a CHIS by a local authority. In the case of an authorisation granted by a local authority in England and Wales (and in Northern Ireland where the authorisation is granted in relation to an excepted or reserved matter), the conditions are: (a) that whether the person granting the authorisation was of the correct office, rank or position and was therefore a designated person within the meaning of section 29 of RIPA; (b) whether the authorisation was in breach of any prohibition imposed by an order made under section 29(7)(a) or any restrictions made by the Secretary of State by virtue of the power at section 30(3); and (c) whether the authorisation or notice satisfied any other conditions that may be set out in an order (subject to the negative resolution procedure) made by the Secretary of State. In respect of the second of these conditions, the Regulation of Investigatory Powers (Juveniles) Order 2010 (SI 2000/2793) imposes certain restrictions where the CHIS is under the age of 18 and the Regulation of Investigatory Powers (Covert Human Intelligence Sources: Matters Subject to Legal Privilege) Order 2010 (SI 2010/123) imposes certain restrictions to protect information that is legally privileged. In relation to the first and second conditions, the Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) Order 2010 (SI 2010/521) applies. For public authorities other than local authorities to which the judicial approval requirement may in the future be applied, the relevant conditions are those to be set out in an order (subject to the negative resolution procedure) made by the Secretary of State.
183.New section 32A(7) defines various terms used in new section 32A.
184.New section 32B sets out the procedure for obtaining judicial approval to use directed surveillance or a CHIS.
185.New section 32B(1) provides that the authority to which the relevant person (authorising officer) belongs may apply for approval of the authorisation of the use of directed surveillance or a CHIS by the relevant judicial authority. The relevant person is not required to apply in person.
186.New section 32B(2) provides that notice of such applications for approval need not be given to either the subject of the authorisation or to their legal representatives; this reflects the covert nature of the exercise of the investigatory powers under RIPA.
187.New section 32B(3) allows the relevant judicial authority on refusing an approval of an authorisation to quash that authorisation.
188.Subsection (2) amends section 43 of RIPA to make provision for renewals of authorisations for the conduct or use of a CHIS. The renewal may not be approved by the relevant judicial authority unless it is satisfied that a review has been carried out by the authority of the use made of the source and the tasks given to the source within the meaning of section 43(7) of RIPA. The relevant judicial authority must consider the results of the review before approving the renewal.
