Citation and commencement
1. These Regulations may be cited as the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 and come into force on the day on which section 46 of the Act (interception by businesses etc. for monitoring and record-keeping purposes) comes into force for all purposes.
Interpretation
2. In these Regulations—
“the Act” means the Investigatory Powers Act 2016;
“communications relevant to the carrying on of relevant activities” means—
communications by means of which transactions are entered into in the course of the relevant activities, or
other communications relating to the relevant activities or taking place in the course of the carrying on of those activities;
“regulatory or self-regulatory practices or procedures” means—
practices or procedures compliance with which is required or recommended by, or by virtue of—
any provision of the law of a member State or other state within the European Economic Area, or
any standard or code of practice established by or on behalf of a body established in a member State or other state in the European Economic Area which includes amongst its objectives the publication of standards or codes of practice for the carrying on of relevant activities, or
practices or procedures which are otherwise applied for the purpose of ensuring compliance with anything so required or recommended;
“system controller” means, in relation to a particular telecommunication system, a person with a right to control its operation or use.
Lawful interception of communications
3.—(1) Conduct is authorised for the purpose of section 46(1) of the Act if—
(a)it consists of the interception of a communication, in the course of its transmission by means of a telecommunication system, which is effected by or with the express consent of the system controller;
(b)it is conduct to which paragraph (2), (3) or (4) applies, and
(c)the requirements in regulation 4 are met.
(2) This paragraph applies to the monitoring or keeping a record of communications—
(a)in order to establish the existence of facts;
(b)in order to ascertain compliance with regulatory or self-regulatory practices or procedures which are applicable, in the carrying on of relevant activities, to—
(i)the system controller, or
(ii)another person where that person is supervised by the system controller in respect of those practices or procedures;
(c)in order to ascertain or demonstrate the standards which are achieved or ought to be achieved by persons using the telecommunication system in the course of their duties;
(d)in the interests of national security;
(e)for the purpose of preventing or detecting crime;
(f)for the purpose of investigating or detecting the unauthorised use of that or any other telecommunication system;
(g)in order to secure, or as an inherent part of, the effective operation of the telecommunication system.
(3) This paragraph applies to the monitoring of communications for the purpose of determining whether they are communications relevant to the carrying on of relevant activities.
(4) This paragraph applies to the monitoring of communications made to a confidential counselling or support service which is free of charge (other than the cost, if any, of the communication) and operated in such a way that users may remain anonymous if they so choose.
Restrictions on the lawful interception of communications
4.—(1) Conduct is authorised by regulation 3 only if—
(a)the interception is effected solely for the purpose of monitoring or (where appropriate) keeping a record of communications relevant to the carrying on of relevant activities by the system controller;
(b)the telecommunication system is provided for use wholly or partly in connection with those relevant activities;
(c)the system controller has made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted, and
(d)in a case to which regulation 3(2)(d) applies, the person by or on whose behalf the interception is effected is one of the persons listed in section 18(1)(a) to (g) of the Act.
(2) In addition to the requirements in paragraph (1), conduct for a purpose falling within regulation 3(2)(a) to (c) is authorised only to the extent permitted by Article 5 of Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector(1).
Ben Wallace
Minister of State
Home Office
8th March 2018