Investigatory Powers Act 2016

229 Main oversight functions U.K.

(1) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation) the exercise by public authorities of statutory functions relating to—

(a) the interception of communications,

(b) the acquisition or retention of communications data,

(c) the acquisition of secondary data or related systems data under Chapter 1 of Part 2 or Chapter 1 of Part 6, or

(d) equipment interference.

(2) Such statutory functions include, in particular, functions relating to the disclosure, retention or other use of—

(a) any content of communications intercepted by an interception authorised or required by a warrant under Chapter 1 of Part 2 or Chapter 1 of Part 6,

(b) acquired or retained communications data,

(c) data acquired as mentioned in subsection (1)(c), or

(d) communications, equipment data or other information acquired by means of equipment interference.

(3) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation)—

(a) the acquisition, retention, use or disclosure of bulk personal datasets by an intelligence service,

(b) the giving and operation of notices under section 252 (national security notices),

(c) the exercise of functions by virtue of section 80 of the Serious Crime Act 2015 (prevention or restriction of use of communication devices by prisoners etc.),

(d) the exercise of functions by virtue of sections 1 to 4 of the Prisons (Interference with Wireless Telegraphy) Act 2012,

(e) the exercise of functions by virtue of Part 2 or 3 of the Regulation of Investigatory Powers Act 2000 (surveillance, covert human intelligence sources and investigation of electronic data protected by encryption etc.),

(f) the adequacy of the arrangements by virtue of which the duties imposed by section 55 of that Act are sought to be discharged,

(g) the exercise of functions by virtue of the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp 11) (surveillance and covert human intelligence sources),

(h) the exercise of functions under Part 3 of the Police Act 1997 (authorisation of action in respect of property),

(i) the exercise by the Secretary of State of functions under sections 5 to 7 of the Intelligence Services Act 1994 (warrants for interference with wireless telegraphy, entry and interference with property etc.), and

(j) the exercise by the Scottish Ministers (by virtue of provision made under section 63 of the Scotland Act 1998) of functions under sections 5 and 6(3) and (4) of the Act of 1994.

[F1 (3A) The Investigatory Powers Commissioner must, in accordance with the Agreement between the Government of the United Kingdom and the Government of the United States of America on access to electronic data for the purpose of countering serious crime dated 3rd October 2019, keep under review the compliance by public authorities with the terms of that Agreement.]

[F2 (3B) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation) the process operated by GCHQ for determining whether information about vulnerabilities in technology should be disclosed.

(3C) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation) compliance by the persons mentioned in subsection (3D) with “The Principles Relating to the Detention and Interviewing of Detainees Overseas and the Passing and Receipt of Intelligence Relating to Detainees”, as published on 18th July 2019.

(3D) Those persons are—

(a) members and civilian staff of the metropolitan police force who are carrying out activities to which a collaboration agreement made under section 22A of the Police Act 1996 relating to counter-terrorism activities applies, and

(b) officers of the National Crime Agency.]

(4) But the Investigatory Powers Commissioner is not to keep under review—

(a) the exercise of any function of a relevant Minister to make subordinate legislation,

(b) the exercise of any function by a judicial authority,

(c) the exercise of any function by virtue of Part 3 of the Regulation of Investigatory Powers Act 2000 which is exercisable with the permission of a judicial authority,

(d) the exercise of any function which—

(i) is for the purpose of obtaining information or taking possession of any document or other property in connection with communications stored in or by a telecommunication system, or

(ii) is carried out in accordance with an order made by a judicial authority for that purpose,

and is not exercisable by virtue of this Act, the Regulation of Investigatory Powers Act 2000, the Regulation of Investigatory Powers (Scotland) Act 2000[F3 , the Crime (Overseas Production Orders) Act 2019] or an enactment mentioned in subsection (3)(c), (h), (i) or (j) above,

(e) the exercise of any function where the conduct concerned is—

(i) conduct authorised by section 45, 47 or 50, or

(ii) conduct authorised by section 46 which is not conduct by or on behalf of an intercepting authority (within the meaning given by section 18(1)), or

(f) the exercise of any function which is subject to review by the Information Commissioner or the Investigatory Powers Commissioner for Northern Ireland.

[F4 (4A) In keeping matters under review in accordance with subsection (3)(e), the Investigatory Powers Commissioner must, in particular, keep under review the exercise of the power to grant or renew authorisations under section 29B of the Regulation of Investigatory Powers Act 2000.

(4B) In keeping under review the exercise of the power mentioned in subsection (4A), the Investigatory Powers Commissioner must, in particular, keep under review whether public authorities are complying with any requirements imposed on them by virtue of Part 2 of the Regulation of Investigatory Powers Act 2000 in relation to juvenile criminal conduct authorisations and vulnerable adult criminal conduct authorisations.

(4C) For the purposes of subsection (4B)—

(a) “a juvenile criminal conduct authorisation” is an authorisation under section 29B of the Regulation of Investigatory Powers Act 2000 where the covert human intelligence source to whom the authorisation relates is under the age of 18; and

(b) “a vulnerable adult criminal conduct authorisation” is an authorisation under section 29B of the Regulation of Investigatory Powers Act 2000 where the covert human intelligence source to whom the authorisation relates is a vulnerable adult within the meaning of section 29D(3) of that Act.]

(5) In keeping matters under review in accordance with this section, the Investigatory Powers Commissioner must, in particular, keep under review the operation of safeguards to protect privacy.

(6) In exercising functions under this Act, a Judicial Commissioner must not act in a way which the Commissioner considers to be contrary to the public interest or prejudicial to—

(a) national security,

(b) the prevention or detection of serious crime, or

(c) the economic well-being of the United Kingdom.

(7) A Judicial Commissioner must, in particular, ensure that the Commissioner does not—

(a) jeopardise the success of an intelligence or security operation or a law enforcement operation,

(b) compromise the safety or security of those involved, or

(c) unduly impede the operational effectiveness of an intelligence service, a police force, a government department or Her Majesty's forces.

(8) Subsections (6) and (7) do not apply in relation to any of the following functions of a Judicial Commissioner—

(a) deciding—

(i) whether to serve, vary or cancel a monetary penalty notice under section 7 or paragraph 16 of Schedule 1, a notice of intent under paragraph 4 of that Schedule or an information notice under Part 2 of that Schedule, or

(ii) the contents of any such notice,

(b) deciding whether to approve the issue, modification or renewal of a warrant,

(c) deciding whether to direct the destruction of material or how otherwise to deal with the situation where—

(i) a warrant issued, or modification made, for what was considered to be an urgent need is not approved, or

(ii) an item subject to legal privilege is retained, following its examination, for purposes other than the destruction of the item,

(d) deciding whether to—

(i) approve the grant, modification or renewal of an authorisation, or

(ii) quash or cancel an authorisation or renewal,

(e) deciding whether to approve—

(i) the giving or varying of a retention notice under Part 4 or a notice under section 252 or 253, or

(ii) the giving of a notice under section 90(10)(b) or 257(9)(b),

(f) participating in a review under section 90 or 257,

(g) deciding whether to approve an authorisation under section 219(3)(b),

(h) deciding whether to give approval under section 222(4),

(i) deciding whether to approve the giving or varying of a direction under section 225(3),

(j) making a decision under section 231(1),

(k) deciding whether to order the destruction of records under section 103 of the Police Act 1997, section 37 of the Regulation of Investigatory Powers Act 2000 or section 15 of the Regulation of Investigatory Powers (Scotland) Act 2000,

(l) deciding whether to make an order under section 103(6) of the Police Act 1997 (order enabling the taking of action to retrieve anything left on property in pursuance of an authorisation),

(m) deciding—

(i) an appeal against, or a review of, a decision by another Judicial Commissioner, and

(ii) any action to take as a result.

[F5 (8A) Subsections (6) and (7) also do not apply in relation to the functions of the Investigatory Powers Commissioner under section 60A or 65(3B).]

(9) In this section—

• “bulk personal dataset” is to be read in accordance with section 199,

• “equipment data” has the same meaning as in Part 5 (see section 100),

• “judicial authority” means a judge, court or tribunal or any person exercising the functions of a judge, court or tribunal (but does not include a Judicial Commissioner),

• “police force” has the same meaning as in Part 2 (see section 60(1)),

• “related systems data” has the meaning given by section 15(6),

• “relevant Minister” means a Minister of the Crown or government department, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department,

• “secondary data” has the same meaning as in Part 2 (see section 16).

Textual Amendments

F1 S. 229(3A) inserted (18.9.2020) by The Functions of the Investigatory Powers Commissioner (Oversight of the Data Access Agreement between the United Kingdom and the United States of America and of functions exercisable under the Crime (Overseas Production Orders) Act 2019) Regulations 2020 (S.I. 2020/1009), regs. 1, 2(a)

F2 S. 229(3B)-(3D) inserted (8.12.2022) by The Investigatory Powers Commissioner (Oversight Functions) Regulations 2022 (S.I. 2022/1299), regs. 1(1), 2

F3 Words in s. 229(4)(d) inserted (18.9.2020) by The Functions of the Investigatory Powers Commissioner (Oversight of the Data Access Agreement between the United Kingdom and the United States of America and of functions exercisable under the Crime (Overseas Production Orders) Act 2019) Regulations 2020 (S.I. 2020/1009), regs. 1, 2(b)

F4 S. 229(4A)-(4C) inserted (10.8.2021 for specified purposes, 15.9.2021 for specified purposes, 30.9.2021 in so far as not already in force) by Covert Human Intelligence Sources (Criminal Conduct) Act 2021 (c. 4), ss. 7(2), 9(2); S.I. 2021/605, reg. 2(a)(b)(c)

F5 S. 229(8A) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 25 (see S.I. 2019/174, reg. 2(c))

Modifications etc. (not altering text)

C1 S. 229(4)(f) power to repeal words conferred (1.9.2017) by Investigatory Powers Act 2016 (c. 25), ss. 240(5)(b), 272(1) (with Sch. 9 paras. 7, 8, 10); S.I. 2017/859, reg. 2(i) (with regs. 6-11)

C2 S. 229(6)(7) applied (12.2.2019 for specified purposes, 13.8.2020 in so far as not already in force) by Counter-Terrorism and Border Security Act 2019 (c. 3), s. 27(1)(g), Sch. 3 para. 62(5) (with s. 25(9)); S.I. 2020/792, reg. 2(g)

Commencement Information

I1 S. 229(1) in force at 12.3.2018 for specified purposes by S.I. 2018/341, reg. 2(b)(i)

I2 S. 229(1)(a)-(c) in force at 1.9.2017 by S.I. 2017/859, reg. 2(d)(i) (with reg. 3(1)(a))

I3 S. 229(1)(d) in force at 27.6.2018 in so far as not already in force by S.I. 2018/652, reg. 11(a)(i)

I4 S. 229(2)(a)-(c) in force at 1.9.2017 by S.I. 2017/859, reg. 2(d)(ii) (with reg. 3(1)(b))

I5 S. 229(2)(d) in force at 27.6.2018 by S.I. 2018/652, reg. 11(a)(i)

I6 S. 229(3)(a) (c)-(j) in force at 1.9.2017 by S.I. 2017/859, reg. 2(d)(iii)

I7 S. 229(3)(b) in force at 12.3.2018 by S.I. 2018/341, reg. 2(b)(ii)

I8 S. 229(4) in force at 1.9.2017 by S.I. 2017/859, reg. 2(d)(iv) (with reg. 3(2)-(5))

I9 S. 229(5) in force at 1.9.2017 by S.I. 2017/859, reg. 2(d)(v)

I10 S. 229(6)(7) in force at 13.2.2017 by S.I. 2017/137, reg. 2(d)

I11 S. 229(8) in force at 27.6.2018 for specified purposes by S.I. 2018/652, reg. 11(a)(ii)

I12 S. 229(8)(a) in force at 1.9.2017 by S.I. 2017/859, reg. 2(d)(vi) (with reg. 3(6))

I13 S. 229(8)(b)(c) in force at 5.2.2019 by S.I. 2019/174, reg. 2(e)

I14 S. 229(8)(d)(i) in force at 1.9.2017 for specified purposes by S.I. 2017/859, reg. 2(d)(vi)

I15 S. 229(8)(d)(i) in force at 5.2.2019 in so far as not already in force by S.I. 2019/174, reg. 2(e)

I16 S. 229(8)(d)(ii) in force at 1.9.2017 by S.I. 2017/859, reg. 2(d)(vi) (with reg. 3(6))

I17 S. 229(8)(e)(f) in force at 1.11.2018 in so far as not already in force by S.I. 2018/873, reg. 4(b)

I18 S. 229(8)(e)(i) in force at 12.3.2018 for specified purposes by S.I. 2018/341, reg. 2(b)(aa)(iii)

I19 S. 229(8)(e)(ii) in force at 12.3.2018 for specified purposes by S.I. 2018/341, reg. 2(b)(bb)(iii)

I20 S. 229(8)(f) in force at 12.3.2018 for specified purposes by S.I. 2018/341, reg. 2(b)(cc)(iii)

I21 S. 229(8)(g)-(i) in force at 22.8.2018 by S.I. 2018/873, reg. 3(d)

I22 S. 229(8)(j)-(m) in force at 1.9.2017 by S.I. 2017/859, reg. 2(d)(vi) (with reg. 3(6))

I23 S. 229(9) in force at 13.2.2017 for specified purposes by S.I. 2017/137, reg. 2(e)

I24 S. 229(9) in force at 1.9.2017 for specified purposes by S.I. 2017/859, reg. 2(d)(vii)

I25 S. 229(9) in force at 27.6.2018 in so far as not already in force by S.I. 2018/652, reg. 11(a)(i)