4.—(1) Conduct is authorised by regulation 3 only if—
(a)the interception is effected solely for the purpose of monitoring or (where appropriate) keeping a record of communications relevant to the carrying on of relevant activities by the system controller;
(b)the telecommunication system is provided for use wholly or partly in connection with those relevant activities;
(c)the system controller has made all reasonable efforts to inform every person who may use the telecommunication system that communications transmitted by means of that system may be intercepted, and
(d)in a case to which regulation 3(2)(d) applies, the person by or on whose behalf the interception is effected is one of the persons listed in section 18(1)(a) to (g) of the Act.
(2) In addition to the requirements in paragraph (1), conduct for a purpose falling within regulation 3(2)(a) to (c) is authorised only to the extent permitted by Article 5 of Directive 2002/58/EC of the European Parliament and of the Council of 12th July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector(1).
O.J. No. L24, 30.1.1998, p.1, amended by O.J. L337, 18.12.2009, p.11.