Part III

Investigation of electronic data protected by encryption etc.

Power to require disclosure

Notices requiring disclosure
49
1
This section applies where any protected information—
a
has come into the possession of any person by means of the exercise of a statutory power to seize, detain, inspect, search or otherwise to interfere with documents or other property, or is likely to do so;
b
has come into the possession of any person by means of the exercise of any statutory power to intercept communications, or is likely to do so;
c
has come into the possession of any person by means of the exercise of any power conferred by an authorisation under section 22(3) or under Part II, or as a result of the giving of a notice under section 22(4), or is likely to do so;
d
has come into the possession of any person as a result of having been provided or disclosed in pursuance of any statutory duty (whether or not one arising as a result of a request for information), or is likely to do so; or
e
has, by any other lawful means not involving the exercise of statutory powers, come into the possession of any of the intelligence services, the police or the customs and excise, or is likely so to come into the possession of any of those services, the police or the customs and excise.
2
If any person with the appropriate permission under Schedule 2 believes, on reasonable grounds—
a
that a key to the protected information is in the possession of any person,
b
that the imposition of a disclosure requirement in respect of the protected information is—
i
necessary on grounds falling within subsection (3), or
ii
necessary for the purpose of securing the effective exercise or proper performance by any public authority of any statutory power or statutory duty,
c
that the imposition of such a requirement is proportionate to what is sought to be achieved by its imposition, and
d
that it is not reasonably practicable for the person with the appropriate permission to obtain possession of the protected information in an intelligible form without the giving of a notice under this section,
the person with that permission may, by notice to the person whom he believes to have possession of the key, impose a disclosure requirement in respect of the protected information.
3
A disclosure requirement in respect of any protected information is necessary on grounds falling within this subsection if it is necessary—
a
in the interests of national security;
b
for the purpose of preventing or detecting crime; or
c
in the interests of the economic well-being of the United Kingdom.
4
A notice under this section imposing a disclosure requirement in respect of any protected information—
a
must be given in writing or (if not in writing) must be given in a manner that produces a record of its having been given;
b
must describe the protected information to which the notice relates;
c
must specify the matters falling within subsection (2)(b)(i) or (ii) by reference to which the notice is given;
d
must specify the office, rank or position held by the person giving it;
e
must specify the office, rank or position of the person who for the purposes of Schedule 2 granted permission for the giving of the notice or (if the person giving the notice was entitled to give it without another person’s permission) must set out the circumstances in which that entitlement arose;
f
must specify the time by which the notice is to be complied with; and
g
must set out the disclosure that is required by the notice and the form and manner in which it is to be made;
and the time specified for the purposes of paragraph (f) must allow a period for compliance which is reasonable in all the circumstances.
5
Where it appears to a person with the appropriate permission—
a
that more than one person is in possession of the key to any protected information,
b
that any of those persons is in possession of that key in his capacity as an officer or employee of any body corporate, and
c
that another of those persons is the body corporate itself or another officer or employee of the body corporate,
a notice under this section shall not be given, by reference to his possession of the key, to any officer or employee of the body corporate unless he is a senior officer of the body corporate or it appears to the person giving the notice that there is no senior officer of the body corporate and (in the case of an employee) no more senior employee of the body corporate to whom it is reasonably practicable to give the notice.
6
Where it appears to a person with the appropriate permission—
a
that more than one person is in possession of the key to any protected information,
b
that any of those persons is in possession of that key in his capacity as an employee of a firm, and
c
that another of those persons is the firm itself or a partner of the firm,
a notice under this section shall not be given, by reference to his possession of the key, to any employee of the firm unless it appears to the person giving the notice that there is neither a partner of the firm nor a more senior employee of the firm to whom it is reasonably practicable to give the notice.
7
Subsections (5) and (6) shall not apply to the extent that there are special circumstances of the case that mean that the purposes for which the notice is given would be defeated, in whole or in part, if the notice were given to the person to whom it would otherwise be required to be given by those subsections.
8
A notice under this section shall not require the making of any disclosure to any person other than—
a
the person giving the notice; or
b
such other person as may be specified in or otherwise identified by, or in accordance with, the provisions of the notice.
9
A notice under this section shall not require the disclosure of any key which—
a
is intended to be used for the purpose only of generating electronic signatures; and
b
has not in fact been used for any other purpose.
10
In this section “senior officer”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body corporate; and for this purpose “director”, in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate.
11
Schedule 2 (definition of the appropriate permission) shall have effect.