Data Retention and Investigatory Powers Act 2014

Retention of relevant communications data

Section 1: Powers for retention of relevant communications data subject to safeguards

28. Subsection (1) replaces provisions in the 2009 Regulations to allow the Secretary of State to give a notice to a telecommunications service provider requiring the retention of data. The notice may require the retention of ‘relevant communications data’, defined in section 2(1) as the data types set out in the Schedule to the 2009 Regulations. The Schedule includes data falling into the categories of fixed network telephony (part 1), mobile telephony (part 2), and internet access, internet e-mail or internet telephony (part 3). Section 1 creates the additional safeguard that the Secretary of State must consider whether it is necessary and proportionate to give the notice for one or more of the purposes set out in section 22(2) of RIPA. These purposes, which are the same purposes for which retained data can be accessed under RIPA, are:

a)

in the interests of national security;

b)

for the purpose of preventing or detecting crime or of preventing disorder;

c)

in the interests of the economic well-being of the United Kingdom;

d)

in the interests of public safety;

e)

for the purpose of protecting public health;

f)

for the purpose of assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department;

g)

for the purpose, in an emergency, of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health; or

h)

for any purpose (not falling within paragraphs (a) to (g)) which is specified for the purposes of section 22(2) by an order made by the Secretary of State.

29. The economic well-being purpose for which communications data may be accessed is amended in section 3 of the Act and this change feeds through into the corresponding purpose for the retention of relevant communications data.

30. The Secretary of State has previously added the following further purposes:

a.

to assist investigations into alleged miscarriages of justice, or

b.

where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition-

i.

to assist in identifying P, or

ii.

to obtain information about P’s next of kin or other persons connected with P or about the reason for P’s death or condition.

31. Telecommunications service providers will not be required to retain data unless they have been given a notice by the Secretary of State.

32. Subsection (2) lists the issues a notice may cover. Paragraph (a) specifies that the notice can apply to a specific telecommunications service provider. Alternatively, it can provide a description of providers to ensure that all those that fit the description are required to retain data. Paragraph (b) provides that a notice may require the retention of all data or any description of data. A notice cannot require the retention of data types other than those that were required to be retained by the 2009 Regulations, but may limit the requirement to a subset of these data types where appropriate. Paragraph (c) allows for a retention notice to specify the period or periods for which data is to be retained. Paragraph (d) provides for a notice to include requirements and restrictions in relation to data retention. Therefore, for example, a notice could require a provider to keep data retained under a notice in a separate store from data retained for other purposes. Paragraph (e) allows for a notice to make different data types subject to different provisions so, for example, there may be a requirement to retain different types of data for different periods of time. Paragraph (f) permits the data retention notice to apply to data whether or not the data is in existence at the time of the notice. If the data is in existence the maximum amount of time new regulations would permit it to be retained will still be 12 months (see subsection (5)).

33. Subsection (3) allows for the Secretary of State to make regulations relating to the retention of relevant communications data. These regulations will replace the 2009 Regulations.

34. Subsection (4) gives examples of the matters that may be provided for in the regulations. This includes: what the Secretary of State should consider before issuing a notice; the procedure for when the notice will come into force, including variation or revocation; the integrity and security of the retained data; enforcement and auditing compliance; a code of practice which will provide specific guidelines on data retention; the reimbursement of telecommunications service providers who incur costs while fulfilling any obligations in their notice; and the transitional measures from the 2009 Regulations.

35. Subsection (5) specifies that the maximum retention period which can be provided for in the regulations made under subsection (3) is 12 months from a date specified in the regulations.

36. Subsection (6) specifies that data retained under the provisions in this legislation can only be acquired through Chapter 2 of Part 1 of RIPA, through an order of the court or other judicial warrant or authorisation, or as specified in regulations made under subsection (3).

37. Subsection (7) permits the Secretary of State to make regulations which apply any provision that is capable of being made by virtue of subsections (4)(d) to (4)(g) or subsection (6) to data that is retained on a voluntary basis under the Anti-terrorism, Crime and Security Act 2001 (“ATCSA”). This power could be used to apply the safeguards in the regulations to data retained under the ATCSA.