Investigatory Powers Act 2016 (c. 25)

Part 3 U.K. Authorisations for obtaining communications data

[F1 Further provision about authorisations] U.K.

Textual Amendments

F1 S. 62 cross-heading inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 2 (see S.I. 2019/174, reg. 2(c))

62 Restrictions in relation to internet connection records U.K.

[F2 (A1) The Investigatory Powers Commissioner may not, on the application of a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record.

(A2) The Investigatory Powers Commissioner may not, on the application of a relevant public authority which is not a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B or C is met.]

F3 (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) A designated senior officer of a relevant public authority which is not a local authority may not grant an authorisation for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B or C is met.

(3) Condition A is that [F4 the person with power to grant the authorisation] considers that it is necessary, for a purpose falling within [F5 section 60A(7), 61(7) or 61A(7) (as applicable)], to obtain the data to identify which person or apparatus is using an internet service where—

(a) the service and time of use are already known, but

(b) the identity of the person or apparatus using the service is not known.

(4) Condition B is that—

(a) the purpose for which the data is to be obtained falls within [F6 section 60A(7), 61(7) or 61A(7) (as applicable) but is not the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a) or the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b),] and

(b) [F7 the person with power to grant the authorisation] considers that it is necessary to obtain the data to identify—

(i) which internet communications service is being used, and when and how it is being used, by a person or apparatus whose identity is already known,

(ii) where or when a person or apparatus whose identity is already known is obtaining access to, or running, a computer file or computer program which wholly or mainly involves making available, or acquiring, material whose possession is a crime, or

(iii) which internet service is being used, and when and how it is being used, by a person or apparatus whose identity is already known.

(5) Condition C is that—

[F8 (a) either—

(i) the purpose for which the data is to be obtained is the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a), or

(ii) the purpose for which the data is to be obtained is the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b) and the crime to be prevented or detected is serious crime, and]

F9 (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c) [F10 the person with power to grant the authorisation] considers that it is necessary to obtain the data to identify—

(i) which internet communications service is being used, and when and how it is being used, by a person or apparatus whose identity is already known,

(ii) where or when a person or apparatus whose identity is already known is obtaining access to, or running, a computer file or computer program which wholly or mainly involves making available, or acquiring, material whose possession is a crime, or

(iii) which internet service is being used, and when and how it is being used, by a person or apparatus whose identity is already known.

F11 (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In this Act “internet connection record” means communications data which—

(a) may be used to identify, or assist in identifying, a telecommunications service to which a communication is transmitted by means of a telecommunication system for the purpose of obtaining access to, or running, a computer file or computer program, and

(b) comprises data generated or processed by a telecommunications operator in the process of supplying the telecommunications service to the sender of the communication (whether or not a person).

Textual Amendments

F2 S. 62(A1)(A2) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(2) (see S.I. 2019/174, reg. 2(c))

F3 S. 62(1) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(3) (see S.I. 2019/174, reg. 2(c))

F4 Words in s. 62(3) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(4)(a) (see S.I. 2019/174, reg. 2(c))

F5 Words in s. 62(3) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(4)(b) (see S.I. 2019/174, reg. 2(c))

F6 Words in s. 62(4)(a) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(5)(a) (see S.I. 2019/174, reg. 2(c))

F7 Words in s. 62(4)(b) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(5)(b) (see S.I. 2019/174, reg. 2(c))

F8 S. 62(5)(a) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(6)(a) (see S.I. 2019/174, reg. 2(c))

F9 S. 62(5)(b) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(6)(b) (see S.I. 2019/174, reg. 2(c))

F10 Words in s. 62(5)(c) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(6)(c) (see S.I. 2019/174, reg. 2(c))

F11 S. 62(6) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(7) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I1 S. 62 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

63 Additional restrictions on grant of authorisations [F12 under section 61] U.K.

(1) A designated senior officer may not grant an authorisation [F13 under section 61] for the purposes of a specific investigation or a specific operation if the officer is working on that investigation or operation.

(2) But, if the designated senior officer considers that there are exceptional circumstances which mean that subsection (1) should not apply in a particular case, that subsection does not apply in that case.

(3) Examples of exceptional circumstances include—

(a) an imminent threat to life or another emergency,

(b) the investigation or operation concerned is one where there is an exceptional need, in the interests of national security, to keep knowledge of it to a minimum, [F14 or]

(c) there is an opportunity to obtain information where—

(i) the opportunity is rare,

(ii) the time to act is short, and

(iii) the need to obtain the information is significant and in the interests of national security.

F15 (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F12 Words in s. 63 heading inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 4(2) (see S.I. 2019/174, reg. 2(c))

F13 Words in s. 63(1) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 4(3) (see S.I. 2019/174, reg. 2(c))

F14 Word in s. 63(3)(b) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 4(4)(a) (see S.I. 2019/174, reg. 2(c))

F15 S. 63(3)(d) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 4(4)(b) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I2 S. 63 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

64 Procedure for authorisations and authorised notices U.K.

(1) An authorisation must specify—

F16 (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F17 (aa) whether the authorisation has been granted by the Investigatory Powers Commissioner under section 60A or by a designated senior officer under section 61 or 61A;]

(b) the matters falling within [F18 section 60A(7), 61(7) or 61A(7) (as applicable)] by reference to which it is granted,

(c) the conduct that is authorised,

(d) the data or description of data to be obtained, and

(e) the persons or descriptions of persons to whom the data is to be, or may be, disclosed or how to identify such persons.

[F19 (1A) An authorisation granted by a designated senior officer under section 61 or 61A must also specify the office, rank or position held by the officer.]

(2) An authorisation which authorises a person to impose requirements by notice on a telecommunications operator must also specify—

(a) the operator concerned, and

(b) the nature of the requirements that are to be imposed,

but need not specify the other contents of the notice.

(3) The notice itself—

(a) must specify—

(i) the office, rank or position held by the person giving it,

(ii) the requirements that are being imposed, and

(iii) the telecommunications operator on whom the requirements are being imposed, and

(b) must be given in writing or (if not in writing) in a manner that produces a record of its having been given.

(4) An authorisation must be applied for, and granted, in writing or (if not in writing) in a manner that produces a record of its having been applied for or granted.

Textual Amendments

F16 S. 64(1)(a) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 5(2)(a) (see S.I. 2019/174, reg. 2(c))

F17 S. 64(1)(aa) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 5(2)(b) (see S.I. 2019/174, reg. 2(c))

F18 Words in s. 64(1)(b) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 5(2)(c) (see S.I. 2019/174, reg. 2(c))

F19 S. 64(1A) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 5(3) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I3 S. 64 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

65 Duration and cancellation of authorisations and notices U.K.

(1) An authorisation [F20 under section 60A or 61] ceases to have effect at the end of the period of one month beginning with the date on which it is granted.

(2) An authorisation [F21 under section 60A or 61] may be renewed at any time before the end of that period by the grant of a further authorisation.

(3) Subsection (1) has effect in relation to a renewed authorisation as if the period of one month mentioned in that subsection did not begin until the end of the period of one month applicable to the authorisation that is current at the time of the renewal.

[F22 (3A) An authorisation under section 61A ceases to have effect at the end of the period of 3 days beginning with the date on which it is granted.]

[F23 (3B) Where the Investigatory Powers Commissioner has granted an authorisation under section 60A to a relevant public authority—

(a) the Investigatory Powers Commissioner or an officer of the authority may cancel it at any time, and

(b) the Investigatory Powers Commissioner or an officer of the authority must cancel it if the Commissioner or (as the case may be) the officer considers that the requirements of this Part would not be satisfied in relation to granting an equivalent new authorisation.]

(4) A designated senior officer who has granted an authorisation [F24 under section 61 or 61A]—

(a) may cancel it at any time, and

(b) must cancel it if the designated senior officer considers that the requirements of this Part would not be satisfied in relation to granting an equivalent new authorisation.

(5) The Secretary of State may by regulations provide for the person by whom any function under subsection (4) is to be exercised where the person who would otherwise have exercised it is no longer available to do so.

(6) Such regulations may, in particular, provide for the person by whom the function is to be exercised to be a person appointed in accordance with the regulations.

(7) A notice given in pursuance of an authorisation (and any requirement imposed by the notice)—

(a) is not affected by the authorisation subsequently ceasing to have effect under subsection (1) [F25 or (3A)], but

(b) is cancelled if the authorisation is cancelled under [F26 subsection (3B) or (4)].

Textual Amendments

F20 Words in s. 65(1) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(2) (see S.I. 2019/174, reg. 2(c))

F21 Words in s. 65(2) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(3) (see S.I. 2019/174, reg. 2(c))

F22 S. 65(3A) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(4) (see S.I. 2019/174, reg. 2(c))

F23 S. 65(3B) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(5) (see S.I. 2019/174, reg. 2(c))

F24 Words in s. 65(4) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(6) (see S.I. 2019/174, reg. 2(c))

F25 Words in s. 65(7)(a) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(7)(a) (see S.I. 2019/174, reg. 2(c))

F26 Words in s. 65(7)(b) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(7)(b) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I4 S. 65 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

66 Duties of telecommunications operators in relation to authorisations U.K.

(1) It is the duty of a telecommunications operator on whom a requirement is imposed by notice given in pursuance of an authorisation to comply with that requirement.

(2) It is the duty of a telecommunications operator who is obtaining or disclosing communications data, in response to a request or requirement for the data in pursuance of an authorisation, to obtain or disclose the data in a way that minimises the amount of data that needs to be processed for the purpose concerned.

(3) A person who is under a duty by virtue of subsection (1) or (2) is not required to take any steps in pursuance of that duty which it is not reasonably practicable for that person to take.

(4) For the purposes of subsection (3), where obligations have been imposed on a telecommunications operator (“P”) under section 253 (maintenance of technical capability), the steps which it is reasonably practicable for P to take include every step which it would have been reasonably practicable for P to take if P had complied with all of those obligations.

(5) The duty imposed by subsection (1) or (2) is enforceable by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.

Commencement Information

I5 S. 66 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)