(1)The Secretary of State may, by notice (a “retention notice”) and subject as follows, require a telecommunications operator to retain relevant communications data if—
(a)the Secretary of State considers that the requirement is necessary and proportionate for one or more of the [F1following purposes—
(i)in the interests of national security,
(ii)for the applicable crime purpose (see subsection (10A)),
(iii)in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,
(iv)in the interests of public safety,
(v)for the purpose of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health,
(vi)to assist investigations into alleged miscarriages of justice,]
and
(b)the decision to give the notice has been approved by a Judicial Commissioner.
(2)A retention notice may—
(a)relate to a particular operator or any description of operators,
(b)require the retention of all data or any description of data,
(c)identify the period or periods for which data is to be retained,
(d)contain other requirements, or restrictions, in relation to the retention of data,
(e)make different provision for different purposes,
(f)relate to data whether or not in existence at the time of the giving, or coming into force, of the notice.
(3)A retention notice must not require any data to be retained for more than 12 months beginning with—
(a)in the case of communications data relating to a specific communication, the day of the communication concerned,
(b)in the case of entity data which does not fall within paragraph (a) above but does fall within paragraph (a)(i) of the definition of “communications data” in section 261(5), the day on which the entity concerned ceases to be associated with the telecommunications service concerned or (if earlier) the day on which the data is changed, and
(c)in any other case, the day on which the data is first held by the operator concerned.
(4)A retention notice must not require an operator who controls or provides a telecommunication system (“the system operator”) to retain data which—
(a)relates to the use of a telecommunications service provided by another telecommunications operator in relation to that system,
(b)is (or is capable of being) processed by the system operator as a result of being comprised in, included as part of, attached to or logically associated with a communication transmitted by means of the system as a result of the use mentioned in paragraph (a),
(c)is not needed by the system operator for the functioning of the system in relation to that communication, and
(d)is not retained or used by the system operator for any other lawful purpose,
and which it is reasonably practicable to separate from other data which is subject to the notice.
(5)A retention notice which relates to data already in existence when the notice comes into force imposes a requirement to retain the data for only so much of a period of retention as occurs on or after the coming into force of the notice.
(6)A retention notice comes into force—
(a)when the notice is given to the operator (or description of operators) concerned, or
(b)(if later) at the time or times specified in the notice.
(7)A retention notice is given to an operator (or description of operators) by giving, or publishing, it in such manner as the Secretary of State considers appropriate for bringing it to the attention of the operator (or description of operators) to whom it relates.
(8)A retention notice must specify—
(a)the operator (or description of operators) to whom it relates,
[F2(aa)each telecommunications service (or description of telecommunications service) to which it relates,]
(b)the data which is to be retained,
(c)the period or periods for which the data is to be retained,
(d)any other requirements, or any restrictions, in relation to the retention of the data,
(e)the information required by section 249(7) (the level or levels of contribution in respect of costs incurred as a result of the notice).
(9)The requirements or restrictions mentioned in subsection (8)(d) may, in particular, include—
(a)a requirement to retain the data in such a way that it can be transmitted efficiently and effectively in response to requests,
(b)requirements or restrictions in relation to the obtaining (whether by collection, generation or otherwise), generation or processing of—
(i)data for retention, or
(ii)retained data.
(10)The fact that the data which would be retained under a retention notice relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that the requirement to retain the data is necessary for one or more of the purposes falling within [F3sub-paragraphs (i) to (vi) of subsection (1)(a)].
[F4(10A)In this section, “the applicable crime purpose” means—
(a)to the extent that a retention notice relates to events data, the purpose of preventing or detecting serious crime;
(b)to the extent that a retention notice relates to entity data, the purpose of preventing or detecting crime or of preventing disorder.
(10B)In subsection (10A)(a), “serious crime” means, in addition to crime which falls within paragraph (a) or (b) of the definition of “serious crime” in section 263(1), crime where the offence, or one of the offences, which is or would be constituted by the conduct concerned is—
(a)an offence for which an individual who has reached the age of 18 (or, in relation to Scotland or Northern Ireland, 21) is capable of being sentenced to imprisonment for a term of 12 months or more (disregarding any enactment prohibiting or restricting the imprisonment of individuals who have no previous convictions), or
(b)an offence—
(i)by a person who is not an individual, or
(ii)which involves, as an integral part of it, the sending of a communication or a breach of a person’s privacy.]
(11)In this Part “relevant communications data” means communications data which may be used to identify, or assist in identifying, any of the following—
(a)the sender or recipient of a communication (whether or not a person),
(b)the time or duration of a communication,
(c)the type, method or pattern, or fact, of communication,
(d)the telecommunication system (or any part of it) from, to or through which, or by means of which, a communication is or may be transmitted, or
(e)the location of any such system,
and this expression therefore includes, in particular, internet connection records.
Textual Amendments
F1S. 87(1)(a)(i)-(vi) substituted (1.11.2018) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), regs. 1(3)(c), 8(2)
F2S. 87(8)(aa) inserted (1.11.2018) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), regs. 1(3)(c), 8(3)
F3Words in s. 87(10) substituted (1.11.2018) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), regs. 1(3)(c), 8(4)
F4S. 87(10A)(10B) inserted (1.11.2018) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), regs. 1(3)(c), 8(5)
Commencement Information
I1S. 87(1)(a)(2)-(11) in force at 30.12.2016 by S.I. 2016/1233, reg. 2(c)
I2S. 87(1)(b) in force at 1.11.2018 by S.I. 2018/873, reg. 4(a)