Investigatory Powers Act 2016

Additional powers U.K.

251 Amendments of the Intelligence Services Act 1994 U.K.

(1) The Intelligence Services Act 1994 is amended as follows.

(2) In section 3 (the Government Communications Headquarters)—

(a) in subsection (1)(a), after “monitor” insert “ , make use of ”, and

(b) in the words following subsection (1)(b)(ii), for the words from “or to any other organisation” to the end substitute “ or, in such cases as it considers appropriate, to other organisations or persons, or to the general public, in the United Kingdom or elsewhere. ”

(3) In section 5 (warrants: general)—

(a) in subsection (2), omit “, subject to subsection (3) below,”,

(b) omit subsection (3), and

(c) in subsection (3A), after “1989” insert “ , or on the application of the Intelligence Service or GCHQ for the purposes of the exercise of their functions by virtue of section 1(2)(c) or 3(2)(c), ”.

Commencement Information

I1 S. 251 in force at 13.2.2017 by S.I. 2017/137, reg. 2(r)

Valid from 12/03/2018

252 National security notices U.K.

(1) The Secretary of State may give any telecommunications operator in the United Kingdom a national security notice under this section if—

(a) the Secretary of State considers that the notice is necessary in the interests of national security,

(b) the Secretary of State considers that the conduct required by the notice is proportionate to what is sought to be achieved by that conduct, and

(c) the decision to give the notice has been approved by a Judicial Commissioner.

(2) A “national security notice” is a notice requiring the operator to take such specified steps as the Secretary of State considers necessary in the interests of national security.

(3) A national security notice may, in particular, require the operator to whom it is given—

(a) to carry out any conduct, including the provision of services or facilities, for the purpose of—

(i) facilitating anything done by an intelligence service under any enactment other than this Act, or

(ii) dealing with an emergency (within the meaning of Part 1 of the Civil Contingencies Act 2004);

(b) to provide services or facilities for the purpose of assisting an intelligence service to carry out its functions more securely or more effectively.

(4) In a case where—

(a) a national security notice would require the taking of any steps, and

(b) in the absence of such a notice requiring the taking of those steps, the taking of those steps would be lawful only if a warrant or authorisation under a relevant enactment had been obtained,

the notice may require the taking of those steps only if such a warrant or authorisation has been obtained.

(5) But the Secretary of State may not give any telecommunications operator a national security notice the main purpose of which is to require the operator to do something for which a warrant or authorisation under a relevant enactment is required.

(6) In this section “relevant enactment” means—

(a) this Act;

(b) the Intelligence Services Act 1994;

(c) the Regulation of Investigatory Powers Act 2000;

(d) the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp 11).

(7) A national security notice must specify such period as appears to the Secretary of State to be reasonable as the period within which the steps specified in the notice are to be taken.

(8) Conduct required by a national security notice is to be treated as lawful for all purposes (to the extent that it would not otherwise be so treated).

(9) Sections 254 to 258 contain further provision about national security notices.

253 Technical capability notices U.K.

(1) The Secretary of State may give a relevant operator a technical capability notice under this section if—

(a) the Secretary of State considers that the notice is necessary for securing that the operator has the capability to provide any assistance which the operator may be required to provide in relation to any relevant authorisation,

(b) the Secretary of State considers that the conduct required by the notice is proportionate to what is sought to be achieved by that conduct, and

(c) the decision to give the notice has been approved by a Judicial Commissioner.

(2) A “technical capability notice” is a notice—

(a) imposing on the relevant operator any applicable obligations specified in the notice, and

(b) requiring the person to take all the steps specified in the notice for the purpose of complying with those obligations.

(3) In this section—

• “applicable obligation”, in relation to a relevant operator of a particular description, means an obligation specified by the Secretary of State in regulations as an obligation that may be imposed on relevant operators, or on relevant operators of that description;

• “relevant authorisation” means—

  (a)

  any warrant issued under Part 2, 5 or 6, or

  (b)

  any authorisation or notice given under Part 3;

• “relevant operator” means—

  (a)

  a postal operator,

  (b)

  a telecommunications operator, or

  (c)

  a person who is proposing to become a postal operator or a telecommunications operator.

(4) Regulations under this section may specify an obligation that may be imposed on any relevant operators only if the Secretary of State considers it is reasonable to do so for the purpose of securing—

(a) that it is (and remains) practicable to impose requirements on those relevant operators to provide assistance in relation to relevant authorisations, and

(b) that it is (and remains) practicable for those relevant operators to comply with those requirements.

(5) The obligations that may be specified in regulations under this section include, among other things—

(a) obligations to provide facilities or services of a specified description;

(b) obligations relating to apparatus owned or operated by a relevant operator;

(c) obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data;

(d) obligations relating to the security of any postal or telecommunications services provided by a relevant operator;

(e) obligations relating to the handling or disclosure of any information.

(6) Before making any regulations under this section, the Secretary of State must consult the following persons—

(a) the Technical Advisory Board,

(b) persons appearing to the Secretary of State to be likely to be subject to any obligations specified in the regulations,

(c) persons representing persons falling within paragraph (b), and

(d) persons with statutory functions in relation to persons falling within that paragraph.

(7) A technical capability notice—

(a) must specify such period as appears to the Secretary of State to be reasonable as the period within which the steps specified in the notice are to be taken, and

(b) may specify different periods in relation to different steps.

(8) A technical capability notice may be given to persons outside the United Kingdom (and may require things to be done, or not to be done, outside the United Kingdom).

(9) Sections 254 to 258 contain further provision about technical capability notices.

Modifications etc. (not altering text)

C1 S. 253(3) modified (8.3.2018) by The Investigatory Powers Act 2016 (Commencement No. 4 and Transitional and Saving Provisions) Regulations 2018 (S.I. 2018/341), reg. 6(1)(a)(2)

Commencement Information

I2 S. 253(3)-(6) in force at 13.2.2017 by S.I. 2017/137, reg. 2(s) (with reg. 3)

Valid from 12/03/2018

254 Approval of notices by Judicial Commissioners U.K.

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) In deciding whether to approve a decision to give a relevant notice, a Judicial Commissioner must review the Secretary of State's conclusions as to the following matters—

(a) whether the notice is necessary as mentioned in section 252(1)(a) or (as the case may be) section 253(1)(a), and

(b) whether the conduct that would be required by the notice is proportionate to what is sought to be achieved by that conduct.

(3) In doing so, the Judicial Commissioner must—

(a) apply the same principles as would be applied by a court on an application for judicial review, and

(b) consider the matters referred to in subsection (2) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

(4) Where a Judicial Commissioner refuses to approve a decision to give a relevant notice, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.

(5) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to give a relevant notice, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to give the notice.

Valid from 12/03/2018

255 Further provision about notices under section 252 or 253 U.K.

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) Before giving a relevant notice to a person, the Secretary of State must consult that person.

(3) Before giving a relevant notice, the Secretary of State must, among other matters, take into account—

(a) the likely benefits of the notice,

(b) the likely number of users (if known) of any postal or telecommunications service to which the notice relates,

(c) the technical feasibility of complying with the notice,

(d) the likely cost of complying with the notice, and

(e) any other effect of the notice on the person (or description of person) to whom it relates.

(4) In the case of a technical capability notice that would impose any obligations relating to the removal by a person of electronic protection applied by or on behalf of that person to any communications or data, in complying with subsection (3) the Secretary of State must in particular take into account the technical feasibility, and likely cost, of complying with those obligations.

(5) A relevant notice must be in writing.

(6) A technical capability notice may be given to a person outside the United Kingdom in any of the following ways (as well as by electronic or other means of giving a notice)—

(a) by delivering it to the person's principal office within the United Kingdom or, if the person has no such office in the United Kingdom, to any place in the United Kingdom where the person carries on business or conducts activities;

(b) if the person has specified an address in the United Kingdom as one at which the person, or someone on the person's behalf, will accept documents of the same description as a notice, by delivering it to that address.

(7) The Secretary of State may by regulations make further provision about the giving of relevant notices.

(8) A person to whom a relevant notice is given, or any person employed or engaged for the purposes of that person's business, must not disclose the existence or contents of the notice to any other person without the permission of the Secretary of State.

(9) A person to whom a relevant notice is given must comply with the notice.

(10) The duty imposed by subsection (9) is enforceable—

(a) in relation to a person in the United Kingdom, and

(b) so far as relating to a technical capability notice within subsection (11), in relation to a person outside the United Kingdom,

by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.

(11) A technical capability notice is within this subsection if it relates to any of the following—

(a) a targeted interception warrant or mutual assistance warrant under Chapter 1 of Part 2;

(b) a bulk interception warrant;

(c) an authorisation or notice given under Part 3.

(12) Subsection (9) applies to a person to whom a national security notice is given despite any other duty imposed on the person by or under Part 1, or Chapter 1 of Part 2, of the Communications Act 2003.

Valid from 12/03/2018

256 Variation and revocation of notices U.K.

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) The Secretary of State must keep each relevant notice under review.

(3) The Secretary of State may—

(a) vary a relevant notice;

(b) revoke a relevant notice (whether wholly or in part).

(4) The Secretary of State may vary a national security notice given to a person only if—

(a) the Secretary of State considers that the variation is necessary in the interests of national security,

(b) the Secretary of State considers that the conduct required by the notice as varied is proportionate to what is sought to be achieved by that conduct, and

(c) if the variation would impose further requirements on the person, the decision to vary the notice has been approved by a Judicial Commissioner (but see subsection (6)).

(5) The Secretary of State may vary a technical capability notice given to a person only if—

(a) the Secretary of State considers that the variation is necessary for securing that the person has the capability to provide any assistance which the person may be required to provide in relation to any relevant authorisation (within the meaning of section 253),

(b) the Secretary of State considers that the conduct required by the notice as varied is proportionate to what is sought to be achieved by that conduct, and

(c) if the variation would impose further requirements on the person, the decision to vary the notice has been approved by a Judicial Commissioner (but see subsection (6)).

(6) The condition in subsection (4)(c) or (as the case may be) subsection (5)(c) does not apply in the case of a variation to which section 257(10) applies.

(7) If the Secretary of State varies or revokes a relevant notice given to any person, the Secretary of State must give that person notice of the variation or revocation.

(8) Section 254 (approval of notices by Judicial Commissioners) applies in relation to a decision to vary a relevant notice (other than a decision to which section 257(10) applies) as it applies in relation to a decision to give a relevant notice, but as if—

(a) the reference in section 254(2)(a) to the notice were to the variation, and

(b) the reference in section 254(2)(b) to the notice were to the notice as varied.

(9) Subsections (2) to (4) and (7) of section 255 apply in relation to varying or revoking a relevant notice as they apply in relation to giving a relevant notice (and in the application of section 255(3) and (4) in relation to varying a relevant notice, references to the notice are to be read as references to the notice as varied).

(10) Subsections (5) and (6) of section 255 apply to any notice of the variation or revocation of a relevant notice as they apply to a relevant notice.

(11) The fact that a relevant notice has been revoked in relation to a particular person (or description of persons) does not prevent the giving of another relevant notice of the same kind in relation to the same person (or description of persons).

(12) Any reference in this section or section 255(8) to (12) to a notice given under section 252 or 253 includes a reference to such a notice as varied under this section.

Valid from 12/03/2018

257 Review of notices by the Secretary of State U.K.

(1) A person who is given a notice under section 252 or 253 may, within such period or circumstances as may be provided for by regulations made by the Secretary of State, refer the notice back to the Secretary of State.

(2) Such a reference may be in relation to the whole of a notice or any aspect of it.

(3) There is no requirement for a person who has referred a notice under subsection (1) to comply with the notice, so far as referred, until the Secretary of State has reviewed the notice in accordance with subsection (4).

(4) The Secretary of State must review any notice so far as referred to the Secretary of State under subsection (1).

(5) Before deciding the review, the Secretary of State must consult—

(a) the Technical Advisory Board, and

(b) a Judicial Commissioner.

(6) The Board must consider the technical requirements and the financial consequences, for the person who has made the reference, of the notice so far as referred.

(7) The Commissioner must consider whether the notice so far as referred is proportionate.

(8) The Board and the Commissioner must—

(a) give the person concerned and the Secretary of State the opportunity to provide evidence, or make representations, to them before reaching their conclusions, and

(b) report their conclusions to—

(i) the person, and

(ii) the Secretary of State.

(9) The Secretary of State may, after considering the conclusions of the Board and the Commissioner—

(a) vary or revoke the notice under section 256, or

(b) give a notice under this section to the person confirming its effect.

(10) But the Secretary of State may vary the notice, or give a notice under subsection (9)(b) confirming its effect, only if the Secretary of State's decision to do so has been approved by the Investigatory Powers Commissioner.

(11) Subsections (5) to (8) of section 255 apply in relation to a notice under subsection (9)(b) above as they apply in relation to a notice under section 252 or 253.

(12) Any reference in this section or section 258 to a notice under section 252 or 253 includes such a notice as varied under section 256, but only so far as the variation is concerned.

But it does not include a notice varied as mentioned in subsection (9)(a) above.

Valid from 12/03/2018

258 Approval of notices following review under section 257 U.K.

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) In deciding whether to approve a decision to vary a relevant notice as mentioned in section 257(9)(a), or to give a notice under section 257(9)(b) confirming the effect of a relevant notice, the Investigatory Powers Commissioner must review the Secretary of State's conclusions as to the following matters—

(a) whether the relevant notice as varied or confirmed is necessary as mentioned in section 252(1)(a) or (as the case may be) section 253(1)(a), and

(b) whether the conduct required by the relevant notice, as varied or confirmed, is proportionate to what is sought to be achieved by that conduct.

(3) In doing so, the Investigatory Powers Commissioner must—

(a) apply the same principles as would be applied by a court on an application for judicial review, and

(b) consider the matters referred to in subsection (2) with a sufficient degree of care as to ensure that the Investigatory Powers Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

(4) Where the Investigatory Powers Commissioner refuses to approve a decision to vary a relevant notice as mentioned in section 257(9)(a), or to give a notice under section 257(9)(b) confirming the effect of a relevant notice, the Investigatory Powers Commissioner must give the Secretary of State written reasons for the refusal.