Part 1Bulk personal datasets

Low or no reasonable expectation of privacy

1Requirement for authorisation

(1)

The Investigatory Powers Act 2016 is amended as follows.

(2)

In section 199 (bulk personal datasets: interpretation)—

(a)

in subsection (1), in the words before paragraph (a), after “Part” insert “and Part 7A”;

(b)

in subsection (2), after “Part” insert “and Part 7A”.

(3)

In the italic heading before section 200, for “warrant” substitute “authorisation”.

(4)

In section 200 (requirement for authorisation by warrant: general)—

(a)

in subsection (1)—

(i)

the words “by a warrant under this Part” become paragraph (a);

(ii)

after that paragraph insert “, or

(b)

by an individual authorisation under Part 7A (low or no reasonable expectation of privacy) (see section 226B).”;

(b)

in subsection (2)—

(i)

the words “by a warrant under this Part” become paragraph (a);

(ii)

after that paragraph insert “, or

(b)

by an individual authorisation under Part 7A.”;

(c)

in the heading, omit “by warrant”.

(5)

In section 201 (exceptions to section 200(1) and (2)), in subsection (3)—

(a)

for “and 220(5)” substitute “, 220(5) and (6) and 226CC(3)”;

(b)

after “BPD warrants” insert “or authorisations under Part 7A”.

(6)

After section 201 insert—
“Restriction on use of class BPD warrants etc”.

(7)

In section 220 (initial examinations: time limits)—

(a)

in subsection (2), for step 3 substitute—

  • “Step 3

    If the head of the intelligence service, or a person acting on their behalf, decides to retain the set and hold it electronically for analysis as mentioned in step 2, as soon as reasonably practicable after making that decision—

    1. (a)

      apply for a specific BPD warrant (unless the retention of the dataset is authorised by a class BPD warrant), or

    2. (b)

      where the head of the intelligence service, or the person acting on their behalf, considers that section 226A applies to the dataset, decide to grant an individual authorisation under Part 7A.”;

    • (b)

    after subsection (5) insert—

    “(6)

    If the head of the intelligence service, or a person acting on their behalf, decides to grant an individual authorisation under Part 7A in accordance with step 3 (set out in subsection (2))—

    (a)

    the intelligence service is not to be regarded as in breach of section 200(1) by virtue of retaining the bulk personal dataset during any period when a Judicial Commissioner is deciding whether to approve the decision to grant the authorisation (see section 226B(5)), and

    (b)

    the intelligence service is not to be regarded as in breach of section 200(2) by virtue of examining the bulk personal dataset during that period if the examination is necessary in connection with obtaining the approval of a Judicial Commissioner.”

    (8)

    In section 225 (application of Part 7 to bulk personal datasets obtained under the Act)—

    (a)

    in subsection (4)—

    (i)

    the words “by a class BPD warrant or a specific BPD warrant under this Part” become paragraph (a);

    (ii)

    after that paragraph insert “, or

    (b)

    by an individual authorisation under Part 7A (low or no reasonable expectation of privacy).”;

    (b)

    in subsection (13)—

    (i)

    the words from “apply” to the end become paragraph (a);

    (ii)

    after that paragraph insert “, or

    (b)

    decide to grant an individual authorisation under Part 7A.”