2018 No. 1123
Electronic Communications
The Data Retention and Acquisition Regulations 2018
Made 31st October 2018
Coming into force in accordance with regulation 1

The Secretary of State, being a Minister designated for the purposes of section 2(2) of the European Communities Act 1972 in respect of matters relating to electronic communications, in exercise of the powers conferred by that section and by paragraph 4(3) of Schedule 7 to the Investigatory Powers Act 2016 makes the following Regulations.
S.I. 2001/3495.
1972 c. 68. Section 2(2) was amended by the Legislative and Regulatory Reform Act 2006 (c. 51) section 27(1)(a), and the European Communities (Amendment) Act 2008 (c.7) Schedule, Part 1.
2016 c. 25.
In accordance with paragraph 4(1) of Schedule 7 to the Investigatory Powers Act 2016, the Secretary of State has prepared and published a draft of the code of practice brought into force by these Regulations, considered representations made about the draft and modified it.
In accordance with paragraph 4(2) of that Schedule, the Secretary of State has consulted the Investigatory Powers Commissioner and the Information Commissioner.
In accordance with paragraph 4(4) of that Schedule and paragraph 2(2) of Schedule 2 to the European Communities Act 1972, a draft of these Regulations was laid before Parliament and approved by a resolution of each House of Parliament.
In accordance with paragraph 4(5) of Schedule 7 to the Investigatory Powers Act 2016, when a draft of these Regulations was laid before Parliament, the code of practice brought into force by these Regulations was also laid.

1 Citation and commencement
1 These Regulations may be cited as the Data Retention and Acquisition Regulations 2018.
2 This regulation and regulation 2 come into force on the day after the day on which these Regulations are made.
3 The following provisions of these Regulations come into force on 1st November 2018—
(a) regulation 3;
(b) regulation 4 for the purposes of regulations 8 to 10;
(c) regulations 8 and 9;
(d) regulation 10 for the purposes of paragraphs 22, 23 and 27(b) and (c) of Schedule 1;
(e) regulation 11 for the purposes of paragraph 2 of Schedule 2;
(f) paragraphs 22, 23 and 27(b) and (c) of Schedule 1;
(g) paragraph 2 of Schedule 2.
4 Subject to paragraph (5), the following provisions of these Regulations come into force on the day that section 61(1) of the Investigatory Powers Act 2016 comes into force—
(a) regulation 4 for all remaining purposes;
(b) regulations 5 to 7;
(c) regulations 10 and 11 for all remaining purposes;
(d) Schedule 1 so far as not already in force;
(e) paragraph 1 of Schedule 2.
5 Where section 61(1) of the Investigatory Powers Act 2016 comes into force on a day only for a particular purpose or purposes specified in regulations under section 272(1) of that Act, the provisions specified in paragraph (4) come into force on that day only for that purpose or (as the case may be) those purposes.

2 Code of Practice
The code of practice entitled “Communications Data” laid before Parliament on 28th June 2018 has effect.

3 Amendments of the Regulation of Investigatory Powers Act 2000
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Reg. 3 revoked (1.1.2024) by Retained EU Law (Revocation and Reform) Act 2023 (c. 28), ss. 1(1), 22(3), Sch. 1 Pt. 1 (with s. 1(3)(4)); S.I. 2023/1363, reg. 2

4 Amendments of the Investigatory Powers Act 2016
The Investigatory Powers Act 2016 is amended in accordance with regulations 5 to 10.
Reg. 4 in force at 1.11.2018 for specificed purposes and at 5.2.2019 otherwise, see reg. 1(3)(b)(4)(a)

5 Grant of authorisations by the Investigatory Powers Commissioner
After the heading of Part 3 insert—

“Targeted authorisations for obtaining data: the Investigatory Powers Commissioner

60A Power of Investigatory Powers Commissioner to grant authorisations
1 Subsection (2) applies if the Investigatory Powers Commissioner, on an application made by a relevant public authority, considers—
(a) that it is necessary for the relevant public authority to obtain communications data for a purpose falling within subsection (7),
(b) that it is necessary for the relevant public authority to obtain the data—
(i) for the purposes of a specific investigation or a specific operation, or
(ii) for the purposes of testing, maintaining or developing equipment, systems or other capabilities relating to the availability or obtaining of communications data, and
(c) that the conduct authorised by the authorisation is proportionate to what is sought to be achieved.
2 The Investigatory Powers Commissioner may authorise the relevant public authority to engage in any conduct which—
(a) is for the purpose of obtaining the data from any person, and
(b) relates to—
(i) a telecommunication system, or
(ii) data derived from a telecommunication system.
3 Subsections (1) and (2) are subject to—
(a) section 62 (restrictions in relation to internet connection records),
(b) sections 70, 73 and 75 and Schedule 4 (restrictions relating to certain relevant public authorities),
(c) section 76 (requirement to consult a single point of contact), and
(d) section 77 (Commissioner approval for authorisations to identify or confirm journalistic sources).
4 Authorised conduct may, in particular, consist of the relevant public authority—
(a) obtaining the communications data itself from any person or telecommunication system,
(b) asking any person whom the relevant public authority believes is, or may be, in possession of the communications data or capable of obtaining it—
(i) to obtain the data (if not already in possession of it), and
(ii) to disclose the data (whether already in the person's possession or subsequently obtained by that person) to the relevant public authority, or
(c) requiring by notice a telecommunications operator whom the relevant public authority believes is, or may be, in possession of the communications data or capable of obtaining it—
(i) to obtain the data (if not already in possession of it), and
(ii) to disclose the data (whether already in the operator's possession or subsequently obtained by the operator) to the relevant public authority.
5 An authorisation—
(a) may relate to data whether or not in existence at the time of the authorisation,
(b) may authorise the obtaining or disclosure of data by a person other than the relevant public authority, or any other conduct by such a person, which enables or facilitates the obtaining of the communications data concerned, and
(c) may, in particular, require a telecommunications operator who controls or provides a telecommunications system to obtain or disclose data relating to the use of a telecommunications service provided by another telecommunications operator in relation to that system.
6 An authorisation may not authorise any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system.
7 It is necessary to obtain communications data for a purpose falling within this subsection if it is necessary to obtain the data—
(a) in the interests of national security,
(b) for the applicable crime purpose (see subsection (8)),
(c) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,
(d) in the interests of public safety,
(e) for the purpose of preventing death or injury or any damage to a person's physical or mental health, or of mitigating any injury or damage to a person's physical or mental health,
(f) to assist investigations into alleged miscarriages of justice, or
(g) where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition—
(i) to assist in identifying P, or
(ii) to obtain information about P's next of kin or other persons connected with P or about the reasons for P's death or condition.
8 In subsection (7)(b), “the applicable crime purpose” means—
(a) where the communications data is wholly or partly events data, the purpose of preventing or detecting serious crime;
(b) in any other case, the purpose of preventing or detecting crime or of preventing disorder.
9 The fact that the communications data which would be obtained in pursuance of an authorisation relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that it is necessary to obtain the data for a purpose falling within subsection (7).
10 See—
(a) sections 70 and 73 for the meaning of “relevant public authority”;
(b) section 84 for the way in which this Part applies to postal operators and postal services;
(c) section 86(2A) for the meaning of “serious crime”.”

.

6 Amendment of section 61
1 In the italic heading before section 61, at the end insert “ : designated senior officers ”.
2 Section 61 (power to grant authorisations) is amended as follows.
3 In the heading, after “Power” insert “ of designated senior officers ”.
4 In subsection (3), in paragraph (c), for “and 73 to 75” substitute “ , 73 and 75 ”.
5 In subsection (7)—
(a) for paragraph (b) substitute—

“(b) for the applicable crime purpose (see subsection (7A)), or”

;
(b) omit paragraphs (d) to (j).
6 After subsection (7) insert—

“(7A) In subsection (7)(b), “the applicable crime purpose” means—
(a) where the communications data is wholly or partly events data, the purpose of preventing or detecting serious crime;
(b) in any other case, the purpose of preventing or detecting crime or of preventing disorder.”

.
7 In subsection (9), after paragraph (b) insert—

“(c) section 86(2A) for the meaning of “serious crime”.”

.

7 Power of designated senior officers to grant authorisations in urgent cases
After section 61 insert—

“61A Power of designated senior officers to grant authorisations: urgent cases
(1) Subsection (2) applies if a designated senior officer of a relevant public authority considers—
(a) that it is necessary to obtain communications data for a purpose falling within subsection (7),
(b) that it is necessary to obtain the data for the purposes of a specific investigation or a specific operation,
(c) that there is an urgent need to obtain the data, and
(d) that the conduct authorised by the authorisation is proportionate to what is sought to be achieved.
(2) The designated senior officer may authorise any officer of the relevant public authority to engage in any conduct which—
(a) is for the purpose of obtaining the data from any person, and
(b) relates to—
(i) a telecommunication system, or
(ii) data derived from a telecommunication system.
(3) Subsections (1) and (2) are subject to—
(a) section 62 (restrictions in relation to internet connection records),
(b) sections 70, 73 and 75 and Schedule 4 (restrictions relating to certain relevant public authorities),
(d) section 76 (requirement to consult a single point of contact), and
(e) section 77 (Commissioner approval for authorisations to identify or confirm journalistic sources).
(4) Authorised conduct may, in particular, consist of an authorised officer—
(a) obtaining the communications data themselves from any person or telecommunication system,
(b) asking any person whom the authorised officer believes is, or may be, in possession of the communications data or capable of obtaining it—
(i) to obtain the data (if not already in possession of it), and
(ii) to disclose the data (whether already in the person's possession or subsequently obtained by that person) to a person identified by, or in accordance with, the authorisation, or
(c) requiring by notice a telecommunications operator whom the authorised officer believes is, or may be, in possession of the communications data or capable of obtaining it—
(i) to obtain the data (if not already in possession of it), and
(ii) to disclose the data (whether already in the operator's possession or subsequently obtained by the operator) to a person identified by, or in accordance with, the authorisation.
(5) An authorisation—
(a) may relate to data whether or not in existence at the time of the authorisation,
(b) may authorise the obtaining or disclosure of data by a person who is not an authorised officer, or any other conduct by such a person, which enables or facilitates the obtaining of the communications data concerned, and
(c) may, in particular, require a telecommunications operator who controls or provides a telecommunications system to obtain or disclose data relating to the use of a telecommunications service provided by another telecommunications operator in relation to that system.
(6) An authorisation—
(a) may not authorise any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system, and
(b) may not authorise an authorised officer to ask or require, in the circumstances mentioned in subsection (4)(b) or (c), a person to disclose the data to any person other than—
(i) an authorised officer, or
(ii) an officer of the same relevant public authority as an authorised officer.
(7) It is necessary to obtain communications data for a purpose falling within this subsection if it is necessary to obtain the data—
(a) for the applicable crime purpose (see subsection (8)),
(b) in the interests of public safety,
(c) for the purpose of preventing death or injury or any damage to a person's physical or mental health, or of mitigating any injury or damage to a person's physical or mental health,
(d) to assist investigations into alleged miscarriages of justice, or
(e) where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition—
(i) to assist in identifying P, or
(ii) to obtain information about P's next of kin or other persons connected with P or about the reasons for P's death or condition.
(8) In subsection (7)(a), “the applicable crime purpose” means—
(a) where the communications data is wholly or partly events data, the purpose of preventing or detecting serious crime;
(b) in any other case, the purpose of preventing or detecting crime or of preventing disorder.
(9) The fact that the communications data which would be obtained in pursuance of an authorisation relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that it is necessary to obtain the data for a purpose falling within subsection (7).
(10) See—
(a) sections 70 and 73 for the meanings of “designated senior officer” and “relevant public authority”;
(b) section 84 for the way in which this Part applies to postal operators and postal services;
(c) section 86(2A) for the meaning of “serious crime”.”

.

8 Retention of communications data
1 Section 87 (powers to require retention of certain data) is amended as follows.
2 In subsection (1)(a), for the words from “purposes falling” to “obtained),” substitute “following purposes—
(i) in the interests of national security,
(ii) for the applicable crime purpose (see subsection (10A)),
(iii) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,
(iv) in the interests of public safety,
(v) for the purpose of preventing death or injury or any damage to a person's physical or mental health, or of mitigating any injury or damage to a person's physical or mental health,
(vi) to assist investigations into alleged miscarriages of justice,”.
3 In subsection (8), after paragraph (a) insert—

“(aa) each telecommunications service (or description of telecommunications service) to which it relates,”

.
4 In subsection (10), for the words from “paragraphs” to the end substitute “ sub-paragraphs (i) to (vi) of subsection (1)(a) ”.
5 After subsection (10) insert—

“(10A) In this section, “the applicable crime purpose” means—
(a) to the extent that a retention notice relates to events data, the purpose of preventing or detecting serious crime;
(b) to the extent that a retention notice relates to entity data, the purpose of preventing or detecting crime or of preventing disorder.
(10B) In subsection (10A)(a), “serious crime” means, in addition to crime which falls within paragraph (a) or (b) of the definition of “serious crime” in section 263(1), crime where the offence, or one of the offences, which is or would be constituted by the conduct concerned is—
(a) an offence for which an individual who has reached the age of 18 (or, in relation to Scotland or Northern Ireland, 21) is capable of being sentenced to imprisonment for a term of 12 months or more (disregarding any enactment prohibiting or restricting the imprisonment of individuals who have no previous convictions), or
(b) an offence—
(i) by a person who is not an individual, or
(ii) which involves, as an integral part of it, the sending of a communication or a breach of a person's privacy.”

.

9 Amendment of section 88
In section 88 (matters to be taken into account before giving retention notices), in subsection (1)—
(a) in paragraph (a), after “notice” insert “ , including in relation to one or more of the purposes mentioned in sub-paragraphs (i) to (vi) of section 87(1)(a) (purposes for which retention of communications data may be required) ”;
(b) after paragraph (a) insert—

“(aa) the telecommunications services to which the retention notice relates,
(ab) the appropriateness of limiting the data to be retained by reference to—
(i) location, or
(ii) descriptions of persons to whom telecommunications services are provided,”

.

10 Further amendments of the Investigatory Powers Act 2016
Schedule 1 makes further amendments of the Investigatory Powers Act 2016.
Reg. 10 in force for specified purposes at 1.11.2018 and at 5.2.2019 otherwise, see reg. 1(3)(d)(4)(c)

11 Consequential amendments
Schedule 2 makes consequential amendments of other legislation.
Reg. 11 in force at 1.11.2018 for specified purposes and at 5.2.2018 otherwise, see reg. 1(3)(e)(4)(c)
Ben Wallace Minister of State Home Office

SCHEDULE 1 Amendments of the Investigatory Powers Act 2016
Regulation 10
1 Omit section 2(6) (definition of “public authority”).
2 Before section 62 insert the italic heading “ Further provision about authorisations ”.
3 (1) Section 62 (restrictions in relation to internet connection records) is amended as follows.
(2) Before subsection (1) insert—

“A1 The Investigatory Powers Commissioner may not, on the application of a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record.
A2 The Investigatory Powers Commissioner may not, on the application of a relevant public authority which is not a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B or C is met.”

.
(3) Omit subsection (1).
(4) In subsection (3)—
(a) for “the designated senior officer” substitute “ the person with power to grant the authorisation ”;
(b) for “section 61(7)” substitute “ section 60A(7), 61(7) or 61A(7) (as applicable) ”.
(5) In subsection (4)—
(a) in paragraph (a), for the words from “section 61(7)” to “crime,” substitute “ section 60A(7), 61(7) or 61A(7) (as applicable) but is not the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a) or the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b), ”;
(b) in paragraph (b), for “the designated senior officer” substitute “ the person with power to grant the authorisation ”.
(6) In subsection (5)—
(a) for paragraph (a) substitute—

“(a) either—
(i) the purpose for which the data is to be obtained is the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a), or
(ii) the purpose for which the data is to be obtained is the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b) and the crime to be prevented or detected is serious crime, and”

;
(b) omit paragraph (b) and the “and” following it;
(c) in paragraph (c), for “the designated senior officer” substitute “ the person with power to grant the authorisation ”.
(7) Omit subsection (6).
4 (1) Section 63 (additional restrictions on grant of authorisations) is amended as follows.
(2) In the heading, after “authorisations” insert “ under section 61 ”.
(3) In subsection (1), after “authorisation” insert “ under section 61 ”.
(4) In subsection (3)—
(a) after paragraph (b), insert “ or ”;
(b) omit paragraph (d) and the “or” before it.
5 (1) Section 64 (procedure for authorisations and authorised notices) is amended as follows.
(2) In subsection (1)—
(a) omit paragraph (a);
(b) before paragraph (b) insert—

“(aa) whether the authorisation has been granted by the Investigatory Powers Commissioner under section 60A or by a designated senior officer under section 61 or 61A;”

;
(c) in paragraph (b), for “section 61(7)” substitute “ section 60A(7), 61(7) or 61A(7) (as applicable) ”.
(3) After subsection (1) insert—

“(1A) An authorisation granted by a designated senior officer under section 61 or 61A must also specify the office, rank or position held by the officer.”

.
6 (1) Section 65 (duration and cancellation of authorisations and notices) is amended as follows.
(2) In subsection (1), after “authorisation” insert “ under section 60A or 61 ”.
(3) In subsection (2), after “authorisation”, in the first place it occurs, insert “ under section 60A or 61 ”.
(4) After subsection (3) insert—

“(3A) An authorisation under section 61A ceases to have effect at the end of the period of 3 days beginning with the date on which it is granted.”

.
(5) After subsection (3A) (as inserted by sub-paragraph (4)) insert—

“(3B) Where the Investigatory Powers Commissioner has granted an authorisation under section 60A to a relevant public authority—
(a) the Investigatory Powers Commissioner or an officer of the authority may cancel it at any time, and
(b) the Investigatory Powers Commissioner or an officer of the authority must cancel it if the Commissioner or (as the case may be) the officer considers that the requirements of this Part would not be satisfied in relation to granting an equivalent new authorisation.”

.
(6) In subsection (4), after “authorisation”, in the first place it occurs, insert “ under section 61 or 61A ”.
(7) In subsection (7)—
(a) in paragraph (a), after “subsection (1)” insert “ or (3A) ”;
(b) in paragraph (b), for “subsection (4)” substitute “ subsection (3B) or (4) ”.
7 In section 67 (filtering arrangements for obtaining data), in subsection (1)(a), for “a designated senior officer, who is” substitute “ a person, who is ”.
8 (1) Section 68 (use of filtering arrangements in pursuance of an authorisation) is amended as follows.
(2) In subsection (3), in the words before paragraph (a), for “the designated senior officer's decision” substitute “ the decision of the person granting the authorisation ”.
(3) In subsection (4), in the words before paragraph (a), for “A designated senior officer” substitute “ A person ”.
(4) In subsection (5), for “the designated senior officer” substitute “ the person ”.
9 In section 69 (duties in connection with operation of filtering arrangements), in subsection (1)(b), in the words following sub-paragraph (ii), for “to the designated senior officer concerned” substitute “ to the person considering whether to grant the authorisation ”.
10 (1) Section 70 (relevant public authorities and designated senior officers) is amended as follows.
(2) After subsection (2) insert—

“(2A) An authorisation under section 60A may be granted on the application of a relevant public authority listed in column 1 of the table only if section 60A(1)(a) is met in relation to a purpose within one of the paragraphs of section 60A(7) specified in the corresponding entry in column 2 of the table.”

.
(3) In subsection (3)—
(a) in paragraph (a), for “column 2” substitute “ column 3 ”;
(b) in paragraph (b), for “column 2” substitute “ column 3 ”.
(4) In subsection (4), for “column 2” substitute “ column 3 ”.
(5) After subsection (5) insert—

“(5A) A person who is a designated senior officer of a relevant public authority by virtue of subsection (3) and an entry in column 3 of the table may grant an authorisation under section 61—
(a) only for obtaining communications data of the kind specified in the corresponding entry in column 4 of the table,
(b) only if one or more paragraphs of section 61(7) is specified in the corresponding entry in column 5 of the table, and
(c) only if section 61(1)(a) is met in relation to a purpose within the specified paragraph or, if more than one paragraph is specified, a purpose within one of them.”

.
(6) In subsection (6)—
(a) in the words before paragraph (a)—
(i) for “column 2” substitute “ column 3 ”;
(ii) after “authorisation” insert “ under section 61A ”;
(b) in paragraph (a), for “column 3” substitute “ column 4 ”;
(c) omit the “and” following paragraph (a);
(d) for paragraph (b) substitute—

“(b) only if one or more paragraphs of section 61A(7) is specified in the corresponding entry in column 6 of the table, and
(c) only if section 61A(1)(a) is met in relation to a purpose within the specified paragraph or, if more than one paragraph is specified, a purpose within one of them.”

.
(7) In subsection (7)—
(a) for “column 2” substitute “ column 3 ”;
(b) for “subsection (6) applies” substitute “ subsections (5A) and (6) apply ”.
11 (1) Section 71 (power to modify section 70 and Schedule 4) is amended as follows.
(2) In subsection (2)—
(a) in paragraph (c), omit “by a designated senior officer with a specified public authority”;
(b) in paragraph (d), for the words from “such authorisations” to the end of the paragraph substitute “ the authorisations may be granted ”.
(3) After subsection (2) insert—

“(2A) Regulations adding a public authority to, or removing a public authority from, the list in column 1 of the table may do so in relation to all or any of the following—
(a) authorisations under section 60A by the Investigatory Powers Commissioner;
(b) authorisations by a designated senior officer under section 61;
(c) authorisations by a designated senior officer under section 61A.”

.
(4) In subsection (3), after “relevant public authority” insert “ (in relation to one or more of the authorisations mentioned in subsection (2A)) ”.
12 In section 72 (certain regulations under section 71: supplementary), in subsection (1)—
(a) in paragraph (a), after “Schedule 4” insert “ (in relation to one or more of the authorisations mentioned in section 71(2A) ”;
(b) in paragraph (b), for “column 2” substitute “ column 3 ”.
13 (1) Section 73 (local authorities as relevant public authorities) is amended as follows.
(2) In subsection (1), at the end insert “ but only so far as relating to authorisations under section 60A ”.
(3) Omit subsections (2) and (4) to (7).
(4) For subsection (3) substitute—

“(3) An authorisation may not be granted under section 60A on the application of a local authority unless—
(a) section 60A(1)(a) is met in relation to a purpose within section 60A(7)(b),
(b) the local authority is a party to a collaboration agreement (whether as a supplying authority or a subscribing authority or both), and
(c) that collaboration agreement is certified by the Secretary of State (having regard to guidance given by virtue of section 79(6) and (7)) as being appropriate for the local authority.
(3A) In subsection (3), “collaboration agreement”, “subscribing authority” and “supplying authority” have the same meaning as in section 78.”

.
14 Omit section 74 (requirement to be party to collaboration agreement).
15 Omit section 75 (judicial approval for local authority authorisations).
16 (1) Section 76 (use of a single point of contact) is amended as follows.
(2) Before subsection (1) insert—

“A1 Before making an application for an authorisation under section 60A, the officer making the application must consult a person who is acting as a single point of contact in relation to the making of applications.”

.
(3) In subsection (1), after “an authorisation” insert “ under section 61 or 61A ”.
(4) In subsection (2)—
(a) after “if the” insert “ officer or (as the case may be) ”;
(b) for “subsection (1)” substitute “ subsection (A1) or (as the case may be) (1) ”.
(5) In subsection (4), in paragraph (b)(i), after “authorisations” insert “ (whether under section 60A, 61 or 61A) ”.
17 (1) Section 77 (Commissioner approval for authorisations to identify or confirm journalistic sources) is amended as follows.
(2) In subsection (1)(a), after “an authorisation” insert “ under section 61 or 61A ”.
(3) After subsection (1) insert—

“(1A) Subsection (2) also applies if—
(a) a person to whom functions under section 60A have been delegated under section 238(5) has granted an authorisation under that section in relation to the obtaining by a relevant public authority of communications data for the purpose of identifying or confirming a source of journalistic information, and
(b) the authorisation is not necessary because of an imminent threat to life.”

.
18 (1) Section 78 (collaboration agreements) is amended as follows.
(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Sch. 1 para. 18(2)(3) revoked (17.5.2019) by The Communications Data Acquisition Regulations 2019 (S.I. 2019/939), regs. 1(2), 6
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) Omit subsections (3) and (4).
(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Sch. 1 para. 18(5) revoked (17.5.2019) by The Communications Data Acquisition Regulations 2019 (S.I. 2019/939), regs. 1(2), 6
19 (1) Section 80 (police collaboration agreements) is amended as follows.
(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Sch. 1 para. 19(2)(3) revoked (17.5.2019) by The Communications Data Acquisition Regulations 2019 (S.I. 2019/939), regs. 1(2), 6
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) Omit subsections (3) and (4).
(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Sch. 1 para. 19(5) revoked (17.5.2019) by The Communications Data Acquisition Regulations 2019 (S.I. 2019/939), regs. 1(2), 6
20 In section 84 (application of Part 3 to postal operators and postal services), in subsection (2)—
(a) omit the “and” at the end of paragraph (d);
(b) after paragraph (d) insert—

“(da) the reference in sections 60A(8)(a), 61(7A)(a) and 61A(8)(a) to events data were a reference to anything within paragraph (a) or (b) of the definition of “communications data” in section 262(3), and”

.
21 (1) Section 86 (Part 3: interpretation) is amended as follows.
(2) In subsection (1)—
(a) in the definition of “authorisation”, for the words from “under section 61” to the end of the definition substitute “ under section 60A, 61 or 61A ”;
(b) in the definition of “designated senior officer”—
(i) omit paragraph (a) and the “and” following it;
(ii) in paragraph (b), omit “other”.
(3) After subsection (2) insert—

“(2A) In this Part, “serious crime” means, in addition to crime which falls within paragraph (a) or (b) of the definition of “serious crime” in section 263(1), crime where the offence, or one of the offences, which is or would be constituted by the conduct concerned is—
(a) an offence for which an individual who has reached the age of 18 (or, in relation to Scotland or Northern Ireland, 21) is capable of being sentenced to imprisonment for a term of 12 months or more (disregarding any enactment prohibiting or restricting the imprisonment of individuals who have no previous convictions), or
(b) an offence—
(i) by a person who is not an individual, or
(ii) which involves, as an integral part of it, the sending of a communication or a breach of a person's privacy.”

.
22 In the following provisions, for the words “paragraphs (a) to (j) of section 61(7)” substitute “ sub-paragraphs (i) to (vi) of section 87(1)(a) ”
(a) section 89(1) (approval by Judicial Commissioner);
(b) section 91(1) (approval by Investigatory Powers Commissioner);
(c) section 94(4)(a) and (5) (grounds on which certain retention notices may be varied etc).
23 In section 96 (application of Part 4 to postal operators and postal services), in subsection (2)—
(a) omit the “and” at the end of paragraph (e);
(b) after paragraph (e) insert—

“(ea) the reference in section 87(10A)(a) to events data were a reference to anything within paragraph (a) or (b) of the definition of “communications data” in section 262(3),
(eb) the reference in section 87(10A)(b) to entity data were a reference to anything within paragraph (c) of the definition of “communications data” in section 262(3), and”

.
24 In section 227 (Investigatory Powers Commissioner and other Judicial Commissioners), after subsection (9) insert—

“(9A) Subsection (8) applies to the functions of the Investigatory Powers Commissioner under section 60A or 65(3B) only where the Investigatory Powers Commissioner is unable to exercise the functions because of illness or absence or for any other reason.”

.
25 In section 229 (main oversight functions), after subsection (8) insert—

“(8A) Subsections (6) and (7) also do not apply in relation to the functions of the Investigatory Powers Commissioner under section 60A or 65(3B).”

.
26 In Part 1 of Schedule 4, for the Table substitute—

“(1)Relevant public authority	(2)Paragraphs of section 60A(7) specified	(3)DSO: minimum office, rank or position	(4)Type of communications data that may be obtained by DSO	(5)Paragraphs of section 61(7) specified for DSO	(6)Paragraphs of section 61A(7) specified for DSO
Police force maintained under section 2 of the Police Act 1996	60A(7)(a), (b), (c), (d), (e) and (g)	Inspector	Entity data	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
		Superintendent	All	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
Metropolitan police force	60A(7)(a), (b), (c), (d), (e) and (g)	Inspector	Entity data	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
		Superintendent	All	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
City of London police force	60A(7)(a), (b), (c), (d), (e) and (g)	Inspector	Entity data	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
		Superintendent	All	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
Police Service of Scotland	60A(7)(a), (b), (c), (d), (e) and (g)	Inspector	Entity data	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
		Superintendent	All	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
Police Service of Northern Ireland	60A(7)(a), (b), (c), (d), (e) and (g)	Inspector	Entity data	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
		Superintendent	All	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
British Transport Police Force	60A(7)(a), (b), (c), (d), (e) and (g)	Inspector	Entity data	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
		Superintendent	All	61(7)(a) and (c)	61A(7)(a), (b), (c) and (e)
Ministry of Defence Police	60A(7)(a), (b), (c), and (e)	Inspector	Entity data	61(7)(a) and (c)	61A(7)(a) and (c)
		Superintendent	All	61(7)(a) and (c)	61A(7)(a) and (c)
Royal Navy Police	60A(7)(a), (b), (c), and (e)	Lieutenant Commander	Entity data	61(7)(a) and (c)	61A(7)(a) and (c)
		Commander	All	61(7)(a) and (c)	61A(7)(a) and (c)
Royal Military Police	60A(7)(a), (b), (c), and (e)	Major	Entity data	61(7)(a) and (c)	61A(7)(a) and (c)
		Lieutenant Colonel	All	61(7)(a) and (c)	61A(7)(a) and (c)
Royal Air Force Police	60A(7)(a), (b), (c), and (e)	Squadron Leader	Entity data	61(7)(a) and (c)	61A(7)(a) and (c)
		Wing Commander	All	61(7)(a) and (c)	61A(7)(a) and (c)
Security Service	60A(7)(a), (b) and (c)	General Duties 4 or any other level 4 officer	Entity data	61(7)(a), (b) and (c)	
		General Duties 3 or any other level 3 officer	All	61(7)(a), (b) and (c)	
Secret Intelligence Service	60A(7)(a), (b) and (c)	Grade 6	All	61(7)(a), (b) and (c)	
GCHQ	60A(7)(a), (b) and (c)	GC8	All	61(7)(a), (b) and (c)	
Ministry of Defence	60A(7)(a) and (b)	Member of the Senior Civil Service or equivalent	All	61(7)(a)	
		Grade 7 in the Fraud Defence Unit	All		61A(7)(a)
Department of Health	60A(7)(b) and (d)	Grade 7 in the Medicines and Healthcare Products Regulatory Agency	All		61A(7)(a) and (b)
		Grade 7 in the Anti-Fraud Unit	All		61A(7)(a)
Home Office	60A(7)(b), (d) and (g)	Immigration inspector or equivalent with responsibility for investigations or other functions relating to immigration and border security	All		61A(7)(a)
		Immigration inspector or equivalent with responsibility for anti-corruption in relation to investigations or other functions relating to immigration and border security	All		61A(7)(a)
		Immigration inspector or equivalent with responsibility for asylum fraud investigations	All		61A(7)(a)
		Immigration inspector or equivalent with responsibility for security and intelligence in the immigration detention estate	All		61A(7)(a), (b) and (e)
Ministry of Justice	60A(7)(b) and (d)	Manager in the security group of the National Offender Management Service responsible for intelligence	Entity data		61A(7)(a) and (b)
		Senior manager in the security group of the National Offender Manager Service responsible for intelligence	All		61A(7)(a) and (b)
National Crime Agency	60A(7)(b), (e) and (g)	Grade 3	Entity data		61A(7)(a), (c) and (e)
		Grade 2	All		61A(7)(a), (c) and (e)
Her Majesty's Revenue and Customs	60A(7)(b)	Higher officer	Entity data		61A(7)(a)
		Senior officer	All		61A(7)(a)
Department for Transport	60A(7)(b), (d) and (e)	Enforcement Officer in Maritime and Coastguard Agency	Entity data		61A(7)(a) and (b)
		Head of Enforcement in Maritime and Coastguard Agency	All		61A(7)(a) and (b)
		Maritime Operations Commander (Grade 7) in the Maritime and Coastguard Agency	All		61A(7)(c)
		Principal Inspector in the Air Accident Investigation Branch, the Marine Accident Investigation Branch or the Rail Accident Investigation Branch	All		61A(7)(b)
Department for Work and Pensions	60A(7)(b)	Senior Executive Officer in Fraud and Error Services	All		61A(7)(a)
		Senior Executive Officer in the Child Maintenance Group Central Legal Services	All		61A(7)(a)
An ambulance trust in England	60A(7)(e)	Duty Manager of Ambulance Trust Control Rooms	All		61A(7)(c)
Common Services Agency for the Scottish Health Service	60A(7)(b)	Head of Counter Fraud Services	All		61A(7)(a)
Competition and Markets Authority	60A(7)(b)	Member of the Senior Civil Service with responsibility for cartels or criminal enforcement	All		61A(7)(a)
Criminal Cases Review Commission	60A(7)(f)	Investigations Adviser	All		61A(7)(d)
Department for Communities in Northern Ireland	60A(7)(b)	Deputy Principal	All		61A(7)(a)
Department for the Economy in Northern Ireland	60A(7)(b)	Deputy chief inspector in trading standards services	All		61A(7)(a)
Department of Justice in Northern Ireland	60A(7)(b), (d) and (g)	Governor 4 in the Northern Ireland Prison Service	All		61A(7)(a), (b) and (e)
Financial Conduct Authority	60A(7)(b)	Head of department in the Enforcement and Market Oversight Division	All		61A(7)(a)
A fire and rescue authority under the Fire and Rescue Services Act 2004	60A(7)(e)	Watch Manager (Control)	All		61A(7)(c)
Food Standards Agency	60A(7)(b)	Grade 6	All		61A(7)(a)
Food Standards Scotland	60A(7)(b)	Head of the Scottish Food Crime and Incidents Unit	All		61A(7)(a)
Gambling Commission	60A(7)(b)	Senior manager	All		61A(7)(a)
Gangmasters and Labour Abuse Authority	60A(7)(b)	Head of operations	All		61A(7)(a)
Health and Safety Executive	60A(7)(b) and (d)	Band 1 inspector	All		61A(7)(a) and (b)
Independent Office for Police Conduct	60A(7)(b) and (g)	Director or an equivalent grade	All		61A(7)(a) and (e)
Information Commissioner	60A(7)(b)	Group manager	Entity data		61A(7)(a)
		Head of enforcement or an equivalent grade	All		61A(7)(a)
National Health Service Business Services Authority	60A(7)(b)	Senior manager (of pay band 8b) in the Counter Fraud and Security Management Services Division	All		61A(7)(a)
Northern Ireland Ambulance Service Health and Social Care Trust	60A(7)(e)	Watch Manager (Control)	All		61A(7)(c)
Northern Ireland Fire and Rescue Service Board	60A(7)(e)	Watch Manager (Control)	All		61A(7)(c)
Northern Ireland Health and Social Care Regional Business Services Organisation	60A(7)(b)	Assistant Director Counter Fraud and Probity Services	All		61A(7)(a)
Office of Communications	60A(7)(b)	Senior associate	All		61A(7)(a)
Office of the Police Ombudsman for Northern Ireland	60A(7)(b)	Senior investigating officer	All		61A(7)(a)
Police Investigations and Review Commissioner	60A(7)(b) and (g)	Commissioner or Director of Operations	All		61A(7)(a) and (e)
Scottish Ambulance Service Board	60A(7)(e)	Watch Manager (Control)	All		61A(7)(c)
Scottish Criminal Cases Review Commission	60A(7)(f)	Investigations Adviser	All		61A(7)(d)
Serious Fraud Office	60A(7)(b)	Grade 6	All		61A(7)(a)
Welsh Ambulance Services National Health Service Trust	60A(7)(e)	Watch Manager (Control)	All		61A(7)(c)”

.
27 In Schedule 9 (transitional, transitory and saving provision), in paragraph 6(1)—
(a) for paragraph (a) substitute—

“(a) “serious crime” in section 86(2A),”

;
(b) omit the “and” following paragraph (a);
(c) after paragraph (a) insert—

“(aa) “serious crime” in section 87(10B), and”

.
Sch. 1 para. 27(b)(c) in force at 1.11.2018 and Sch. 1 para. 27 in force at 5.2.2019 othwerwise, see reg. 1(3)(f)(4)(d)
28 In Schedule 10 (minor and consequential provision), omit paragraphs 57 and 58 (which are superseded by the amendments made by Schedule 2).

SCHEDULE 2 Consequential amendments
Regulation 11
1 (1) The Regulation of Investigatory Powers Act 2000 is amended as follows.
Sections 77A and 77B were inserted by the Protection of Freedoms Act 2012, Schedule 9, Part 3, paragraphs 6 and 15.
(2) In section 77A (procedure for order of sheriff: Scotland)—
(a) in the heading, omit “23A or”;
(b) in subsection (1), omit “23A or”;
(c) in subsection (3), for “sections 23B and 32B” substitute “ section 32B ”.
(3) In section 77B (procedure for order of district judge: Northern Ireland)—
(a) in the heading, omit “23A or”;
(b) in subsection (1), omit “23A or”;
(c) in subsection (4)—
(i) omit “23A or”;
(ii) for “sections 23B and 32B” substitute “ section 32B ”.
2 (1) The Regulation of Investigatory Powers (Communications Data) Order 2010 is amended as follows.
S.I. 2010/480; relevant amending instruments are S.I. 2013/472, 2013/602, 2015/228 and 2018/378.
(2) In article 2, omit paragraph (c).
(3) In Schedule 1, in column 4 of the table, omit “, (e)” in the entries relating to the following—
(a) a police force maintained under section 2 of the Police Act 1996;
(b) the metropolitan police force;
(c) the City of London police force;
(d) the Police Service of Scotland;
(e) the Police Service of Northern Ireland;
(f) the British Transport Police.
(4) In that Schedule, in column 4 of the table, in the entry relating to the Commissioners for Her Majesty's Revenue and Customs, omit “and (f)”.
(5) In Schedule 2, in column 4 of the table in Part 1—
(a) in the entry relating to the Financial Conduct Authority, omit “Article 2(c)”;
(b) in the entry relating to the Prudential Regulation Authority, omit “Article 2(c)”.
(6) In that Schedule, in column 4 of the table in Part 2—
(a) in the entry relating to the Department of Health and Social Care, for “, (d) and (e)” substitute “ and (d) ”;
(b) in the entry relating to the Health and Safety Executive, for “, (d) and (e)” substitute “ and (d) ”.

(This note is not part of the Regulations)
These Regulations amend Parts 3 and 4 of the Investigatory Powers Act 2016 (c. 25) (“the Act”), which provide for the retention of communications data by telecommunications and postal operators, and the acquisition of that communications data by public authorities, and bring into force a code of practice in relation to those provisions.
Regulation 2 brings into force a code of practice entitled “Communications Data”, about the exercise of functions conferred by Parts 3 and 4 of the Act. The code of practice comes into force on the day after the day on which these Regulations are made.
The code of practice will be published by the Stationery Office and copies may be obtained from the Stationery Office bookshops or online shop. The code of practice will also be available on the Investigatory Powers Act 2016 codes of practice pages on the gov.uk website.
The amendments to Parts 3 and 4 of the Act are made in response to the judgment of the Court of Justice of the European Union (CJEU) in joined cases C‑203/15 and C‑698/15, setting out safeguards required in order that a communications data retention regime is compliant with EU law.
Part 3 of the Act is not yet in force and the Regulations also amend Chapter 2 of Part 1 of the Regulation of Investigatory Powers Act 2000 (c. 25) (“RIPA”), which currently provides for the acquisition of communications data by public authorities and will be replaced by Part 3 of the Act.
Regulation 3 amends section 22 of RIPA so that access to certain communications data (traffic or location data) may be authorised only for the purpose of the prevention or detection of serious crime. A request for subscriber data may be authorised for the purpose of the prevention or detection of crime or of preventing disorder, as is currently the case for all communications data under RIPA. Three of the statutory purposes for which access to communications data may currently be authorised are also removed by this regulation and by paragraph 2(2) of Schedule 2 to these Regulations.
Regulation 5 amends Part 3 of the Act to provide for independent authorisation of requests by public authorities to access communications data, conferring on the Investigatory Powers Commissioner a new power to authorise communications data requests. The Commissioner, acting through a body of his staff to be known as the Office for Communications Data Authorisations, will be responsible for considering the vast majority of requests to access communications data made by public authorities. A request may be authorised where it is necessary for one or more of the statutory purposes, and proportionate. In relation to the crime purpose, the effect of the amendments is that access to events data may be authorised for the purpose of the prevention or detection of serious crime, but a request solely for entity data may be made for the purpose of the prevention or detection of crime or of preventing disorder.
Regulation 6 amends the power in Part 3 of the Act to authorise requests to access communications data internally within a public authority. The effect of the amendments is that the power will only be exercisable to access communications data in the interests of national security, or of the economic well-being of the UK so far as relevant to national security, or for the purpose of the prevention or detection of serious crime. Where a request is solely for entity data a request may be made for the purpose of the prevention or detection of crime or of preventing disorder.
Regulation 7 amends the Act to permit internal authorisation by a designated senior officer in a public authority (except a local authority) in a case where there is an urgent need to obtain communications data.
Regulation 8 amends Part 4 of the Act to restrict the purposes for which the Secretary State may give a notice to a telecommunications or postal operator requiring the retention of communications data. A notice may be given where it is necessary and proportionate to retain data in the interests of national security or of the economic well-being of the UK so far as relevant to national security, in the interests of public safety, for the purpose of preventing death or injury or to assist investigations into alleged miscarriages of justice. A notice may be given for the purpose of the prevention or detection of serious crime so far as it relates to events data, or for the purpose of the prevention or detection of crime or of preventing disorder so far as it relates to entity data.
Regulation 9 amends the Act to include additional matters which the Secretary of State must take into account before giving a retention notice.
Regulation 10 introduces Schedule 1 to the Regulations which makes further amendments of the Act, in the main consequential on the amendments in regulations 2 to 7. Paragraph 15 removes the requirement for local authority applications to be subject to judicial approval by a magistrate, in light of the new independent authorisation arrangements. Paragraph 21 inserts a definition of serious crime for the purposes of Part 3 of the Act. Paragraph 26 substitutes the Table contained in Part 1 of Schedule 4 to the Act, which sets out which public authorities may acquire communications data, the purposes for which each public authority may do so, the types of data they may obtain and the level of internal authorisation required within that organisation.
Regulation 11 introduces Schedule 2 to the Regulations, which makes consequential amendments of RIPA and the Regulation of Investigatory Powers (Communications Data) Order 2010 (S.I. 2010/480).
An impact assessment of the effect that this instrument will have on the costs of business, the voluntary sector and the public sector is available alongside this instrument at www.legislation.gov.uk.