Statutory Instruments
Electronic Communications
Made
31st October 2018
Coming into force in accordance with regulation 1
The Secretary of State, being a Minister designated M1 for the purposes of section 2(2) of the European Communities Act 1972 M2 in respect of matters relating to electronic communications, in exercise of the powers conferred by that section and by paragraph 4(3) of Schedule 7 to the Investigatory Powers Act 2016 M3 makes the following Regulations.
In accordance with paragraph 4(1) of Schedule 7 to the Investigatory Powers Act 2016, the Secretary of State has prepared and published a draft of the code of practice brought into force by these Regulations, considered representations made about the draft and modified it.
In accordance with paragraph 4(2) of that Schedule, the Secretary of State has consulted the Investigatory Powers Commissioner and the Information Commissioner.
In accordance with paragraph 4(4) of that Schedule and paragraph 2(2) of Schedule 2 to the European Communities Act 1972, a draft of these Regulations was laid before Parliament and approved by a resolution of each House of Parliament.
In accordance with paragraph 4(5) of Schedule 7 to the Investigatory Powers Act 2016, when a draft of these Regulations was laid before Parliament, the code of practice brought into force by these Regulations was also laid.
Marginal Citations
M21972 c. 68. Section 2(2) was amended by the Legislative and Regulatory Reform Act 2006 (c. 51) section 27(1)(a), and the European Communities (Amendment) Act 2008 (c.7) Schedule, Part 1.
1.—(1) These Regulations may be cited as the Data Retention and Acquisition Regulations 2018.
(2) This regulation and regulation 2 come into force on the day after the day on which these Regulations are made.
(3) The following provisions of these Regulations come into force on 1st November 2018—
(a)regulation 3;
(b)regulation 4 for the purposes of regulations 8 to 10;
(c)regulations 8 and 9;
(d)regulation 10 for the purposes of paragraphs 22, 23 and 27(b) and (c) of Schedule 1;
(e)regulation 11 for the purposes of paragraph 2 of Schedule 2;
(f)paragraphs 22, 23 and 27(b) and (c) of Schedule 1;
(g)paragraph 2 of Schedule 2.
(4) Subject to paragraph (5), the following provisions of these Regulations come into force on the day that section 61(1) of the Investigatory Powers Act 2016 comes into force—
(a)regulation 4 for all remaining purposes;
(b)regulations 5 to 7;
(c)regulations 10 and 11 for all remaining purposes;
(d)Schedule 1 so far as not already in force;
(e)paragraph 1 of Schedule 2.
(5) Where section 61(1) of the Investigatory Powers Act 2016 comes into force on a day only for a particular purpose or purposes specified in regulations under section 272(1) of that Act, the provisions specified in paragraph (4) come into force on that day only for that purpose or (as the case may be) those purposes.
2. The code of practice entitled “Communications Data” laid before Parliament on 28th June 2018 has effect.
F13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Textual Amendments
F1Reg. 3 revoked (1.1.2024) by Retained EU Law (Revocation and Reform) Act 2023 (c. 28), ss. 1(1), 22(3), Sch. 1 Pt. 1 (with s. 1(3)(4)); S.I. 2023/1363, reg. 2
4. The Investigatory Powers Act 2016 is amended in accordance with regulations 5 to 10.
Commencement Information
I1Reg. 4 in force at 1.11.2018 for specificed purposes and at 5.2.2019 otherwise, see reg. 1(3)(b)(4)(a)
5. After the heading of Part 3 insert—
60A.—(1) Subsection (2) applies if the Investigatory Powers Commissioner, on an application made by a relevant public authority, considers—
(a)that it is necessary for the relevant public authority to obtain communications data for a purpose falling within subsection (7),
(b)that it is necessary for the relevant public authority to obtain the data—
(i)for the purposes of a specific investigation or a specific operation, or
(ii)for the purposes of testing, maintaining or developing equipment, systems or other capabilities relating to the availability or obtaining of communications data, and
(c)that the conduct authorised by the authorisation is proportionate to what is sought to be achieved.
(2) The Investigatory Powers Commissioner may authorise the relevant public authority to engage in any conduct which—
(a)is for the purpose of obtaining the data from any person, and
(b)relates to—
(i)a telecommunication system, or
(ii)data derived from a telecommunication system.
(3) Subsections (1) and (2) are subject to—
(a)section 62 (restrictions in relation to internet connection records),
(b)sections 70, 73 and 75 and Schedule 4 (restrictions relating to certain relevant public authorities),
(c)section 76 (requirement to consult a single point of contact), and
(d)section 77 (Commissioner approval for authorisations to identify or confirm journalistic sources).
(4) Authorised conduct may, in particular, consist of the relevant public authority—
(a)obtaining the communications data itself from any person or telecommunication system,
(b)asking any person whom the relevant public authority believes is, or may be, in possession of the communications data or capable of obtaining it—
(i)to obtain the data (if not already in possession of it), and
(ii)to disclose the data (whether already in the person's possession or subsequently obtained by that person) to the relevant public authority, or
(c)requiring by notice a telecommunications operator whom the relevant public authority believes is, or may be, in possession of the communications data or capable of obtaining it—
(i)to obtain the data (if not already in possession of it), and
(ii)to disclose the data (whether already in the operator's possession or subsequently obtained by the operator) to the relevant public authority.
(5) An authorisation—
(a)may relate to data whether or not in existence at the time of the authorisation,
(b)may authorise the obtaining or disclosure of data by a person other than the relevant public authority, or any other conduct by such a person, which enables or facilitates the obtaining of the communications data concerned, and
(c)may, in particular, require a telecommunications operator who controls or provides a telecommunications system to obtain or disclose data relating to the use of a telecommunications service provided by another telecommunications operator in relation to that system.
(6) An authorisation may not authorise any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system.
(7) It is necessary to obtain communications data for a purpose falling within this subsection if it is necessary to obtain the data—
(a)in the interests of national security,
(b)for the applicable crime purpose (see subsection (8)),
(c)in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,
(d)in the interests of public safety,
(e)for the purpose of preventing death or injury or any damage to a person's physical or mental health, or of mitigating any injury or damage to a person's physical or mental health,
(f)to assist investigations into alleged miscarriages of justice, or
(g)where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition—
(i)to assist in identifying P, or
(ii)to obtain information about P's next of kin or other persons connected with P or about the reasons for P's death or condition.
(8) In subsection (7)(b), “the applicable crime purpose” means—
(a)where the communications data is wholly or partly events data, the purpose of preventing or detecting serious crime;
(b)in any other case, the purpose of preventing or detecting crime or of preventing disorder.
(9) The fact that the communications data which would be obtained in pursuance of an authorisation relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that it is necessary to obtain the data for a purpose falling within subsection (7).
(10) See—
(a)sections 70 and 73 for the meaning of “relevant public authority”;
(b)section 84 for the way in which this Part applies to postal operators and postal services;
(c)section 86(2A) for the meaning of “serious crime”.”.
6.—(1) In the italic heading before section 61, at the end insert “ : designated senior officers ”.
(2) Section 61 (power to grant authorisations) is amended as follows.
(3) In the heading, after “Power” insert “ of designated senior officers ”.
(4) In subsection (3), in paragraph (c), for “and 73 to 75” substitute “ , 73 and 75 ”.
(5) In subsection (7)—
(a)for paragraph (b) substitute—
“(b)for the applicable crime purpose (see subsection (7A)), or”;
(b)omit paragraphs (d) to (j).
(6) After subsection (7) insert—
“(7A) In subsection (7)(b), “the applicable crime purpose” means—
(a)where the communications data is wholly or partly events data, the purpose of preventing or detecting serious crime;
(b)in any other case, the purpose of preventing or detecting crime or of preventing disorder.”.
(7) In subsection (9), after paragraph (b) insert—
“(c)section 86(2A) for the meaning of “serious crime”.”.
7. After section 61 insert—
(1) Subsection (2) applies if a designated senior officer of a relevant public authority considers—
(a)that it is necessary to obtain communications data for a purpose falling within subsection (7),
(b)that it is necessary to obtain the data for the purposes of a specific investigation or a specific operation,
(c)that there is an urgent need to obtain the data, and
(d)that the conduct authorised by the authorisation is proportionate to what is sought to be achieved.
(2) The designated senior officer may authorise any officer of the relevant public authority to engage in any conduct which—
(a)is for the purpose of obtaining the data from any person, and
(b)relates to—
(i)a telecommunication system, or
(ii)data derived from a telecommunication system.
(3) Subsections (1) and (2) are subject to—
(a)section 62 (restrictions in relation to internet connection records),
(b)sections 70, 73 and 75 and Schedule 4 (restrictions relating to certain relevant public authorities),
(d)section 76 (requirement to consult a single point of contact), and
(e)section 77 (Commissioner approval for authorisations to identify or confirm journalistic sources).
(4) Authorised conduct may, in particular, consist of an authorised officer—
(a)obtaining the communications data themselves from any person or telecommunication system,
(b)asking any person whom the authorised officer believes is, or may be, in possession of the communications data or capable of obtaining it—
(i)to obtain the data (if not already in possession of it), and
(ii)to disclose the data (whether already in the person's possession or subsequently obtained by that person) to a person identified by, or in accordance with, the authorisation, or
(c)requiring by notice a telecommunications operator whom the authorised officer believes is, or may be, in possession of the communications data or capable of obtaining it—
(i)to obtain the data (if not already in possession of it), and
(ii)to disclose the data (whether already in the operator's possession or subsequently obtained by the operator) to a person identified by, or in accordance with, the authorisation.
(5) An authorisation—
(a)may relate to data whether or not in existence at the time of the authorisation,
(b)may authorise the obtaining or disclosure of data by a person who is not an authorised officer, or any other conduct by such a person, which enables or facilitates the obtaining of the communications data concerned, and
(c)may, in particular, require a telecommunications operator who controls or provides a telecommunications system to obtain or disclose data relating to the use of a telecommunications service provided by another telecommunications operator in relation to that system.
(6) An authorisation—
(a)may not authorise any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system, and
(b)may not authorise an authorised officer to ask or require, in the circumstances mentioned in subsection (4)(b) or (c), a person to disclose the data to any person other than—
(i)an authorised officer, or
(ii)an officer of the same relevant public authority as an authorised officer.
(7) It is necessary to obtain communications data for a purpose falling within this subsection if it is necessary to obtain the data—
(a)for the applicable crime purpose (see subsection (8)),
(b)in the interests of public safety,
(c)for the purpose of preventing death or injury or any damage to a person's physical or mental health, or of mitigating any injury or damage to a person's physical or mental health,
(d)to assist investigations into alleged miscarriages of justice, or
(e)where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition—
(i)to assist in identifying P, or
(ii)to obtain information about P's next of kin or other persons connected with P or about the reasons for P's death or condition.
(8) In subsection (7)(a), “the applicable crime purpose” means—
(a)where the communications data is wholly or partly events data, the purpose of preventing or detecting serious crime;
(b)in any other case, the purpose of preventing or detecting crime or of preventing disorder.
(9) The fact that the communications data which would be obtained in pursuance of an authorisation relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that it is necessary to obtain the data for a purpose falling within subsection (7).
(10) See—
(a)sections 70 and 73 for the meanings of “designated senior officer” and “relevant public authority”;
(b)section 84 for the way in which this Part applies to postal operators and postal services;
(c)section 86(2A) for the meaning of “serious crime”.”.
8.—(1) Section 87 (powers to require retention of certain data) is amended as follows.
(2) In subsection (1)(a), for the words from “purposes falling” to “obtained),” substitute “following purposes—
(i)in the interests of national security,
(ii)for the applicable crime purpose (see subsection (10A)),
(iii)in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,
(iv)in the interests of public safety,
(v)for the purpose of preventing death or injury or any damage to a person's physical or mental health, or of mitigating any injury or damage to a person's physical or mental health,
(vi)to assist investigations into alleged miscarriages of justice,”.
(3) In subsection (8), after paragraph (a) insert—
“(aa)each telecommunications service (or description of telecommunications service) to which it relates,”.
(4) In subsection (10), for the words from “paragraphs” to the end substitute “ sub-paragraphs (i) to (vi) of subsection (1)(a) ”.
(5) After subsection (10) insert—
“(10A) In this section, “the applicable crime purpose” means—
(a)to the extent that a retention notice relates to events data, the purpose of preventing or detecting serious crime;
(b)to the extent that a retention notice relates to entity data, the purpose of preventing or detecting crime or of preventing disorder.
(10B) In subsection (10A)(a), “serious crime” means, in addition to crime which falls within paragraph (a) or (b) of the definition of “serious crime” in section 263(1), crime where the offence, or one of the offences, which is or would be constituted by the conduct concerned is—
(a)an offence for which an individual who has reached the age of 18 (or, in relation to Scotland or Northern Ireland, 21) is capable of being sentenced to imprisonment for a term of 12 months or more (disregarding any enactment prohibiting or restricting the imprisonment of individuals who have no previous convictions), or
(b)an offence—
(i)by a person who is not an individual, or
(ii)which involves, as an integral part of it, the sending of a communication or a breach of a person's privacy.”.
9. In section 88 (matters to be taken into account before giving retention notices), in subsection (1)—
(a)in paragraph (a), after “notice” insert “ , including in relation to one or more of the purposes mentioned in sub-paragraphs (i) to (vi) of section 87(1)(a) (purposes for which retention of communications data may be required) ”;
(b)after paragraph (a) insert—
“(aa)the telecommunications services to which the retention notice relates,
(ab)the appropriateness of limiting the data to be retained by reference to—
(i)location, or
(ii)descriptions of persons to whom telecommunications services are provided,”.
M410. Schedule 1 makes further amendments of the Investigatory Powers Act 2016.
Marginal Citations
M4Reg. 10 in force for specified purposes at 1.11.2018 and at 5.2.2019 otherwise, see reg. 1(3)(d)(4)(c)
11. Schedule 2 makes consequential amendments of other legislation.
Commencement Information
I2Reg. 11 in force at 1.11.2018 for specified purposes and at 5.2.2018 otherwise, see reg. 1(3)(e)(4)(c)
Ben Wallace
Minister of State
Home Office
Regulation 10
1. Omit section 2(6) (definition of “public authority”).U.K.
2. Before section 62 insert the italic heading “ Further provision about authorisations ”.U.K.
3.—(1) Section 62 (restrictions in relation to internet connection records) is amended as follows.U.K.
(2) Before subsection (1) insert—
“(A1) The Investigatory Powers Commissioner may not, on the application of a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record.
(A2) The Investigatory Powers Commissioner may not, on the application of a relevant public authority which is not a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B or C is met.”.
(3) Omit subsection (1).
(4) In subsection (3)—
(a)for “the designated senior officer” substitute “ the person with power to grant the authorisation ”;
(b)for “section 61(7)” substitute “ section 60A(7), 61(7) or 61A(7) (as applicable) ”.
(5) In subsection (4)—
(a)in paragraph (a), for the words from “section 61(7)” to “crime,” substitute “ section 60A(7), 61(7) or 61A(7) (as applicable) but is not the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a) or the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b), ”;
(b)in paragraph (b), for “the designated senior officer” substitute “ the person with power to grant the authorisation ”.
(6) In subsection (5)—
(a)for paragraph (a) substitute—
“(a)either—
(i)the purpose for which the data is to be obtained is the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a), or
(ii)the purpose for which the data is to be obtained is the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b) and the crime to be prevented or detected is serious crime, and”;
(b)omit paragraph (b) and the “and” following it;
(c)in paragraph (c), for “the designated senior officer” substitute “ the person with power to grant the authorisation ”.
(7) Omit subsection (6).
4.—(1) Section 63 (additional restrictions on grant of authorisations) is amended as follows.U.K.
(2) In the heading, after “authorisations” insert “ under section 61 ”.
(3) In subsection (1), after “authorisation” insert “ under section 61 ”.
(4) In subsection (3)—
(a)after paragraph (b), insert “ or ”;
(b)omit paragraph (d) and the “or” before it.
5.—(1) Section 64 (procedure for authorisations and authorised notices) is amended as follows.U.K.
(2) In subsection (1)—
(a)omit paragraph (a);
(b)before paragraph (b) insert—
“(aa)whether the authorisation has been granted by the Investigatory Powers Commissioner under section 60A or by a designated senior officer under section 61 or 61A;”;
(c)in paragraph (b), for “section 61(7)” substitute “ section 60A(7), 61(7) or 61A(7) (as applicable) ”.
(3) After subsection (1) insert—
“(1A) An authorisation granted by a designated senior officer under section 61 or 61A must also specify the office, rank or position held by the officer.”.
6.—(1) Section 65 (duration and cancellation of authorisations and notices) is amended as follows.U.K.
(2) In subsection (1), after “authorisation” insert “ under section 60A or 61 ”.
(3) In subsection (2), after “authorisation”, in the first place it occurs, insert “ under section 60A or 61 ”.
(4) After subsection (3) insert—
“(3A) An authorisation under section 61A ceases to have effect at the end of the period of 3 days beginning with the date on which it is granted.”.
(5) After subsection (3A) (as inserted by sub-paragraph (4)) insert—
“(3B) Where the Investigatory Powers Commissioner has granted an authorisation under section 60A to a relevant public authority—
(a)the Investigatory Powers Commissioner or an officer of the authority may cancel it at any time, and
(b)the Investigatory Powers Commissioner or an officer of the authority must cancel it if the Commissioner or (as the case may be) the officer considers that the requirements of this Part would not be satisfied in relation to granting an equivalent new authorisation.”.
(6) In subsection (4), after “authorisation”, in the first place it occurs, insert “ under section 61 or 61A ”.
(7) In subsection (7)—
(a)in paragraph (a), after “subsection (1)” insert “ or (3A) ”;
(b)in paragraph (b), for “subsection (4)” substitute “ subsection (3B) or (4) ”.
7. In section 67 (filtering arrangements for obtaining data), in subsection (1)(a), for “a designated senior officer, who is” substitute “ a person, who is ”.U.K.
8.—(1) Section 68 (use of filtering arrangements in pursuance of an authorisation) is amended as follows.U.K.
(2) In subsection (3), in the words before paragraph (a), for “the designated senior officer's decision” substitute “ the decision of the person granting the authorisation ”.
(3) In subsection (4), in the words before paragraph (a), for “A designated senior officer” substitute “ A person ”.
(4) In subsection (5), for “the designated senior officer” substitute “ the person ”.
9. In section 69 (duties in connection with operation of filtering arrangements), in subsection (1)(b), in the words following sub-paragraph (ii), for “to the designated senior officer concerned” substitute “ to the person considering whether to grant the authorisation ”.U.K.
10.—(1) Section 70 (relevant public authorities and designated senior officers) is amended as follows.U.K.
(2) After subsection (2) insert—
“(2A) An authorisation under section 60A may be granted on the application of a relevant public authority listed in column 1 of the table only if section 60A(1)(a) is met in relation to a purpose within one of the paragraphs of section 60A(7) specified in the corresponding entry in column 2 of the table.”.
(3) In subsection (3)—
(a)in paragraph (a), for “column 2” substitute “ column 3 ”;
(b)in paragraph (b), for “column 2” substitute “ column 3 ”.
(4) In subsection (4), for “column 2” substitute “ column 3 ”.
(5) After subsection (5) insert—
“(5A) A person who is a designated senior officer of a relevant public authority by virtue of subsection (3) and an entry in column 3 of the table may grant an authorisation under section 61—
(a)only for obtaining communications data of the kind specified in the corresponding entry in column 4 of the table,
(b)only if one or more paragraphs of section 61(7) is specified in the corresponding entry in column 5 of the table, and
(c)only if section 61(1)(a) is met in relation to a purpose within the specified paragraph or, if more than one paragraph is specified, a purpose within one of them.”.
(6) In subsection (6)—
(a)in the words before paragraph (a)—
(i)for “column 2” substitute “ column 3 ”;
(ii)after “authorisation” insert “ under section 61A ”;
(b)in paragraph (a), for “column 3” substitute “ column 4 ”;
(c)omit the “and” following paragraph (a);
(d)for paragraph (b) substitute—
“(b)only if one or more paragraphs of section 61A(7) is specified in the corresponding entry in column 6 of the table, and
(c)only if section 61A(1)(a) is met in relation to a purpose within the specified paragraph or, if more than one paragraph is specified, a purpose within one of them.”.
(7) In subsection (7)—
(a)for “column 2” substitute “ column 3 ”;
(b)for “subsection (6) applies” substitute “ subsections (5A) and (6) apply ”.
11.—(1) Section 71 (power to modify section 70 and Schedule 4) is amended as follows.U.K.
(2) In subsection (2)—
(a)in paragraph (c), omit “by a designated senior officer with a specified public authority”;
(b)in paragraph (d), for the words from “such authorisations” to the end of the paragraph substitute “ the authorisations may be granted ”.
(3) After subsection (2) insert—
“(2A) Regulations adding a public authority to, or removing a public authority from, the list in column 1 of the table may do so in relation to all or any of the following—
(a)authorisations under section 60A by the Investigatory Powers Commissioner;
(b)authorisations by a designated senior officer under section 61;
(c)authorisations by a designated senior officer under section 61A.”.
(4) In subsection (3), after “relevant public authority” insert “ (in relation to one or more of the authorisations mentioned in subsection (2A)) ”.
12. In section 72 (certain regulations under section 71: supplementary), in subsection (1)—U.K.
(a)in paragraph (a), after “Schedule 4” insert “ (in relation to one or more of the authorisations mentioned in section 71(2A) ”;
(b)in paragraph (b), for “column 2” substitute “ column 3 ”.
13.—(1) Section 73 (local authorities as relevant public authorities) is amended as follows.U.K.
(2) In subsection (1), at the end insert “ but only so far as relating to authorisations under section 60A ”.
(3) Omit subsections (2) and (4) to (7).
(4) For subsection (3) substitute—
“(3) An authorisation may not be granted under section 60A on the application of a local authority unless—
(a)section 60A(1)(a) is met in relation to a purpose within section 60A(7)(b),
(b)the local authority is a party to a collaboration agreement (whether as a supplying authority or a subscribing authority or both), and
(c)that collaboration agreement is certified by the Secretary of State (having regard to guidance given by virtue of section 79(6) and (7)) as being appropriate for the local authority.
(3A) In subsection (3), “collaboration agreement”, “subscribing authority” and “supplying authority” have the same meaning as in section 78.”.
14. Omit section 74 (requirement to be party to collaboration agreement).U.K.
15. Omit section 75 (judicial approval for local authority authorisations).U.K.
16.—(1) Section 76 (use of a single point of contact) is amended as follows.U.K.
(2) Before subsection (1) insert—
“(A1) Before making an application for an authorisation under section 60A, the officer making the application must consult a person who is acting as a single point of contact in relation to the making of applications.”.
(3) In subsection (1), after “an authorisation” insert “ under section 61 or 61A ”.
(4) In subsection (2)—
(a)after “if the” insert “ officer or (as the case may be) ”;
(b)for “subsection (1)” substitute “ subsection (A1) or (as the case may be) (1) ”.
(5) In subsection (4), in paragraph (b)(i), after “authorisations” insert “ (whether under section 60A, 61 or 61A) ”.
17.—(1) Section 77 (Commissioner approval for authorisations to identify or confirm journalistic sources) is amended as follows.U.K.
(2) In subsection (1)(a), after “an authorisation” insert “ under section 61 or 61A ”.
(3) After subsection (1) insert—
“(1A) Subsection (2) also applies if—
(a)a person to whom functions under section 60A have been delegated under section 238(5) has granted an authorisation under that section in relation to the obtaining by a relevant public authority of communications data for the purpose of identifying or confirming a source of journalistic information, and
(b)the authorisation is not necessary because of an imminent threat to life.”.
18.—(1) Section 78 (collaboration agreements) is amended as follows.U.K.
F2(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F2(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) Omit subsections (3) and (4).
F3(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Textual Amendments
F2Sch. 1 para. 18(2)(3) revoked (17.5.2019) by The Communications Data Acquisition Regulations 2019 (S.I. 2019/939), regs. 1(2), 6
F3Sch. 1 para. 18(5) revoked (17.5.2019) by The Communications Data Acquisition Regulations 2019 (S.I. 2019/939), regs. 1(2), 6
19.—(1) Section 80 (police collaboration agreements) is amended as follows.U.K.
F4(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F4(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) Omit subsections (3) and (4).
F5(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Textual Amendments
F4Sch. 1 para. 19(2)(3) revoked (17.5.2019) by The Communications Data Acquisition Regulations 2019 (S.I. 2019/939), regs. 1(2), 6
F5Sch. 1 para. 19(5) revoked (17.5.2019) by The Communications Data Acquisition Regulations 2019 (S.I. 2019/939), regs. 1(2), 6
20. In section 84 (application of Part 3 to postal operators and postal services), in subsection (2)—U.K.
(a)omit the “and” at the end of paragraph (d);
(b)after paragraph (d) insert—
“(da)the reference in sections 60A(8)(a), 61(7A)(a) and 61A(8)(a) to events data were a reference to anything within paragraph (a) or (b) of the definition of “communications data” in section 262(3), and”.
21.—(1) Section 86 (Part 3: interpretation) is amended as follows.U.K.
(2) In subsection (1)—
(a)in the definition of “authorisation”, for the words from “under section 61” to the end of the definition substitute “ under section 60A, 61 or 61A ”;
(b)in the definition of “designated senior officer”—
(i)omit paragraph (a) and the “and” following it;
(ii)in paragraph (b), omit “other”.
(3) After subsection (2) insert—
“(2A) In this Part, “serious crime” means, in addition to crime which falls within paragraph (a) or (b) of the definition of “serious crime” in section 263(1), crime where the offence, or one of the offences, which is or would be constituted by the conduct concerned is—
(a)an offence for which an individual who has reached the age of 18 (or, in relation to Scotland or Northern Ireland, 21) is capable of being sentenced to imprisonment for a term of 12 months or more (disregarding any enactment prohibiting or restricting the imprisonment of individuals who have no previous convictions), or
(b)an offence—
(i)by a person who is not an individual, or
(ii)which involves, as an integral part of it, the sending of a communication or a breach of a person's privacy.”.
22. In the following provisions, for the words “paragraphs (a) to (j) of section 61(7)” substitute “ sub-paragraphs (i) to (vi) of section 87(1)(a) ”U.K.
(a)section 89(1) (approval by Judicial Commissioner);
(b)section 91(1) (approval by Investigatory Powers Commissioner);
(c)section 94(4)(a) and (5) (grounds on which certain retention notices may be varied etc).
23. In section 96 (application of Part 4 to postal operators and postal services), in subsection (2)—U.K.
(a)omit the “and” at the end of paragraph (e);
(b)after paragraph (e) insert—
“(ea)the reference in section 87(10A)(a) to events data were a reference to anything within paragraph (a) or (b) of the definition of “communications data” in section 262(3),
(eb)the reference in section 87(10A)(b) to entity data were a reference to anything within paragraph (c) of the definition of “communications data” in section 262(3), and”.
24. In section 227 (Investigatory Powers Commissioner and other Judicial Commissioners), after subsection (9) insert—U.K.
“(9A) Subsection (8) applies to the functions of the Investigatory Powers Commissioner under section 60A or 65(3B) only where the Investigatory Powers Commissioner is unable to exercise the functions because of illness or absence or for any other reason.”.
25. In section 229 (main oversight functions), after subsection (8) insert—U.K.
“(8A) Subsections (6) and (7) also do not apply in relation to the functions of the Investigatory Powers Commissioner under section 60A or 65(3B).”.
26. In Part 1 of Schedule 4, for the Table substitute—U.K.
| “(1) Relevant public authority | (2) Paragraphs of section 60A(7) specified | (3) DSO: minimum office, rank or position | (4) Type of communications data that may be obtained by DSO | (5) Paragraphs of section 61(7) specified for DSO | (6) Paragraphs of section 61A(7) specified for DSO |
|---|---|---|---|---|---|
| Police force maintained under section 2 of the Police Act 1996 | 60A(7)(a), (b), (c), (d), (e) and (g) | Inspector | Entity data | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) |
| Superintendent | All | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) | ||
| Metropolitan police force | 60A(7)(a), (b), (c), (d), (e) and (g) | Inspector | Entity data | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) |
| Superintendent | All | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) | ||
| City of London police force | 60A(7)(a), (b), (c), (d), (e) and (g) | Inspector | Entity data | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) |
| Superintendent | All | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) | ||
| Police Service of Scotland | 60A(7)(a), (b), (c), (d), (e) and (g) | Inspector | Entity data | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) |
| Superintendent | All | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) | ||
| Police Service of Northern Ireland | 60A(7)(a), (b), (c), (d), (e) and (g) | Inspector | Entity data | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) |
| Superintendent | All | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) | ||
| British Transport Police Force | 60A(7)(a), (b), (c), (d), (e) and (g) | Inspector | Entity data | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) |
| Superintendent | All | 61(7)(a) and (c) | 61A(7)(a), (b), (c) and (e) | ||
| Ministry of Defence Police | 60A(7)(a), (b), (c), and (e) | Inspector | Entity data | 61(7)(a) and (c) | 61A(7)(a) and (c) |
| Superintendent | All | 61(7)(a) and (c) | 61A(7)(a) and (c) | ||
| Royal Navy Police | 60A(7)(a), (b), (c), and (e) | Lieutenant Commander | Entity data | 61(7)(a) and (c) | 61A(7)(a) and (c) |
| Commander | All | 61(7)(a) and (c) | 61A(7)(a) and (c) | ||
| Royal Military Police | 60A(7)(a), (b), (c), and (e) | Major | Entity data | 61(7)(a) and (c) | 61A(7)(a) and (c) |
| Lieutenant Colonel | All | 61(7)(a) and (c) | 61A(7)(a) and (c) | ||
| Royal Air Force Police | 60A(7)(a), (b), (c), and (e) | Squadron Leader | Entity data | 61(7)(a) and (c) | 61A(7)(a) and (c) |
| Wing Commander | All | 61(7)(a) and (c) | 61A(7)(a) and (c) | ||
| Security Service | 60A(7)(a), (b) and (c) | General Duties 4 or any other level 4 officer | Entity data | 61(7)(a), (b) and (c) | |
| General Duties 3 or any other level 3 officer | All | 61(7)(a), (b) and (c) | |||
| Secret Intelligence Service | 60A(7)(a), (b) and (c) | Grade 6 | All | 61(7)(a), (b) and (c) | |
| GCHQ | 60A(7)(a), (b) and (c) | GC8 | All | 61(7)(a), (b) and (c) | |
| Ministry of Defence | 60A(7)(a) and (b) | Member of the Senior Civil Service or equivalent | All | 61(7)(a) | |
| Grade 7 in the Fraud Defence Unit | All | 61A(7)(a) | |||
| Department of Health | 60A(7)(b) and (d) | Grade 7 in the Medicines and Healthcare Products Regulatory Agency | All | 61A(7)(a) and (b) | |
| Grade 7 in the Anti-Fraud Unit | All | 61A(7)(a) | |||
| Home Office | 60A(7)(b), (d) and (g) | Immigration inspector or equivalent with responsibility for investigations or other functions relating to immigration and border security | All | 61A(7)(a) | |
| Immigration inspector or equivalent with responsibility for anti-corruption in relation to investigations or other functions relating to immigration and border security | All | 61A(7)(a) | |||
| Immigration inspector or equivalent with responsibility for asylum fraud investigations | All | 61A(7)(a) | |||
| Immigration inspector or equivalent with responsibility for security and intelligence in the immigration detention estate | All | 61A(7)(a), (b) and (e) | |||
| Ministry of Justice | 60A(7)(b) and (d) | Manager in the security group of the National Offender Management Service responsible for intelligence | Entity data | 61A(7)(a) and (b) | |
| Senior manager in the security group of the National Offender Manager Service responsible for intelligence | All | 61A(7)(a) and (b) | |||
| National Crime Agency | 60A(7)(b), (e) and (g) | Grade 3 | Entity data | 61A(7)(a), (c) and (e) | |
| Grade 2 | All | 61A(7)(a), (c) and (e) | |||
| Her Majesty's Revenue and Customs | 60A(7)(b) | Higher officer | Entity data | 61A(7)(a) | |
| Senior officer | All | 61A(7)(a) | |||
| Department for Transport | 60A(7)(b), (d) and (e) | Enforcement Officer in Maritime and Coastguard Agency | Entity data | 61A(7)(a) and (b) | |
| Head of Enforcement in Maritime and Coastguard Agency | All | 61A(7)(a) and (b) | |||
| Maritime Operations Commander (Grade 7) in the Maritime and Coastguard Agency | All | 61A(7)(c) | |||
| Principal Inspector in the Air Accident Investigation Branch, the Marine Accident Investigation Branch or the Rail Accident Investigation Branch | All | 61A(7)(b) | |||
| Department for Work and Pensions | 60A(7)(b) | Senior Executive Officer in Fraud and Error Services | All | 61A(7)(a) | |
| Senior Executive Officer in the Child Maintenance Group Central Legal Services | All | 61A(7)(a) | |||
| An ambulance trust in England | 60A(7)(e) | Duty Manager of Ambulance Trust Control Rooms | All | 61A(7)(c) | |
| Common Services Agency for the Scottish Health Service | 60A(7)(b) | Head of Counter Fraud Services | All | 61A(7)(a) | |
| Competition and Markets Authority | 60A(7)(b) | Member of the Senior Civil Service with responsibility for cartels or criminal enforcement | All | 61A(7)(a) | |
| Criminal Cases Review Commission | 60A(7)(f) | Investigations Adviser | All | 61A(7)(d) | |
| Department for Communities in Northern Ireland | 60A(7)(b) | Deputy Principal | All | 61A(7)(a) | |
| Department for the Economy in Northern Ireland | 60A(7)(b) | Deputy chief inspector in trading standards services | All | 61A(7)(a) | |
| Department of Justice in Northern Ireland | 60A(7)(b), (d) and (g) | Governor 4 in the Northern Ireland Prison Service | All | 61A(7)(a), (b) and (e) | |
| Financial Conduct Authority | 60A(7)(b) | Head of department in the Enforcement and Market Oversight Division | All | 61A(7)(a) | |
| A fire and rescue authority under the Fire and Rescue Services Act 2004 | 60A(7)(e) | Watch Manager (Control) | All | 61A(7)(c) | |
| Food Standards Agency | 60A(7)(b) | Grade 6 | All | 61A(7)(a) | |
| Food Standards Scotland | 60A(7)(b) | Head of the Scottish Food Crime and Incidents Unit | All | 61A(7)(a) | |
| Gambling Commission | 60A(7)(b) | Senior manager | All | 61A(7)(a) | |
| Gangmasters and Labour Abuse Authority | 60A(7)(b) | Head of operations | All | 61A(7)(a) | |
| Health and Safety Executive | 60A(7)(b) and (d) | Band 1 inspector | All | 61A(7)(a) and (b) | |
| Independent Office for Police Conduct | 60A(7)(b) and (g) | Director or an equivalent grade | All | 61A(7)(a) and (e) | |
| Information Commissioner | 60A(7)(b) | Group manager | Entity data | 61A(7)(a) | |
| Head of enforcement or an equivalent grade | All | 61A(7)(a) | |||
| National Health Service Business Services Authority | 60A(7)(b) | Senior manager (of pay band 8b) in the Counter Fraud and Security Management Services Division | All | 61A(7)(a) | |
| Northern Ireland Ambulance Service Health and Social Care Trust | 60A(7)(e) | Watch Manager (Control) | All | 61A(7)(c) | |
| Northern Ireland Fire and Rescue Service Board | 60A(7)(e) | Watch Manager (Control) | All | 61A(7)(c) | |
| Northern Ireland Health and Social Care Regional Business Services Organisation | 60A(7)(b) | Assistant Director Counter Fraud and Probity Services | All | 61A(7)(a) | |
| Office of Communications | 60A(7)(b) | Senior associate | All | 61A(7)(a) | |
| Office of the Police Ombudsman for Northern Ireland | 60A(7)(b) | Senior investigating officer | All | 61A(7)(a) | |
| Police Investigations and Review Commissioner | 60A(7)(b) and (g) | Commissioner or Director of Operations | All | 61A(7)(a) and (e) | |
| Scottish Ambulance Service Board | 60A(7)(e) | Watch Manager (Control) | All | 61A(7)(c) | |
| Scottish Criminal Cases Review Commission | 60A(7)(f) | Investigations Adviser | All | 61A(7)(d) | |
| Serious Fraud Office | 60A(7)(b) | Grade 6 | All | 61A(7)(a) | |
| Welsh Ambulance Services National Health Service Trust | 60A(7)(e) | Watch Manager (Control) | All | 61A(7)(c)”. |
27. In Schedule 9 (transitional, transitory and saving provision), in paragraph 6(1)—U.K.
(a)for paragraph (a) substitute—
“(a)“serious crime” in section 86(2A),”;
(b)omit the “and” following paragraph (a);
(c)after paragraph (a) insert—
“(aa)“serious crime” in section 87(10B), and”.
Commencement Information
I3Sch. 1 para. 27(b)(c) in force at 1.11.2018 and Sch. 1 para. 27 in force at 5.2.2019 othwerwise, see reg. 1(3)(f)(4)(d)
28. In Schedule 10 (minor and consequential provision), omit paragraphs 57 and 58 (which are superseded by the amendments made by Schedule 2).U.K.
Regulation 11
1.—(1) The Regulation of Investigatory Powers Act 2000 M5 is amended as follows.U.K.
(2) In section 77A (procedure for order of sheriff: Scotland)—
(a)in the heading, omit “23A or”;
(b)in subsection (1), omit “23A or”;
(c)in subsection (3), for “sections 23B and 32B” substitute “ section 32B ”.
(3) In section 77B (procedure for order of district judge: Northern Ireland)—
(a)in the heading, omit “23A or”;
(b)in subsection (1), omit “23A or”;
(c)in subsection (4)—
(i)omit “23A or”;
(ii)for “sections 23B and 32B” substitute “ section 32B ”.
Marginal Citations
M5Sections 77A and 77B were inserted by the Protection of Freedoms Act 2012, Schedule 9, Part 3, paragraphs 6 and 15.
2.—(1) The Regulation of Investigatory Powers (Communications Data) Order 2010 M6 is amended as follows.U.K.
(2) In article 2, omit paragraph (c).
(3) In Schedule 1, in column 4 of the table, omit “, (e)” in the entries relating to the following—
(a)a police force maintained under section 2 of the Police Act 1996;
(b)the metropolitan police force;
(c)the City of London police force;
(d)the Police Service of Scotland;
(e)the Police Service of Northern Ireland;
(f)the British Transport Police.
(4) In that Schedule, in column 4 of the table, in the entry relating to the Commissioners for Her Majesty's Revenue and Customs, omit “and (f)”.
(5) In Schedule 2, in column 4 of the table in Part 1—
(a)in the entry relating to the Financial Conduct Authority, omit “Article 2(c)”;
(b)in the entry relating to the Prudential Regulation Authority, omit “Article 2(c)”.
(6) In that Schedule, in column 4 of the table in Part 2—
(a)in the entry relating to the Department of Health and Social Care, for “, (d) and (e)” substitute “ and (d) ”;
(b)in the entry relating to the Health and Safety Executive, for “, (d) and (e)” substitute “ and (d) ”.
Marginal Citations
M6S.I. 2010/480; relevant amending instruments are S.I. 2013/472, 2013/602, 2015/228 and 2018/378.
(This note is not part of the Regulations)
These Regulations amend Parts 3 and 4 of the Investigatory Powers Act 2016 (c. 25) (“the Act”), which provide for the retention of communications data by telecommunications and postal operators, and the acquisition of that communications data by public authorities, and bring into force a code of practice in relation to those provisions.
Regulation 2 brings into force a code of practice entitled “Communications Data”, about the exercise of functions conferred by Parts 3 and 4 of the Act. The code of practice comes into force on the day after the day on which these Regulations are made.
The code of practice will be published by the Stationery Office and copies may be obtained from the Stationery Office bookshops or online shop. The code of practice will also be available on the Investigatory Powers Act 2016 codes of practice pages on the gov.uk website.
The amendments to Parts 3 and 4 of the Act are made in response to the judgment of the Court of Justice of the European Union (CJEU) in joined cases C‑203/15 and C‑698/15, setting out safeguards required in order that a communications data retention regime is compliant with EU law.
Part 3 of the Act is not yet in force and the Regulations also amend Chapter 2 of Part 1 of the Regulation of Investigatory Powers Act 2000 (c. 25) (“RIPA”), which currently provides for the acquisition of communications data by public authorities and will be replaced by Part 3 of the Act.
Regulation 3 amends section 22 of RIPA so that access to certain communications data (traffic or location data) may be authorised only for the purpose of the prevention or detection of serious crime. A request for subscriber data may be authorised for the purpose of the prevention or detection of crime or of preventing disorder, as is currently the case for all communications data under RIPA. Three of the statutory purposes for which access to communications data may currently be authorised are also removed by this regulation and by paragraph 2(2) of Schedule 2 to these Regulations.
Regulation 5 amends Part 3 of the Act to provide for independent authorisation of requests by public authorities to access communications data, conferring on the Investigatory Powers Commissioner a new power to authorise communications data requests. The Commissioner, acting through a body of his staff to be known as the Office for Communications Data Authorisations, will be responsible for considering the vast majority of requests to access communications data made by public authorities. A request may be authorised where it is necessary for one or more of the statutory purposes, and proportionate. In relation to the crime purpose, the effect of the amendments is that access to events data may be authorised for the purpose of the prevention or detection of serious crime, but a request solely for entity data may be made for the purpose of the prevention or detection of crime or of preventing disorder.
Regulation 6 amends the power in Part 3 of the Act to authorise requests to access communications data internally within a public authority. The effect of the amendments is that the power will only be exercisable to access communications data in the interests of national security, or of the economic well-being of the UK so far as relevant to national security, or for the purpose of the prevention or detection of serious crime. Where a request is solely for entity data a request may be made for the purpose of the prevention or detection of crime or of preventing disorder.
Regulation 7 amends the Act to permit internal authorisation by a designated senior officer in a public authority (except a local authority) in a case where there is an urgent need to obtain communications data.
Regulation 8 amends Part 4 of the Act to restrict the purposes for which the Secretary State may give a notice to a telecommunications or postal operator requiring the retention of communications data. A notice may be given where it is necessary and proportionate to retain data in the interests of national security or of the economic well-being of the UK so far as relevant to national security, in the interests of public safety, for the purpose of preventing death or injury or to assist investigations into alleged miscarriages of justice. A notice may be given for the purpose of the prevention or detection of serious crime so far as it relates to events data, or for the purpose of the prevention or detection of crime or of preventing disorder so far as it relates to entity data.
Regulation 9 amends the Act to include additional matters which the Secretary of State must take into account before giving a retention notice.
Regulation 10 introduces Schedule 1 to the Regulations which makes further amendments of the Act, in the main consequential on the amendments in regulations 2 to 7. Paragraph 15 removes the requirement for local authority applications to be subject to judicial approval by a magistrate, in light of the new independent authorisation arrangements. Paragraph 21 inserts a definition of serious crime for the purposes of Part 3 of the Act. Paragraph 26 substitutes the Table contained in Part 1 of Schedule 4 to the Act, which sets out which public authorities may acquire communications data, the purposes for which each public authority may do so, the types of data they may obtain and the level of internal authorisation required within that organisation.
Regulation 11 introduces Schedule 2 to the Regulations, which makes consequential amendments of RIPA and the Regulation of Investigatory Powers (Communications Data) Order 2010 (S.I. 2010/480).
An impact assessment of the effect that this instrument will have on the costs of business, the voluntary sector and the public sector is available alongside this instrument at www.legislation.gov.uk.