Investigatory Powers Act 2016

Filtering arrangements for obtaining data U.K.

67 Filtering arrangements for obtaining data U.K.

(1) The Secretary of State may establish, maintain and operate arrangements for the purposes of—

(a) assisting [F1 a person, who is] considering whether to grant an authorisation, to determine whether the requirements of this Part in relation to granting the authorisation are satisfied, or

(b) facilitating the lawful, efficient and effective obtaining of communications data from any person by relevant public authorities in pursuance of an authorisation.

(2) Arrangements under subsection (1) (“filtering arrangements”) may, in particular, involve the obtaining of communications data in pursuance of an authorisation (“the target data”) by means of—

(a) a request to the Secretary of State to obtain the target data on behalf of an authorised officer, and

(b) the Secretary of State—

(i) obtaining the target data or data from which the target data may be derived,

(ii) processing the target data or the data from which it may be derived (and retaining data temporarily for that purpose), and

(iii) disclosing the target data to the person identified for this purpose by, or in accordance with, the authorisation.

(3) Filtering arrangements may, in particular, involve the generation or use by the Secretary of State of information—

(a) for the purpose mentioned in subsection (1)(a), or

(b) for the purposes of—

(i) the support, maintenance, oversight, operation or administration of the arrangements, or

(ii) the functions of the Investigatory Powers Commissioner mentioned in subsection (4) or (5).

(4) Filtering arrangements must involve the generation and retention of such information or documents as the Investigatory Powers Commissioner considers appropriate for the purposes of the functions of the Commissioner under section 229(1) of keeping under review the exercise by public authorities of functions under this Part.

(5) The Secretary of State must consult the Investigatory Powers Commissioner about the principles on the basis of which the Secretary of State intends to establish, maintain or operate any arrangements for the purpose mentioned in subsection (1)(a).

Textual Amendments

F1 Words in s. 67(1)(a) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 7 (see S.I. 2019/174, reg. 2(c))

Commencement Information

I1 S. 67 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

68 Use of filtering arrangements in pursuance of an authorisation U.K.

(1) This section applies in relation to the use of the filtering arrangements in pursuance of an authorisation.

(2) The filtering arrangements may be used—

(a) to obtain and disclose communications data in pursuance of an authorisation, only if the authorisation specifically authorises the use of the arrangements to obtain and disclose the data,

(b) to process data in pursuance of an authorisation (and to retain the data temporarily for that purpose), only if the authorisation specifically authorises processing data of that description under the arrangements (and their temporary retention for that purpose).

(3) An authorisation must record [F2 the decision of the person granting the authorisation] as to—

(a) whether the communications data to be obtained and disclosed in pursuance of the authorisation may be obtained and disclosed by use of the filtering arrangements,

(b) whether the processing of data under the filtering arrangements (and its temporary retention for that purpose) is authorised,

(c) if the processing of data under the filtering arrangements is authorised, the description of data that may be processed.

(4) [F3 A person] must not grant an authorisation which authorises—

(a) use of the filtering arrangements, or

(b) processing under the filtering arrangements,

unless the condition in subsection (5) is met.

(5) The condition is that [F4 the person] (as well as considering that the other requirements of this Part in relation to granting the authorisation are satisfied) considers that what is authorised in relation to the filtering arrangements is proportionate to what is sought to be achieved.

Textual Amendments

F2 Words in s. 68(3) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 8(2) (see S.I. 2019/174, reg. 2(c))

F3 Words in s. 68(4) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 8(3) (see S.I. 2019/174, reg. 2(c))

F4 Words in s. 68(5) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 8(4) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I2 S. 68 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

69 Duties in connection with operation of filtering arrangements U.K.

(1) The Secretary of State must secure—

(a) that no authorisation data is obtained or processed under the filtering arrangements except for the purposes of an authorisation,

(b) that data which—

(i) has been obtained or processed under the filtering arrangements, and

(ii) is to be disclosed in pursuance of an authorisation or for the purpose mentioned in section 67(1)(a),

is disclosed only to the person to whom the data is to be disclosed in pursuance of the authorisation or (as the case may be) [F5 to the person considering whether to grant the authorisation],

(c) that any authorisation data which is obtained under the filtering arrangements in pursuance of an authorisation is immediately destroyed—

(i) when the purposes of the authorisation have been met, or

(ii) if at any time it ceases to be necessary to retain the data for the purposes or purpose concerned.

(2) The Secretary of State must secure that data (other than authorisation data) which is retained under the filtering arrangements is disclosed only—

(a) for the purpose mentioned in section 67(1)(a),

(b) for the purposes of support, maintenance, oversight, operation or administration of the arrangements,

(c) to the Investigatory Powers Commissioner for the purposes of the functions of the Commissioner mentioned in section 67(4) or (5), or

(d) otherwise as authorised by law.

(3) The Secretary of State must secure that—

(a) only the Secretary of State and designated individuals are permitted to read, obtain or otherwise process data for the purposes of support, maintenance, oversight, operation or administration of the filtering arrangements, and

(b) no other persons are permitted to access or use the filtering arrangements except in pursuance of an authorisation or for the purpose mentioned in section 67(1)(a).

(4) In subsection (3)(a) “designated” means designated by the Secretary of State; and the Secretary of State may designate an individual only if the Secretary of State thinks that it is necessary for the individual to be able to act as mentioned in subsection (3)(a).

(5) The Secretary of State must—

(a) put in place and maintain an adequate security system to govern access to, and use of, the filtering arrangements and to protect against any abuse of the power of access, and

(b) impose measures to protect against unauthorised or unlawful data retention, processing, access or disclosure.

(6) The Secretary of State must—

(a) put in place and maintain procedures (including the regular testing of relevant software and hardware) to ensure that the filtering arrangements are functioning properly, and

(b) report, as soon as possible after the end of each calendar year, to the Investigatory Powers Commissioner about the functioning of the filtering arrangements during that year.

(7) A report under subsection (6)(b) must, in particular, contain information about the destruction of authorisation data during the calendar year concerned.

(8) If the Secretary of State believes that significant processing errors have occurred giving rise to a contravention of any of the requirements of this Part which relate to the filtering arrangements, the Secretary of State must report that fact immediately to the Investigatory Powers Commissioner.

(9) In this section “authorisation data”, in relation to an authorisation, means communications data that is, or is to be, obtained in pursuance of the authorisation or any data from which that data is, or may be, derived.

Textual Amendments

F5 Words in s. 69(1)(b) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 9 (see S.I. 2019/174, reg. 2(c))

Commencement Information

I3 S. 69 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)