Investigatory Powers Bill (HC Bill 143)

Investigatory Powers BillPage 60

(a) any requirements or restrictions under the law of that country or
territory that are relevant to the taking of those steps, and

(b) the extent to which it is reasonably practicable to comply with the duty
in a way that does not breach any of those requirements or restrictions.

(5) 5Nothing in the definition of “telecommunications operator” limits the type of
communications data in relation to which an authorisation, or a request or
requirement of a kind which gives rise to a duty under section 57(1) or (2), may
apply.

77 Part 3: interpretation

(1) 10In this Part—

  • “authorisation” means an authorisation under section 53 (including that
    section as modified by sections 69 and 71),

  • “designated senior officer”—

    (a)

    in relation to a relevant public authority which is a local
    15authority, has the meaning given by section 64(2), and

    (b)

    in relation to any other relevant public authority, has the
    meaning given by section 61(3),

  • “filtering arrangements” means any arrangements under section 58(1),

  • “officer”, in relation to a relevant public authority, means a person
    20holding an office, rank or position with that authority,

  • “relevant public authority” means a public authority which is a relevant
    public authority for the purposes of this Part by virtue of section 61(2)
    or 64(1).

(2) In this Part “local authority” means—

(a) 25a district or county council in England,

(b) a London borough council,

(c) the Common Council of the City of London in its capacity as a local
authority,

(d) the Council of the Isles of Scilly,

(e) 30a county council or county borough council in Wales,

(f) a council constituted under section 2 of the Local Government etc.
(Scotland) Act 1994, and

(g) a district council in Northern Ireland.

(3) See also—

  • 35section 223 (telecommunications definitions),

  • section 224 (postal definitions),

  • section 225 (general definitions),

  • section 226 (index of defined expressions).

Investigatory Powers BillPage 61

Part 4 Retention of communications data

General

78 Powers to require retention of certain data

(1) 5The Secretary of State may by notice (a “retention notice”) require a
telecommunications operator to retain relevant communications data if the
Secretary of State considers that the requirement is necessary and
proportionate for one or more of the purposes falling within paragraphs (a) to
(j) of section 53(7) (purposes for which communications data may be obtained).

(2) 10A retention notice may—

(a) relate to a particular operator or any description of operators,

(b) require the retention of all data or any description of data,

(c) identify the period or periods for which data is to be retained,

(d) contain other requirements, or restrictions, in relation to the retention
15of data,

(e) make different provision for different purposes,

(f) relate to data whether or not in existence at the time of the giving, or
coming into force, of the notice.

(3) A retention notice must not require any data to be retained for more than 12
20months beginning with—

(a) in the case of communications data relating to a specific
communication, the day of the communication concerned,

(b) in the case of entity data which does not fall within paragraph (a) above
but does fall within paragraph (a)(i) of the definition of
25“communications data” in section 223(5), the day on which the entity
concerned ceases to be associated with the telecommunications service
concerned or (if earlier) the day on which the data is changed, and

(c) in any other case, the day on which the data is first held by the operator
concerned.

(4) 30A retention notice which relates to data already in existence when the notice
comes into force imposes a requirement to retain the data for only so much of
a period of retention as occurs on or after the coming into force of the notice.

(5) A retention notice comes into force—

(a) when the notice is given to the operator (or description of operators)
35concerned, or

(b) (if later) at the time or times specified in the notice.

(6) A retention notice is given to an operator (or description of operators) by
giving, or publishing, it in such manner as the Secretary of State considers
appropriate for bringing it to the attention of the operator (or description of
40operators) to whom it relates.

(7) A retention notice must specify—

(a) the operator (or description of operators) to whom it relates,

(b) the data which is to be retained,

(c) the period or periods for which the data is to be retained,

Investigatory Powers BillPage 62

(d) any other requirements, or any restrictions, in relation to the retention
of the data,

(e) the information required by section 213(7) (the level or levels of
contribution in respect of costs incurred as a result of the notice).

(8) 5The requirements or restrictions mentioned in subsection (7)(d) may, in
particular, include—

(a) a requirement to retain the data in such a way that it can be transmitted
efficiently and effectively in response to requests,

(b) requirements or restrictions in relation to the obtaining (whether by
10collection, generation or otherwise), generation or processing of—

(i) data for retention, or

(ii) retained data.

(9) In this Part “relevant communications data” means communications data
which may be used to identify, or assist in identifying, any of the following—

(a) 15the sender or recipient of a communication (whether or not a person),

(b) the time or duration of a communication,

(c) the type, method or pattern, or fact, of communication,

(d) the telecommunication system (or any part of it) from, to or through
which, or by means of which, a communication is or may be
20transmitted, or

(e) the location of any such system,

and this expression therefore includes, in particular, internet connection
records.

Safeguards

79 25Matters to be taken into account before giving retention notices

(1) Before giving a retention notice, the Secretary of State must, among other
matters, take into account—

(a) the likely benefits of the notice,

(b) the likely number of users (if known) of any telecommunications
30service to which the notice relates,

(c) the technical feasibility of complying with the notice,

(d) the likely cost of complying with the notice, and

(e) any other effect of the notice on the telecommunications operator (or
description of operators) to whom it relates.

(2) 35Before giving such a notice, the Secretary of State must take reasonable steps to
consult any operator to whom it relates.

80 Review by the Secretary of State

(1) A telecommunications operator to whom a retention notice is given may,
within such period or circumstances as may be provided for by regulations
40made by the Secretary of State, refer the notice back to the Secretary of State.

(2) Such a reference may be in relation to the whole of a notice or any aspect of it.

(3) In the case of a notice given to a description of operators—

Investigatory Powers BillPage 63

(a) each operator falling within that description may make a reference
under subsection (1), but

(b) each such reference may only be in relation to the notice, or aspect of
the notice, so far as it applies to that operator.

(4) 5There is no requirement for an operator who has referred a retention notice
under subsection (1) to comply with the notice, so far as referred, until the
Secretary of State has reviewed the notice in accordance with subsection (5).

(5) The Secretary of State must review any notice so far as referred to the Secretary
of State under subsection (1).

(6) 10Before deciding the review, the Secretary of State must consult—

(a) the Technical Advisory Board, and

(b) the Investigatory Powers Commissioner.

(7) The Board must consider the technical requirements and the financial
consequences, for the operator who has made the reference, of the notice so far
15as referred.

(8) The Commissioner must consider whether the notice so far as referred is
proportionate.

(9) The Board and the Commissioner must—

(a) give the operator concerned and the Secretary of State the opportunity
20to provide evidence, or make representations, to them before reaching
their conclusions,

(b) report their conclusions to—

(i) the operator, and

(ii) the Secretary of State.

(10) 25The Secretary of State may, after considering the conclusions of the Board and
the Commissioner—

(a) vary or revoke the retention notice under section 83, or

(b) give a notice under this section to the operator concerned confirming its
effect.

(11) 30A report or notice under this section is given to an operator by giving or
publishing it in such manner as the Secretary of State considers appropriate for
bringing it to the attention of the operator.

(12) The Secretary of State must keep a retention notice under review (whether or
not referred under subsection (1)).

81 35Data integrity and security

(1) A telecommunications operator who retains relevant communications data by
virtue of this Part must—

(a) secure that the data is of the same integrity, and subject to at least the
same security and protection, as the data on any system from which it
40is derived,

(b) secure, by appropriate technical and organisational measures, that the
data can be accessed only by specially authorised personnel, and

(c) protect, by appropriate technical and organisational measures, the data
against accidental or unlawful destruction, accidental loss or alteration,
45or unauthorised or unlawful retention, processing, access or disclosure.

Investigatory Powers BillPage 64

(2) A telecommunications operator who retains relevant communications data by
virtue of this Part must destroy the data if the retention of the data ceases to be
authorised by virtue of this Part and is not otherwise authorised by law.

(3) The destruction of the data may take place at such monthly or shorter intervals
5as appear to the operator to be practicable.

82 Disclosure of retained data

A telecommunications operator must put in place adequate security systems
(including technical and organisational measures) governing access to relevant
communications data retained by virtue of this Part in order to protect against
10any unlawful disclosure.

Variation or revocation of notices

83 Variation or revocation of notices

(1) The Secretary of State may vary a retention notice.

(2) The Secretary of State must give, or publish, notice of the variation in such
15manner as the Secretary of State considers appropriate for bringing the
variation to the attention of the telecommunications operator (or description of
operators) to whom it relates.

(3) A variation comes into force—

(a) when notice of it is given or published in accordance with subsection
20(2), or

(b) (if later) at the time or times specified in the notice of variation.

(4) A retention notice may not be varied so as to require the retention of additional
relevant communications data unless the Secretary of State considers that the
requirement is necessary and proportionate for one or more of the purposes
25falling within paragraphs (a) to (j) of section 53(7) (purposes for which
communications data may be obtained).

(5) Section 78(2) and (4) apply in relation to a retention notice as varied as they
apply in relation to a retention notice, but as if the references to the notice
coming into force included references to the variation coming into force.

(6) 30Sections 78(3) and (7), 84 and 86, and subsections (1), (4), (9) and (12) of this
section, apply in relation to a retention notice as varied as they apply in relation
to a retention notice.

(7) Section 79 applies in relation to the making of a variation as it applies in
relation to the giving of a retention notice.

(8) 35Section 80 applies (but only so far as the variation is concerned) in relation to a
retention notice as varied (other than one varied as mentioned in subsection
(10)(a) of that section) as it applies in relation to a retention notice.

(9) The Secretary of State may revoke (whether wholly or in part) a retention
notice.

(10) 40The Secretary of State must give or publish notice of the revocation in such
manner as the Secretary of State considers appropriate for bringing the

Investigatory Powers BillPage 65

revocation to the attention of the operator (or description of operators) to
whom it relates.

(11) A revocation comes into force—

(a) when notice of it is given or published in accordance with subsection
5(10), or

(b) (if later) at the time or times specified in the notice of revocation.

(12) The fact that a retention notice has been revoked in relation to a particular
description of communications data and a particular operator (or description
of operators) does not prevent the giving of another retention notice in relation
10to the same description of data and the same operator (or description of
operators).

Enforcement

84 Enforcement of notices and certain other requirements and restrictions

(1) It is the duty of a telecommunications operator on whom a requirement or
15restriction is imposed by—

(a) a retention notice, or

(b) section 81 or 82,

to comply with the requirement or restriction.

(2) A telecommunications operator, or any person employed or engaged for the
20purposes of the business of a telecommunications operator, must not disclose
the existence or contents of a retention notice to any other person.

(3) The Information Commissioner, or any member of staff of the Information
Commissioner, must not disclose the existence or contents of a retention notice
to any other person.

(4) 25Subsections (2) and (3) do not apply to a disclosure made with the permission
of the Secretary of State.

(5) The duty under subsection (1) or (2) is enforceable by civil proceedings by the
Secretary of State for an injunction, or for specific performance of a statutory
duty under section 45 of the Court of Session Act 1988, or for any other
30appropriate relief.

Further and supplementary provision

85 Application of Part 4 to postal operators and postal services

(1) This Part applies to postal operators and postal services as it applies to
telecommunications operators and telecommunications services.

(2) 35In its application by virtue of subsection (1), this Part has effect as if—

(a) any reference to a telecommunications operator were a reference to a
postal operator,

(b) any reference to a telecommunications service were a reference to a
postal service,

(c) 40any reference to a telecommunication system were a reference to a
postal service,

Investigatory Powers BillPage 66

(d) in section 78(3), for paragraph (b) there were substituted—

(b) in the case of communications data which does not fall
within paragraph (a) above but does fall within
paragraph (c) of the definition of “communications
5data” in section 224(3), the day on which the person
concerned leaves the postal service concerned or (if
earlier) the day on which the data is changed,”, and

(e) in section 78(9), the words from “and this expression” to the end were
omitted.

86 10Extra-territorial application of Part 4

(1) A retention notice, and any requirement or restriction imposed by virtue of a
retention notice or by section 81, 82 or 84(1) to (3), may relate to conduct outside
the United Kingdom and persons outside the United Kingdom.

(2) But section 84(5), so far as relating to those requirements or restrictions, does
15not apply to a person outside the United Kingdom.

87 Part 4: interpretation

(1) In this Part—

  • “notice” means notice in writing,

  • “relevant communications data” has the meaning given by section 78(9),

  • 20“retention notice” has the meaning given by section 78(1).

(2) See also—

  • section 223 (telecommunications definitions),

  • section 224 (postal definitions),

  • section 225 (general definitions),

  • 25section 226 (index of defined expressions).

Part 5 Equipment interference

Warrants under this Part

88 Warrants under this Part: general

(1) 30There are two kinds of warrants which may be issued under this Part—

(a) targeted equipment interference warrants (see subsection (2));

(b) targeted examination warrants (see subsection (9)).

(2)
A targeted equipment interference warrant is a warrant which authorises or
requires the person to whom it is addressed to secure interference with any
35equipment for the purpose of obtaining—

(a) communications (see section 118);

(b) equipment data (see section 89);

(c) any other information.

(3) A targeted equipment interference warrant—

Investigatory Powers BillPage 67

(a) must also authorise or require the person to whom it is addressed to
secure the obtaining of the communications, equipment data or other
information to which the warrant relates;

(b) may also authorise that person to secure the disclosure, in any manner
5described in the warrant, of anything obtained under the warrant by
virtue of paragraph (a).

(4) The reference in subsections (2) and (3) to the obtaining of communications or
other information includes doing so by—

(a) monitoring, observing or listening to a person’s communications or
10other activities;

(b) recording anything which is monitored, observed or listened to.

(5) A targeted equipment interference warrant also authorises the following
conduct (in addition to the conduct described in the warrant)—

(a) any conduct which it is necessary to undertake in order to do what is
15expressly authorised or required by the warrant, including conduct for
securing the obtaining of communications, equipment data or other
information;

(b) any conduct by any person which is conduct in pursuance of a
requirement imposed by or on behalf of the person to whom the
20warrant is addressed to be provided with assistance in giving effect to
the warrant.

(6) A targeted equipment interference warrant may not, by virtue of subsection
(3), authorise or require a person to engage in conduct, in relation to a
communication other than a stored communication, which would (unless done
25with lawful authority) constitute an offence under section 2(1) (unlawful
interception).

(7) Subsection (5)(a) does not authorise a person to engage in conduct which could
not be expressly authorised under the warrant because of the restriction
imposed by subsection (6).

(8) 30In subsection (6), “stored communication” means a communication stored in or
by a telecommunication system (whether before or after its transmission).

(9) A targeted examination warrant is a warrant which authorises the person to
whom it is addressed to carry out the selection of protected material obtained
under a bulk equipment interference warrant for examination, in breach of the
35prohibition in section 170(4) (prohibition on seeking to identify
communications of, or private information relating to, individuals in the
British Islands).

In this Part, “protected material”, in relation to a targeted examination warrant,
means any material obtained under a bulk equipment interference warrant
40under Chapter 3 of Part 6, other than material which is—

  • equipment data;

  • information (other than a communication or equipment data) which is
    not private information.

(10) For provision enabling the combination of targeted equipment interference
45warrants with certain other warrants or authorisations (including targeted
examination warrants), see Schedule 8.

(11) Any conduct which is carried out in accordance with a warrant under this Part
is lawful for all purposes.

Investigatory Powers BillPage 68

89 Meaning of “equipment data”

(1) In this Part, “equipment data” means—

(a) systems data;

(b) data which falls within subsection (2).

(2) 5The data falling within this subsection is identifying data which—

(a) is, for the purposes of a relevant system, comprised in, included as part
of, attached to or logically associated with a communication (whether
by the sender or otherwise) or any other item of information,

(b) is capable of being logically separated from the remainder of the
10communication or the item of information, and

(c) if it were so separated, would not reveal anything of what might
reasonably be considered to be the meaning (if any) of the
communication or the item of information, disregarding any meaning
arising from the fact of the communication or the existence of the item
15of information or from any data relating to that fact.

(3) In subsection (2), “relevant system” means any system on or by means of which
the data is held.

(4) For the meaning of “systems data” and “identifying data”, see section 225.

90 Subject-matter of warrants

(1) 20A targeted equipment interference warrant may relate to any one or more of
the following matters—

(a) equipment belonging to, used by or in the possession of a particular
person or organisation;

(b) equipment belonging to, used by or in the possession of a group of
25persons who share a common purpose or who carry on, or may carry
on, a particular activity;

(c) equipment belonging to, used by or in the possession of more than one
person or organisation, where the interference is for the purpose of a
single investigation or operation;

(d) 30equipment in a particular location;

(e) equipment in more than one location, where the interference is for the
purpose of the same investigation or operation;

(f) equipment which is being, or may be used, for the purposes of a
particular activity or activities of a particular description;

(g) 35equipment which is being, or may be used, to test, maintain or develop
capabilities relating to interference with equipment for the purpose of
obtaining communications, equipment data or other information;

(h) equipment which is being, or may be used, for the training of persons
who carry out, or are likely to carry out, such interference with
40equipment.

(2) A targeted examination warrant may relate to any one or more of the following
matters—

(a) a particular person or organisation;

(b) a group of persons who share a common purpose or who carry on, or
45may carry on, a particular activity;

(c) more than one person or organisation, where the conduct authorised by
the warrant is for the purpose of a single investigation or operation;

Investigatory Powers BillPage 69

(d) the testing, maintenance or development of capabilities relating to the
selection of protected material for examination;

(e) the training of persons who carry out, or are likely to carry out, the
selection of such material for examination.

5Power to issue warrants

91 Power to issue warrants to intelligence services: the Secretary of State

(1) The Secretary of State may, on an application made by or on behalf of the head
of an intelligence service, issue a targeted equipment interference warrant if—

(a) the Secretary of State considers that the warrant is necessary on
10grounds falling within subsection (5),

(b) the Secretary of State considers that the conduct authorised by the
warrant is proportionate to what is sought to be achieved by which
conduct,

(c) the Secretary of State considers that satisfactory arrangements made for
15the purposes of sections 112 and 113 (safeguards relating to disclosure
etc.) are in force in relation to the warrant, and

(d) except where the Secretary of State considers that there is an urgent
need to issue the warrant, the decision to issue the warrant has been
approved by a Judicial Commissioner.

(2) 20But the Secretary of State may not issue a targeted equipment interference
warrant under subsection (1) if—

(a) the Secretary of State considers that the only ground for considering the
warrant to be necessary is for the purpose of preventing or detecting
serious crime, and

(b) 25the warrant, if issued, would authorise interference only with
equipment which would be in Scotland at the time of the issue of the
warrant or which the Secretary of State believes would be in Scotland
at that time.

For the power of the Scottish Ministers to issue a targeted equipment
30interference warrant, see section 92.

(3) The Secretary of State may, on an application made by or on behalf of the head
of an intelligence service, issue a targeted examination warrant if—

(a) the Secretary of State considers that the warrant is necessary on
grounds falling within subsection (5),

(b) 35the Secretary of State considers that the conduct authorised by the
warrant is proportionate to what is sought to be achieved by that
conduct,

(c) the Secretary of State considers that the warrant is or may be necessary
to authorise the selection of protected material for examination in
40breach of the prohibition in section 170(4) (prohibition on seeking to
identify communications of, or private information relating to,
individuals in the British Islands), and

(d) except where the Secretary of State considers that there is an urgent
need to issue the warrant, the decision to issue the warrant has been
45approved by a Judicial Commissioner.

(4) But the Secretary of State may not issue a targeted examination warrant under
subsection (3) if the warrant, if issued, would relate only to a person who