Investigatory Powers Bill (HC Bill 172)

documents of the same description as a notice, by delivering it to that
address,

(c) by notifying the person by such other means as the authorised officer
considers appropriate (which may include notifying the person orally).

(4) 5In determining for the purposes of subsection (3) of section 57 whether it is
reasonably practicable for a telecommunications operator outside the United
Kingdom to take any steps in a country or territory outside the United
Kingdom for the purpose of complying with a duty imposed by virtue of
subsection (1) or (2) of that section, the matters to be taken into account include
10the following—

(a) any requirements or restrictions under the law of that country or
territory that are relevant to the taking of those steps, and

(b) the extent to which it is reasonably practicable to comply with the duty
in a way that does not breach any of those requirements or restrictions.

(5) 15Nothing in the definition of “telecommunications operator” limits the type of
communications data in relation to which an authorisation, or a request or
requirement of a kind which gives rise to a duty under section 57(1) or (2), may
apply.

77 Part 3: interpretation

(1) 20In this Part—

• “authorisation” means an authorisation under section 53 (including that
  section as modified by sections 69 and 71),

• “designated senior officer”—

  (a)

  in relation to a relevant public authority which is a local
  25authority, has the meaning given by section 64(2), and

  (b)

  in relation to any other relevant public authority, has the
  meaning given by section 61(3),

• “filtering arrangements” means any arrangements under section 58(1),

• “officer”, in relation to a relevant public authority, means a person
  30holding an office, rank or position with that authority,

• “relevant public authority” means a public authority which is a relevant
  public authority for the purposes of this Part by virtue of section 61(2)
  or 64(1).

(2) In this Part “local authority” means—

(a) 35a district or county council in England,

(b) a London borough council,

(c) the Common Council of the City of London in its capacity as a local
authority,

(d) the Council of the Isles of Scilly,

(e) 40a county council or county borough council in Wales,

(f) a council constituted under section 2 of the Local Government etc.
(Scotland) Act 1994, and

(g) a district council in Northern Ireland.

(3) See also—

• 45section 223 (telecommunications definitions),

• section 224 (postal definitions),

• section 225 (general definitions),

Investigatory Powers BillPage 61

• section 226 (index of defined expressions).

Part 4 Retention of communications data

General

78 5Powers to require retention of certain data

(1) The Secretary of State may by notice (a “retention notice”) require a
telecommunications operator to retain relevant communications data if the
Secretary of State considers that the requirement is necessary and
proportionate for one or more of the purposes falling within paragraphs (a) to
10(j) of section 53(7) (purposes for which communications data may be obtained).

(2) A retention notice may—

(a) relate to a particular operator or any description of operators,

(b) require the retention of all data or any description of data,

(c) identify the period or periods for which data is to be retained,

(d) 15contain other requirements, or restrictions, in relation to the retention
of data,

(e) make different provision for different purposes,

(f) relate to data whether or not in existence at the time of the giving, or
coming into force, of the notice.

(3) 20A retention notice must not require any data to be retained for more than 12
months beginning with—

(a) in the case of communications data relating to a specific
communication, the day of the communication concerned,

(b) in the case of entity data which does not fall within paragraph (a) above
25but does fall within paragraph (a)(i) of the definition of
“communications data” in section 223(5), the day on which the entity
concerned ceases to be associated with the telecommunications service
concerned or (if earlier) the day on which the data is changed, and

(c) in any other case, the day on which the data is first held by the operator
30concerned.

(4) A retention notice which relates to data already in existence when the notice
comes into force imposes a requirement to retain the data for only so much of
a period of retention as occurs on or after the coming into force of the notice.

(5) A retention notice comes into force—

(a) 35when the notice is given to the operator (or description of operators)
concerned, or

(b) (if later) at the time or times specified in the notice.

(6) A retention notice is given to an operator (or description of operators) by
giving, or publishing, it in such manner as the Secretary of State considers
40appropriate for bringing it to the attention of the operator (or description of
operators) to whom it relates.

(7) A retention notice must specify—

(a) the operator (or description of operators) to whom it relates,

(b) the data which is to be retained,

(c) the period or periods for which the data is to be retained,

(d) any other requirements, or any restrictions, in relation to the retention
of the data,

(e) 5the information required by section 213(7) (the level or levels of
contribution in respect of costs incurred as a result of the notice).

(8) The requirements or restrictions mentioned in subsection (7)(d) may, in
particular, include—

(a) a requirement to retain the data in such a way that it can be transmitted
10efficiently and effectively in response to requests,

(b) requirements or restrictions in relation to the obtaining (whether by
collection, generation or otherwise), generation or processing of—

(i) data for retention, or

(ii) retained data.

(9) 15In this Part “relevant communications data” means communications data
which may be used to identify, or assist in identifying, any of the following—

(a) the sender or recipient of a communication (whether or not a person),

(b) the time or duration of a communication,

(c) the type, method or pattern, or fact, of communication,

(d) 20the telecommunication system (or any part of it) from, to or through
which, or by means of which, a communication is or may be
transmitted, or

(e) the location of any such system,

and this expression therefore includes, in particular, internet connection
25records.

Safeguards

79 Matters to be taken into account before giving retention notices

(1) Before giving a retention notice, the Secretary of State must, among other
matters, take into account—

(a) 30the likely benefits of the notice,

(b) the likely number of users (if known) of any telecommunications
service to which the notice relates,

(c) the technical feasibility of complying with the notice,

(d) the likely cost of complying with the notice, and

(e) 35any other effect of the notice on the telecommunications operator (or
description of operators) to whom it relates.

(2) Before giving such a notice, the Secretary of State must take reasonable steps to
consult any operator to whom it relates.

80 Review by the Secretary of State

(1) 40A telecommunications operator to whom a retention notice is given may,
within such period or circumstances as may be provided for by regulations
made by the Secretary of State, refer the notice back to the Secretary of State.

(2) Such a reference may be in relation to the whole of a notice or any aspect of it.

(3) In the case of a notice given to a description of operators—

(a) each operator falling within that description may make a reference
under subsection (1), but

(b) each such reference may only be in relation to the notice, or aspect of
5the notice, so far as it applies to that operator.

(4) There is no requirement for an operator who has referred a retention notice
under subsection (1) to comply with the notice, so far as referred, until the
Secretary of State has reviewed the notice in accordance with subsection (5).

(5) The Secretary of State must review any notice so far as referred to the Secretary
10of State under subsection (1).

(6) Before deciding the review, the Secretary of State must consult—

(a) the Technical Advisory Board, and

(b) the Investigatory Powers Commissioner.

(7) The Board must consider the technical requirements and the financial
15consequences, for the operator who has made the reference, of the notice so far
as referred.

(8) The Commissioner must consider whether the notice so far as referred is
proportionate.

(9) The Board and the Commissioner must—

(a) 20give the operator concerned and the Secretary of State the opportunity
to provide evidence, or make representations, to them before reaching
their conclusions, and

(b) report their conclusions to—

(i) the operator, and

(ii) 25the Secretary of State.

(10) The Secretary of State may, after considering the conclusions of the Board and
the Commissioner—

(a) vary or revoke the retention notice under section 83, or

(b) give a notice under this section to the operator concerned confirming its
30effect.

(11) A report or notice under this section is given to an operator by giving or
publishing it in such manner as the Secretary of State considers appropriate for
bringing it to the attention of the operator.

(12) The Secretary of State must keep a retention notice under review (whether or
35not referred under subsection (1)).

81 Data integrity and security

(1) A telecommunications operator who retains relevant communications data by
virtue of this Part must—

(a) secure that the data is of the same integrity, and subject to at least the
40same security and protection, as the data on any system from which it
is derived,

(b) secure, by appropriate technical and organisational measures, that the
data can be accessed only by specially authorised personnel, and

(c) protect, by appropriate technical and organisational measures, the data
against accidental or unlawful destruction, accidental loss or alteration,
or unauthorised or unlawful retention, processing, access or disclosure.

(2) A telecommunications operator who retains relevant communications data by
5virtue of this Part must destroy the data if the retention of the data ceases to be
authorised by virtue of this Part and is not otherwise authorised by law.

(3) The destruction of the data may take place at such monthly or shorter intervals
as appear to the operator to be practicable.

82 Disclosure of retained data

10A telecommunications operator must put in place adequate security systems
(including technical and organisational measures) governing access to relevant
communications data retained by virtue of this Part in order to protect against
any unlawful disclosure.

Variation or revocation of notices

83 15Variation or revocation of notices

(1) The Secretary of State may vary a retention notice.

(2) The Secretary of State must give, or publish, notice of the variation in such
manner as the Secretary of State considers appropriate for bringing the
variation to the attention of the telecommunications operator (or description of
20operators) to whom it relates.

(3) A variation comes into force—

(a) when notice of it is given or published in accordance with subsection
(2), or

(b) (if later) at the time or times specified in the notice of variation.

(4) 25A retention notice may not be varied so as to require the retention of additional
relevant communications data unless the Secretary of State considers that the
requirement is necessary and proportionate for one or more of the purposes
falling within paragraphs (a) to (j) of section 53(7) (purposes for which
communications data may be obtained).

(5) 30Section 78(2) and (4) apply in relation to a retention notice as varied as they
apply in relation to a retention notice, but as if the references to the notice
coming into force included references to the variation coming into force.

(6) Sections 78(3) and (7), 84 and 86, and subsections (1), (4), (9) and (12) of this
section, apply in relation to a retention notice as varied as they apply in relation
35to a retention notice.

(7) Section 79 applies in relation to the making of a variation as it applies in
relation to the giving of a retention notice.

(8) Section 80 applies (but only so far as the variation is concerned) in relation to a
retention notice as varied (other than one varied as mentioned in subsection
40(10)(a) of that section) as it applies in relation to a retention notice.

(9) The Secretary of State may revoke (whether wholly or in part) a retention
notice.

(10) The Secretary of State must give or publish notice of the revocation in such
manner as the Secretary of State considers appropriate for bringing the
revocation to the attention of the operator (or description of operators) to
whom it relates.

(11) 5A revocation comes into force—

(a) when notice of it is given or published in accordance with subsection
(10), or

(b) (if later) at the time or times specified in the notice of revocation.

(12) The fact that a retention notice has been revoked in relation to a particular
10description of communications data and a particular operator (or description
of operators) does not prevent the giving of another retention notice in relation
to the same description of data and the same operator (or description of
operators).

Enforcement

84 15Enforcement of notices and certain other requirements and restrictions

(1) It is the duty of a telecommunications operator on whom a requirement or
restriction is imposed by—

(a) a retention notice, or

(b) section 81 or 82,

20to comply with the requirement or restriction.

(2) A telecommunications operator, or any person employed or engaged for the
purposes of the business of a telecommunications operator, must not disclose
the existence or contents of a retention notice to any other person.

(3) The Information Commissioner, or any member of staff of the Information
25Commissioner, must not disclose the existence or contents of a retention notice
to any other person.

(4) Subsections (2) and (3) do not apply to a disclosure made with the permission
of the Secretary of State.

(5) The duty under subsection (1) or (2) is enforceable by civil proceedings by the
30Secretary of State for an injunction, or for specific performance of a statutory
duty under section 45 of the Court of Session Act 1988, or for any other
appropriate relief.

Further and supplementary provision

85 Application of Part 4 to postal operators and postal services

(1) 35This Part applies to postal operators and postal services as it applies to
telecommunications operators and telecommunications services.

(2) In its application by virtue of subsection (1), this Part has effect as if—

(a) any reference to a telecommunications operator were a reference to a
postal operator,

(b) 40any reference to a telecommunications service were a reference to a
postal service,

(c) any reference to a telecommunication system were a reference to a
postal service,

(d) in section 78(3), for paragraph (b) there were substituted—

“(b) in the case of communications data which does not fall
5within paragraph (a) above but does fall within
paragraph (c) of the definition of “communications
data” in section 224(3), the day on which the person
concerned leaves the postal service concerned or (if
earlier) the day on which the data is changed,”, and”

(e) 10in section 78(9), the words from “and this expression” to the end were
omitted.

86 Extra-territorial application of Part 4

(1) A retention notice, and any requirement or restriction imposed by virtue of a
retention notice or by section 81, 82 or 84(1) to (3), may relate to conduct outside
15the United Kingdom and persons outside the United Kingdom.

(2) But section 84(5), so far as relating to those requirements or restrictions, does
not apply to a person outside the United Kingdom.

87 Part 4: interpretation

(1) In this Part—

• 20“notice” means notice in writing,

• “relevant communications data” has the meaning given by section 78(9),

• “retention notice” has the meaning given by section 78(1).

(2) See also—

• section 223 (telecommunications definitions),

• 25section 224 (postal definitions),

• section 225 (general definitions),

• section 226 (index of defined expressions).

Part 5 Equipment interference

30Warrants under this Part

88 Warrants under this Part: general

(1) There are two kinds of warrants which may be issued under this Part—

(a) targeted equipment interference warrants (see subsection (2));

(b) targeted examination warrants (see subsection (9)).

(2)
35A targeted equipment interference warrant is a warrant which authorises or
requires the person to whom it is addressed to secure interference with any
equipment for the purpose of obtaining—

(a) communications (see section 118);

(b) equipment data (see section 89);

(c) 40any other information.

(3) A targeted equipment interference warrant—

(a) must also authorise or require the person to whom it is addressed to
secure the obtaining of the communications, equipment data or other
information to which the warrant relates;

(b) 5may also authorise that person to secure the disclosure, in any manner
described in the warrant, of anything obtained under the warrant by
virtue of paragraph (a).

(4) The reference in subsections (2) and (3) to the obtaining of communications or
other information includes doing so by—

(a) 10monitoring, observing or listening to a person’s communications or
other activities;

(b) recording anything which is monitored, observed or listened to.

(5) A targeted equipment interference warrant also authorises the following
conduct (in addition to the conduct described in the warrant)—

(a) 15any conduct which it is necessary to undertake in order to do what is
expressly authorised or required by the warrant, including conduct for
securing the obtaining of communications, equipment data or other
information;

(b) any conduct by any person which is conduct in pursuance of a
20requirement imposed by or on behalf of the person to whom the
warrant is addressed to be provided with assistance in giving effect to
the warrant.

(6) A targeted equipment interference warrant may not, by virtue of subsection
(3), authorise or require a person to engage in conduct, in relation to a
25communication other than a stored communication, which would (unless done
with lawful authority) constitute an offence under section 2(1) (unlawful
interception).

(7) Subsection (5)(a) does not authorise a person to engage in conduct which could
not be expressly authorised under the warrant because of the restriction
30imposed by subsection (6).

(8) In subsection (6), “stored communication” means a communication stored in or
by a telecommunication system (whether before or after its transmission).

(9) A targeted examination warrant is a warrant which authorises the person to
whom it is addressed to carry out the selection of protected material obtained
35under a bulk equipment interference warrant for examination, in breach of the
prohibition in section 170(4) (prohibition on seeking to identify
communications of, or private information relating to, individuals in the
British Islands).

In this Part, “protected material”, in relation to a targeted examination warrant,
40means any material obtained under a bulk equipment interference warrant
under Chapter 3 of Part 6, other than material which is—

• equipment data;

• information (other than a communication or equipment data) which is
  not private information.

(10) 45For provision enabling the combination of targeted equipment interference
warrants with certain other warrants or authorisations (including targeted
examination warrants), see Schedule 8.

(11) Any conduct which is carried out in accordance with a warrant under this Part
is lawful for all purposes.

89 Meaning of “equipment data”

(1) In this Part, “equipment data” means—

(a) 5systems data;

(b) data which falls within subsection (2).

(2) The data falling within this subsection is identifying data which—

(a) is, for the purposes of a relevant system, comprised in, included as part
of, attached to or logically associated with a communication (whether
10by the sender or otherwise) or any other item of information,

(b) is capable of being logically separated from the remainder of the
communication or the item of information, and

(c) if it were so separated, would not reveal anything of what might
reasonably be considered to be the meaning (if any) of the
15communication or the item of information, disregarding any meaning
arising from the fact of the communication or the existence of the item
of information or from any data relating to that fact.

(3) In subsection (2), “relevant system” means any system on or by means of which
the data is held.

(4) 20For the meaning of “systems data” and “identifying data”, see section 225.

90 Subject-matter of warrants

(1) A targeted equipment interference warrant may relate to any one or more of
the following matters—

(a) equipment belonging to, used by or in the possession of a particular
25person or organisation;

(b) equipment belonging to, used by or in the possession of a group of
persons who share a common purpose or who carry on, or may carry
on, a particular activity;

(c) equipment belonging to, used by or in the possession of more than one
30person or organisation, where the interference is for the purpose of a
single investigation or operation;

(d) equipment in a particular location;

(e) equipment in more than one location, where the interference is for the
purpose of a single investigation or operation;

(f) 35equipment which is being, or may be, used for the purposes of a
particular activity or activities of a particular description;

(g) equipment which is being, or may be, used to test, maintain or develop
capabilities relating to interference with equipment for the purpose of
obtaining communications, equipment data or other information;

(h) 40equipment which is being, or may be, used for the training of persons
who carry out, or are likely to carry out, such interference with
equipment.

(2) A targeted examination warrant may relate to any one or more of the following
matters—

(a) 45a particular person or organisation;

(b) a group of persons who share a common purpose or who carry on, or
may carry on, a particular activity;

(c) more than one person or organisation, where the conduct authorised by
the warrant is for the purpose of a single investigation or operation;

(d) 5the testing, maintenance or development of capabilities relating to the
selection of protected material for examination;

(e) the training of persons who carry out, or are likely to carry out, the
selection of such material for examination.

Power to issue warrants

91 10Power to issue warrants to intelligence services: the Secretary of State

(1) The Secretary of State may, on an application made by or on behalf of the head
of an intelligence service, issue a targeted equipment interference warrant if—

(a) the Secretary of State considers that the warrant is necessary on
grounds falling within subsection (5),

(b) 15the Secretary of State considers that the conduct authorised by the
warrant is proportionate to what is sought to be achieved by that
conduct,

(c) the Secretary of State considers that satisfactory arrangements made for
the purposes of sections 112 and 113 (safeguards relating to disclosure
20etc.) are in force in relation to the warrant, and

(d) except where the Secretary of State considers that there is an urgent
need to issue the warrant, the decision to issue the warrant has been
approved by a Judicial Commissioner.

(2) But the Secretary of State may not issue a targeted equipment interference
25warrant under subsection (1) if—

(a) the Secretary of State considers that the only ground for considering the
warrant to be necessary is for the purpose of preventing or detecting
serious crime, and

(b) the warrant, if issued, would authorise interference only with
30equipment which would be in Scotland at the time of the issue of the
warrant or which the Secretary of State believes would be in Scotland
at that time.

For the power of the Scottish Ministers to issue a targeted equipment
interference warrant, see section 92.

(3) 35The Secretary of State may, on an application made by or on behalf of the head
of an intelligence service, issue a targeted examination warrant if—

(a) the Secretary of State considers that the warrant is necessary on
grounds falling within subsection (5),

(b) the Secretary of State considers that the conduct authorised by the
40warrant is proportionate to what is sought to be achieved by that
conduct,

(c) the Secretary of State considers that the warrant is or may be necessary
to authorise the selection of protected material for examination in
breach of the prohibition in section 170(4) (prohibition on seeking to
45identify communications of, or private information relating to,
individuals in the British Islands), and