6 The Government is introducing legislation to replace the emergency legislation passed in July 2014, the Data Retention and Investigatory Powers Act 2014 (DRIPA), which is repealed on 31 December 2016. DRIPA replaced the Data Retention (EC Directive) Regulations 2009 (S.I. 2009/859) following the European Court of Justice judgment of April 2014 in the Digital Rights Ireland case which declared the Data Retention Directive invalid. During the passage of DRIPA, the Government committed to bring forward new legislation which would provide the security and intelligence agencies, law enforcement and other public authorities with the investigatory powers necessary to address evolving threats within a changing communications environment. The Investigatory Powers Bill updates the legal framework governing the state’s ability to acquire communications and data about communications.
7 The Bill will govern the powers available to the state to obtain communications and communications data in the UK. It will provide consistent statutory safeguards and will clarify which powers different public authorities can use and for what purposes. It sets out the statutory tests that must be met before a power may be used and the authorisation regime for each investigative tool, including a new requirement for Judicial Commissioners to approve the issuing of warrants for the most sensitive and intrusive powers. The Bill will also create a new Investigatory Powers Commissioner to oversee the use of these powers. Finally, the Bill will provide a new power, requiring communications services providers to retain internet connection records when given a notice by the Secretary of State.
8 The Bill is in nine parts.
9 Part 1 asserts the privacy of communications and provides for related offences. It defines interception and sets out the offences of unlawful interception and unlawful acquisition of communications data and the penalties for committing such offences. It also references the use of powers to acquire stored communications such as an email stored on a web-based server or a voicemail.
10 Part 2 provides for targeted interception: acquiring the content of communications. This power is currently provided for under the Regulation of the Investigatory Powers Act 2000 (RIPA). The Bill will repeal and replace the existing interception powers in Part 1, Chapter 1 of RIPA with a new targeted interception power. It will provide for the targeted interception of communications by a limited number of public authorities for a limited number of purposes when a warrant is in place. It will clarify that in all circumstances, when law enforcement or the security and intelligence agencies wish to intercept the communications of a person believed to be in the UK, or examine the communications of a person believed to be in the UK that have been collected in bulk, a targeted interception warrant or targeted examination warrant must be sought. It also lists the other limited circumstances in which interception (including that not undertaken by law enforcement or security and intelligence agencies) can be lawful. It includes the interception powers previously provided for in the Wireless Telegraphy Act 2006.
11 Part 3 concerns authorisations for acquiring communications data: the ‘who’, ‘when’, ‘where’ and ‘how’ of a communication. The Bill will provide powers for public authorities to acquire communications data, replacing and largely replicating the effect of Chapter 2 of Part 1 of RIPA. The classes of communications data will be redefined so that they reflect current technology. The Bill will require requests for communications data to be made on a case by case basis so that access is permitted only when authorised by designated senior officers (who will be, subject to some specific exceptions, independent from investigations), on the advice of an expert Single Point of Contact (SPoC). Minor public authorities will be required to share SPoCs. The individual requests must be in respect of the statutory purposes and must be considered necessary and proportionate by a designated senior officer. The Bill will set out the public authorities that will have access to communications data in future, permitting bodies to retain powers to access to communications data only where a clear case has been made.
12 Part 4 covers the retention of communications data. The existing statutory regime by which public telecommunications operators can be required to retain communications data will be broadly replicated, replacing section 1 of DRIPA. It will provide for the Secretary of State to require communications service providers to retain relevant communications data for one or more of the statutory purposes for a period that must not exceed twelve months. It specifies a number of safeguards in respect of data retention, for example the matters that must be considered before the giving of a retention notice, oversight arrangements and means of redress. The Bill also provides a new power for the retention of, and access to, internet connection records (ICRs) (the records captured by a network access provider of the internet services with which a person or device interacts).
13 Part 5 concerns equipment interference: interfering with computer equipment to obtain communications, information or equipment data. This is currently provided for the security and intelligence agencies under the Intelligence Services Act 1994 (ISA) and, for law enforcement agencies under the Police Act 1997. The Bill will provide a bespoke statutory framework for the ability of the security and intelligence agencies, Armed Forces and law enforcement agencies to undertake equipment interference to obtain communications and other information. Interference with equipment where the primary purpose is not to acquire communications, equipment data or other information may continue to be authorised under the ISA and the Police Act 1997.
14 Part 6 contains powers for the security and intelligence agencies to intercept communications, conduct equipment interference and to obtain communications data in bulk. The Bill will provide for a new ’bulk acquisition’ warrant for the security and intelligence agencies to obtain communications data. This replaces the provision at section 94 of the Telecommunications Act 1984, which will be repealed. The Bill will allow the security and intelligence agencies to intercept communications in bulk, where the communications are overseas-related. This will replace the power to intercept "external communications" in Chapter 1, Part 1 of RIPA. Where it is not necessary to obtain the content of such communications, the Bill will provide the Secretary of State with the power to issue, subject to Judicial Commissioner approval, a warrant for the acquisition of secondary data only. The warrant will also pre-authorise the purposes for which communications acquired under a bulk warrant may be examined – looked at or listened to. A bulk equipment interference power will provide the statutory basis for overseas-related equipment interference activity undertaken by the security and intelligence agencies. All bulk powers will be underpinned by safeguards equivalent to the bulk interception regime for the handling, destruction and retention of information.
15 Part 7 provides clarity and additional safeguards for the security and intelligence agencies’ retention and examination of Bulk Personal Datasets (BPD). The security and intelligence agencies have existing statutory powers under ISA and the Security Service Act 1989 (SSA) which enable them to acquire and access datasets containing personal data about a large number of individuals, many of whom are not of interest to the agencies. The Bill will not create a new power but bring greater transparency to this important capability and provide for enhanced safeguards. Retention and examination of bulk personal datasets by the security and intelligence agencies will be subject to an authorisation process where the Secretary of State will issue either a ‘class’ or ‘specific’ warrant which must be approved by a Judicial Commissioner before it can be issued.
16 Part 8 sets out new oversight regime arrangements which will replace the three existing Commissioners (the Intelligence Services Commissioner, the Interception of Communications Commissioner and the Chief Surveillance Commissioner, and the Investigatory Powers Commissioner for Northern Ireland who is provided for in law) with a single new Commissioner, the Investigatory Powers Commissioner (IPC). The Investigatory Powers Commissioner, a senior judge, will be supported by a number of Judicial Commissioners undertaking either authorisation or oversight and inspection functions. The Investigatory Powers Commissioner will have significantly greater powers and resources compared to the current oversight regime. The IPC will be a more visible body, providing robust oversight and scrutiny of the use of investigatory powers by a wide range of public authorities. The Investigatory Powers Commissioner will be able to draw on extensive legal and technical expertise. The Investigatory Powers Commissioner will have to report annually and be able to make ad hoc reports on matters that they consider appropriate.
17 The Bill will also create a domestic right of appeal from decisions or determinations of the Investigatory Powers Tribunal (IPT) to the Court of Appeal in England and Wales, the Court of Session or the Court of Appeal in Northern Ireland. It will be possible for appeals to be heard wholly or partly in closed material proceedings (CMP), if it is necessary for the appeal court to review information which was considered by the IPT in closed session.
18 The Bill will provide for statutory Codes of Practice providing further guidance on the powers and duties in the Bill, to which public authorities and providers must have regard when carrying out these powers and duties.
19 Part 9 contains General and Final Provisions. This includes provision relating to obligations that may be placed on communications service providers to assist in giving effect to warrants and authorisations under the Bill, as well as providing a new framework for obligations previously provided for under s.94 of the Telecommunications Act 1984.