Investigatory Powers Bill (HL Bill 62)

Investigatory Powers BillPage 180

(b) the Secretary of State considers that the conduct required by the notice
is proportionate to what is sought to be achieved by that conduct, and

(c) the decision to give the notice has been approved by a Judicial
Commissioner.

(2) 5A “national security notice” is a notice requiring the operator to take such
specified steps as the Secretary of State considers necessary in the interests of
national security.

(3) A national security notice may, in particular, require the operator to whom it
is given—

(a) 10to carry out any conduct, including the provision of services or
facilities, for the purpose of—

(i) facilitating anything done by an intelligence service under any
enactment other than this Act, or

(ii) dealing with an emergency (within the meaning of Part 1 of the
15Civil Contingencies Act 2004);

(b) to provide services or facilities for the purpose of assisting an
intelligence service to carry out its functions more securely or more
effectively.

(4) But a national security notice may not require the taking of any steps the main
20purpose of which is to do something for which a warrant or authorisation is
required under any of the following enactments—

(a) this Act;

(b) the Intelligence Services Act 1994;

(c) the Regulation of Investigatory Powers Act 2000;

(d) 25the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp
11).

(5) A national security notice must specify such period as appears to the Secretary
of State to be reasonable as the period within which the steps specified in the
notice are to be taken.

(6) 30Sections 230 to 234 contain further provision about national security notices.

229 Technical capability notices

(1) The Secretary of State may give a relevant operator a technical capability notice
under this section if—

(a) the Secretary of State considers that the notice is necessary for securing
35that the operator has the capability to provide any assistance which the
operator may be required to provide in relation to any relevant
authorisation,

(b) the Secretary of State considers that the conduct required by the notice
is proportionate to what is sought to be achieved by that conduct, and

(c) 40the decision to give the notice has been approved by a Judicial
Commissioner.

(2) A “technical capability notice” is a notice—

(a) imposing on the relevant operator any applicable obligations specified
in the notice, and

(b) 45requiring the person to take all the steps specified in the notice for the
purpose of complying with those obligations.

Investigatory Powers BillPage 181

(3) In this section—

  • “applicable obligation”, in relation to a relevant operator of a particular
    description, means an obligation specified by the Secretary of State in
    regulations as an obligation that may be imposed on relevant operators,
    5or on relevant operators of that description;

  • “relevant authorisation” means—

    (a)

    any warrant issued under Part 2, 5 or 6, or

    (b)

    any authorisation or notice given under Part 3;

  • “relevant operator” means—

    (a)

    10a postal operator,

    (b)

    a telecommunications operator, or

    (c)

    a person who is proposing to become a postal operator or a
    telecommunications operator.

(4) Regulations under this section may specify an obligation that may be imposed
15on any relevant operators only if the Secretary of State considers it is
reasonable to do so for the purpose of securing—

(a) that it is (and remains) practicable to impose requirements on those
relevant operators to provide assistance in relation to relevant
authorisations, and

(b) 20that it is (and remains) practicable for those relevant operators to
comply with those requirements.

(5) The obligations that may be specified in regulations under this section include,
among other things—

(a) obligations to provide facilities or services of a specified description;

(b) 25obligations relating to apparatus owned or operated by a relevant
operator;

(c) obligations relating to the removal by a relevant operator of electronic
protection applied by or on behalf of that operator to any
communications or data;

(d) 30obligations relating to the security of any postal or telecommunications
services provided by a relevant operator;

(e) obligations relating to the handling or disclosure of any information.

(6) Before making any regulations under this section, the Secretary of State must
consult the following persons—

(a) 35the Technical Advisory Board,

(b) persons appearing to the Secretary of State to be likely to be subject to
any obligations specified in the regulations,

(c) persons representing persons falling within paragraph (b), and

(d) persons with statutory functions in relation to persons falling within
40that paragraph.

(7) A technical capability notice—

(a) must specify such period as appears to the Secretary of State to be
reasonable as the period within which the steps specified in the notice
are to be taken, and

(b) 45may specify different periods in relation to different steps.

(8) A technical capability notice may be given to persons outside the United
Kingdom (and may require things to be done, or not to be done, outside the
United Kingdom).

Investigatory Powers BillPage 182

(9) Sections 230 to 234 contain further provision about technical capability notices.

230 Approval of notices by Judicial Commissioners

(1) In this section “relevant notice” means—

(a) a national security notice under section 228, or

(b) 5a technical capability notice under section 229.

(2) In deciding whether to approve a decision to give a relevant notice, a Judicial
Commissioner must review the Secretary of State’s conclusions as to the
following matters—

(a) whether the notice is necessary as mentioned in section 228(1)(a) or (as
10the case may be) section 229(1)(a), and

(b) whether the conduct that would be required by the notice is
proportionate to what is sought to be achieved by that conduct.

(3) In doing so, the Judicial Commissioner must—

(a) apply the same principles as would be applied by a court on an
15application for judicial review, and

(b) consider the matters referred to in subsection (2) with a sufficient
degree of care as to ensure that the Judicial Commissioner complies
with the duties imposed by section 2 (general duties in relation to
privacy).

(4) 20Where a Judicial Commissioner refuses to approve a decision to give a relevant
notice, the Judicial Commissioner must give the Secretary of State written
reasons for the refusal.

(5) Where a Judicial Commissioner, other than the Investigatory Powers
Commissioner, refuses to approve a decision to give a relevant notice, the
25Secretary of State may ask the Investigatory Powers Commissioner to decide
whether to approve the decision to give the notice.

231 Further provision about notices under section 228 or 229

(1) In this section “relevant notice” means—

(a) a national security notice under section 228, or

(b) 30a technical capability notice under section 229.

(2) Before giving a relevant notice to a person, the Secretary of State must consult
that person.

(3) Before giving a relevant notice, the Secretary of State must, among other
matters, take into account—

(a) 35the likely benefits of the notice,

(b) the likely number of users (if known) of any postal or
telecommunications service to which the notice relates,

(c) the technical feasibility of complying with the notice,

(d) the likely cost of complying with the notice, and

(e) 40any other effect of the notice on the person (or description of person) to
whom it relates.

(4) In the case of a technical capability notice that would impose any obligations
relating to the removal by a person of electronic protection applied by or on
behalf of that person to any communications or data, in complying with

Investigatory Powers BillPage 183

subsection (3) the Secretary of State must in particular take into account the
technical feasibility, and likely cost, of complying with those obligations.

(5) A relevant notice must be in writing.

(6) A technical capability notice may be given to a person outside the United
5Kingdom in any of the following ways (as well as by electronic or other means
of giving a notice)—

(a) by delivering it to the person’s principal office within the United
Kingdom or, if the person has no such office in the United Kingdom, to
any place in the United Kingdom where the person carries on business
10or conducts activities;

(b) if the person has specified an address in the United Kingdom as one at
which the person, or someone on the person’s behalf, will accept
documents of the same description as a notice, by delivering it to that
address.

(7) 15The Secretary of State may by regulations make further provision about the
giving of relevant notices.

(8) A person to whom a relevant notice is given, or any person employed or
engaged for the purposes of that person’s business, must not disclose the
existence or contents of the notice to any other person without the permission
20of the Secretary of State.

(9) A person to whom a relevant notice is given must comply with the notice.

(10) The duty imposed by subsection (9) is enforceable—

(a) in relation to a person in the United Kingdom, and

(b) so far as relating to a technical capability notice within subsection (11),
25in relation to a person outside the United Kingdom,

by civil proceedings by the Secretary of State for an injunction, or for specific
performance of a statutory duty under section 45 of the Court of Session Act
1988, or for any other appropriate relief.

(11) A technical capability notice is within this subsection if it relates to any of the
30following—

(a) a targeted interception warrant or mutual assistance warrant under
Chapter 1 of Part 2;

(b) a bulk interception warrant;

(c) an authorisation or notice given under Part 3.

(12) 35Subsection (9) applies to a person to whom a national security notice is given
despite any other duty imposed on the person by or under Part 1, or Chapter 1
of Part 2, of the Communications Act 2003.

232 Variation and revocation of notices

(1) In this section “relevant notice” means—

(a) 40a national security notice under section 228, or

(b) a technical capability notice under section 229.

(2) The Secretary of State must keep each relevant notice under review.

(3) The Secretary of State may—

(a) vary a relevant notice;

Investigatory Powers BillPage 184

(b) revoke a relevant notice (whether wholly or in part).

(4) The Secretary of State may vary a national security notice only if the Secretary
of State considers that the conduct required by the notice as varied is
proportionate to what is sought to be achieved by that conduct.

(5) 5If the Secretary of State varies or revokes a relevant notice given to any person,
the Secretary of State must give that person notice of the variation or
revocation.

(6) Subsections (2) to (4) and (7) of section 231 apply in relation to varying or
revoking a relevant notice as they apply in relation to giving a relevant notice
10(and in the application of section 231(3) and (4) in relation to varying a relevant
notice, references to the notice are to be read as references to the notice as
varied).

(7) Subsections (5) and (6) of section 231 apply to any notice of the variation or
revocation of a relevant notice as they apply to a relevant notice.

(8) 15The fact that a relevant notice has been revoked in relation to a particular
person (or description of persons) does not prevent the giving of another
relevant notice of the same kind in relation to the same person (or description
of persons).

(9) Any reference in this section or section 231(8) to (12) to a notice given under
20section 228 or 229 includes a reference to such a notice as varied under this
section.

233 Review of notices by the Secretary of State

(1) A person who is given a notice under section 228 or 229 may, within such
period or circumstances as may be provided for by regulations made by the
25Secretary of State, refer the notice back to the Secretary of State.

(2) Such a reference may be in relation to the whole of a notice or any aspect of it.

(3) There is no requirement for a person who has referred a notice under
subsection (1) to comply with the notice, so far as referred, until the Secretary
of State has reviewed the notice in accordance with subsection (4).

(4) 30The Secretary of State must review any notice so far as referred to the Secretary
of State under subsection (1).

(5) Before deciding the review, the Secretary of State must consult—

(a) the Technical Advisory Board, and

(b) a Judicial Commissioner.

(6) 35The Board must consider the technical requirements and the financial
consequences, for the person who has made the reference, of the notice so far
as referred.

(7) The Commissioner must consider whether the notice so far as referred is
proportionate.

(8) 40The Board and the Commissioner must—

(a) give the person concerned and the Secretary of State the opportunity to
provide evidence, or make representations, to them before reaching
their conclusions, and

(b) report their conclusions to—

Investigatory Powers BillPage 185

(i) the person, and

(ii) the Secretary of State.

(9) The Secretary of State may, after considering the conclusions of the Board and
the Commissioner—

(a) 5vary or revoke the notice under section 232, or

(b) give a notice under this section to the person confirming its effect.

(10) But the Secretary of State may vary the notice, or give a notice under subsection
(9)(b) confirming its effect, only if the Secretary of State’s decision to do so has
been approved by the Investigatory Powers Commissioner.

(11) 10Subsections (5) to (8) of section 231 apply in relation to a notice under
subsection (9)(b) above as they apply in relation to a notice under section 228
or 229.

(12) Any reference in this section to a notice under section 228 or 229 includes such
a notice as varied under section 232, but only so far as the variation is
15concerned.

But it does not include a notice varied as mentioned in subsection (9)(a) above.

234 Approval of notices following review under section 233

(1) In this section “relevant notice” means—

(a) a national security notice under section 228, or

(b) 20a technical capability notice under section 229.

(2) In deciding whether to approve a decision to vary a relevant notice as
mentioned in section 233(9)(a), or to give a notice under section 233(9)(b)
confirming the effect of a relevant notice, the Investigatory Powers
Commissioner must review the Secretary of State’s conclusions as to the
25following matters—

(a) whether the relevant notice as varied or confirmed is necessary as
mentioned in section 228(1)(a) or (as the case may be) section 229(1)(a),
and

(b) whether the conduct required by the relevant notice, as varied or
30confirmed, is proportionate to what is sought to be achieved by that
conduct.

(3) In doing so, the Investigatory Powers Commissioner must—

(a) apply the same principles as would be applied by a court on an
application for judicial review, and

(b) 35consider the matters referred to in subsection (2) with a sufficient
degree of care as to ensure that the Investigatory Powers Commissioner
complies with the duties imposed by section 2 (general duties in
relation to privacy).

(4) Where the Investigatory Powers Commissioner refuses to approve a decision
40to vary a relevant notice as mentioned in section 233(9)(a), or to give a notice
under section 233(9)(b) confirming the effect of a relevant notice, the
Investigatory Powers Commissioner must give the Secretary of State written
reasons for the refusal.

Investigatory Powers BillPage 186

Wireless telegraphy

235 Amendments of the Wireless Telegraphy Act 2006

(1) The Wireless Telegraphy Act 2006 is amended as follows.

(2) Section 48 (interception and disclosure of messages) is amended as follows.

(3) 5In subsection (1), for “otherwise than under the authority of a designated
person” substitute “without lawful authority”.

(4) After subsection (3) insert—

(3A) A person does not commit an offence under this section consisting in
any conduct if the conduct—

(a) 10constitutes an offence under section 3(1) of the Investigatory
Powers Act 2016 (offence of unlawful interception), or

(b) would do so in the absence of any lawful authority (within the
meaning of section 6 of that Act).”

(5) Omit subsection (5).

(6) 15Omit section 49 (interception authorities).

(7) In consequence of the repeal made by subsection (6)—

(a) in sections 50(5) and 119(2)(a), for “49” substitute “48”;

(b) in section 121(2), omit paragraph (b).

CHAPTER 2 20General

Review of operation of Act

236 Review of operation of Act

(1) The Secretary of State must, within the period of 6 months beginning with the
end of the initial period, prepare a report on the operation of this Act.

(2) 25In subsection (1) “the initial period” is the period of 5 years and 6 months
beginning with the day on which this Act is passed.

(3) In preparing the report under subsection (1), the Secretary of State must, in
particular, take account of any report on the operation of this Act made by a
Select Committee of either House of Parliament (whether acting alone or
30jointly).

(4) The Secretary of State must—

(a) publish the report prepared under subsection (1), and

(b) lay a copy of it before Parliament.

Investigatory Powers BillPage 187

Interpretation

237 Telecommunications definitions

(1) The definitions in this section have effect for the purposes of this Act.

Communication

(2) 5“Communication”, in relation to a telecommunications operator,
telecommunications service or telecommunication system, includes—

(a) anything comprising speech, music, sounds, visual images or data of
any description, and

(b) signals serving either for the impartation of anything between persons,
10between a person and a thing or between things or for the actuation or
control of any apparatus.

Entity data

(3) “Entity data” means any data which—

(a) is about—

(i) 15an entity,

(ii) an association between a telecommunications service and an
entity, or

(iii) an association between any part of a telecommunication system
and an entity,

(b) 20consists of, or includes, data which identifies or describes the entity
(whether or not by reference to the entity’s location), and

(c) is not events data.

Events data

(4) “Events data” means any data which identifies or describes an event (whether
25or not by reference to its location) on, in or by means of a telecommunication
system where the event consists of one or more entities engaging in a specific
activity at a specific time.

Communications data

(5) “Communications data”, in relation to a telecommunications operator,
30telecommunications service or telecommunication system, means entity data
or events data—

(a) which is (or is to be or is capable of being) held or obtained by, or on
behalf of, a telecommunications operator and—

(i) is about an entity to which a telecommunications service is
35provided and relates to the provision of the service,

(ii) is comprised in, included as part of, attached to or logically
associated with a communication (whether by the sender or
otherwise) for the purposes of a telecommunication system by
means of which the communication is being or may be
40transmitted, or

(iii) does not fall within sub-paragraph (i) or (ii) but does relate to
the use of a telecommunications service or a telecommunication
system,

Investigatory Powers BillPage 188

(b) which is available directly from a telecommunication system and falls
within sub-paragraph (ii) of paragraph (a), or

(c) which—

(i) is (or is to be or is capable of being) held or obtained by, or on
5behalf of, a telecommunications operator,

(ii) is about the architecture of a telecommunication system, and

(iii) is not about a specific person,

but does not include any content of a communication or anything which, in the
absence of subsection (6)(b), would be content of a communication.

10Content of a communication

(6) “Content”, in relation to a communication and a telecommunications operator,
telecommunications service or telecommunication system, means any element
of the communication, or any data attached to or logically associated with the
communication, which reveals anything of what might reasonably be
15considered to be the meaning (if any) of the communication, but—

(a) any meaning arising from the fact of the communication or from any
data relating to the transmission of the communication is to be
disregarded, and

(b) anything which is systems data is not content.

20Other definitions

(7) “Entity” means a person or thing.

(8) “Public telecommunications service” means any telecommunications service
which is offered or provided to the public, or a substantial section of the public,
in any one or more parts of the United Kingdom.

(9) 25“Public telecommunication system” means a telecommunication system
located in the United Kingdom—

(a) by means of which any public telecommunications service is provided,
or

(b) which consists of parts of any other telecommunication system by
30means of which any such service is provided.

(10) “Telecommunications operator” means a person who—

(a) offers or provides a telecommunications service to persons in the
United Kingdom, or

(b) controls or provides a telecommunication system which is (wholly or
35partly)—

(i) in the United Kingdom, or

(ii) controlled from the United Kingdom.

(11) “Telecommunications service” means any service that consists in the provision
of access to, and of facilities for making use of, any telecommunication system
40(whether or not one provided by the person providing the service).

(12) For the purposes of subsection (11), the cases in which a service is to be taken
to consist in the provision of access to, and of facilities for making use of, a
telecommunication system include any case where a service consists in or
includes facilitating the creation, management or storage of communications
45transmitted, or that may be transmitted, by means of such a system.

Investigatory Powers BillPage 189

(13) “Telecommunication system” means a system (including the apparatus
comprised in it) that exists (whether wholly or partly in the United Kingdom
or elsewhere) for the purpose of facilitating the transmission of
communications by any means involving the use of electrical or
5electromagnetic energy.

(14) “Private telecommunication system” means any telecommunication system
which—

(a) is not a public telecommunication system,

(b) is attached, directly or indirectly, to a public telecommunication system
10(whether or not for the purposes of the communication in question),
and

(c) includes apparatus which is both located in the United Kingdom and
used (with or without other apparatus) for making the attachment to
that public telecommunication system.

238 15Postal definitions

(1) The definitions in this section have effect for the purposes of this Act.

Communication

(2) “Communication”, in relation to a postal operator or postal service (but not in
the definition of “postal service” in this section), includes anything transmitted
20by a postal service.

Communications data

(3) “Communications data”, in relation to a postal operator or postal service,
means—

(a) postal data comprised in, included as part of, attached to or logically
25associated with a communication (whether by the sender or otherwise)
for the purposes of a postal service by means of which it is being or may
be transmitted,

(b) information about the use made by any person of a postal service (but
excluding any content of a communication (apart from information
30within paragraph (a)), or

(c) information not within paragraph (a) or (b) that is (or is to be) held or
obtained by or on behalf of a person providing a postal service, is about
those to whom the service is provided by that person and relates to the
service so provided.

35Postal data

(4) “Postal data” means data which—

(a) identifies, or purports to identify, any person, apparatus or location to
or from which a communication is or may be transmitted,

(b) identifies or selects, or purports to identify or select, apparatus through
40which, or by means of which, a communication is or may be
transmitted,

(c) identifies, or purports to identify, the time at which an event relating to
a communication occurs, or

(d) identifies the data or other data as data comprised in, included as part
45of, attached to or logically associated with a particular communication.