Investigatory Powers Bill (HL Bill 62)

Investigatory Powers BillPage 60

subscribing authority”) for the purposes of the subscribing authority’s
functions under this Part, and

(b) either—

(i) a designated senior officer of the supplying authority is
5permitted to grant authorisations to officers of the subscribing
authority,

(ii) officers of the supplying authority are permitted to be granted
authorisations by a designated senior officer of the subscribing
authority, or

(iii) 10officers of the supplying authority act as single points of contact
for officers of the subscribing authority.

(2) The persons by whom, or to whom, authorisations may be granted (or who
may act as single points of contact) under a collaboration agreement are
additional to those persons by whom, or to whom, authorisations would
15otherwise be granted under this Part (or who could otherwise act as single
points of contact).

(3) In a case falling within subsection (1)(b)(i)—

(a) section 58 has effect as if—

(i) in subsection (2) the reference to an officer of the authority were
20a reference to an officer of the subscribing authority, and

(ii) in subsection (6)(b)(ii) the reference to an officer of the same
relevant public authority as an authorised officer included a
reference to an officer of the supplying authority, and

(b) section 60(3)(d) has effect as if the reference to the relevant public
25authority concerned were a reference to both authorities.

(4) In a case falling within subsection (1)(b)(ii)—

(a) section 58 has effect as if—

(i) in subsection (2) the reference to an officer of the authority were
a reference to an officer of the supplying authority, and

(ii) 30in subsection (6)(b)(ii) the reference to an officer of the same
relevant public authority as an authorised officer included a
reference to an officer of the subscribing authority, and

(b) section 60(3)(d) has effect as if the reference to the relevant public
authority concerned were a reference to both authorities.

(5) 35In a case falling within subsection (1)(b)(iii), section 73(4)(b) has effect as if the
references to the relevant public authority were references to the subscribing
authority.

(6) In this section—

  • “force collaboration provision” has the meaning given by paragraph (a) of
    40section 22A(2) of the Police Act 1996 but as if the reference in that
    paragraph to a police force included the National Crime Agency,

  • “police collaboration agreement” means a collaboration agreement under
    section 22A of the Police Act 1996 which contains force collaboration
    provision.

76 45Collaboration agreements: supplementary

(1) A collaboration agreement may provide for payments to be made between
parties to the agreement.

Investigatory Powers BillPage 61

(2) A collaboration agreement—

(a) must be in writing,

(b) may be varied by a subsequent collaboration agreement, and

(c) may be brought to an end by agreement between the parties to it.

(3) 5A person who makes a collaboration agreement must—

(a) publish the agreement, or

(b) publish the fact that the agreement has been made and such other
details about it as the person considers appropriate.

(4) A relevant public authority may enter into a collaboration agreement as a
10supplying authority, a subscribing authority or both (whether or not it would
have power to do so apart from this section).

(5) The Secretary of State may, after consulting a relevant public authority, direct
it to enter into a collaboration agreement if the Secretary of State considers that
entering into the agreement would assist the effective exercise by the authority,
15or another relevant public authority, of its functions under this Part.

(6) A code of practice under Schedule 7 must include guidance to relevant public
authorities about collaboration agreements.

(7) The guidance must include guidance about the criteria the Secretary of State
will use in considering whether a collaboration agreement is appropriate for a
20relevant public authority.

77 Police collaboration agreements

(1) This section applies if—

(a) the chief officer of police of an England and Wales police force (“force
1”) has entered into a police collaboration agreement, and

(b) 25under the terms of the agreement—

(i) a designated senior officer of force 1 is permitted to grant
authorisations to officers of a collaborating police force,

(ii) officers of force 1 are permitted to be granted authorisations by
a designated senior officer of a collaborating police force, or

(iii) 30officers of force 1 act as single points of contact for officers of a
collaborating police force.

(2) The persons by whom, or to whom, authorisations may be granted (or who
may act as single points of contact) under a police collaboration agreement are
additional to those persons by whom, or to whom, authorisations would
35otherwise be granted under this Part (or who could otherwise act as single
points of contact).

(3) In a case falling within subsection (1)(b)(i)—

(a) section 58 has effect as if—

(i) in subsection (2) the reference to an officer of the authority were
40a reference to an officer of the collaborating police force, and

(ii) in subsection (6)(b)(ii) the reference to an officer of the same
relevant public authority as an authorised officer included a
reference to an officer of force 1, and

(b) section 60(3)(d) has effect as if the reference to the relevant public
45authority concerned were a reference to force 1 and the collaborating
police force.

Investigatory Powers BillPage 62

(4) In a case falling within subsection (1)(b)(ii)—

(a) section 58 has effect as if—

(i) in subsection (2) the reference to an officer of the authority were
a reference to an officer of force 1, and

(ii) 5in subsection (6)(b)(ii) the reference to an officer of the same
relevant public authority as an authorised officer included a
reference to an officer of the collaborating police force, and

(b) section 60(3)(d) has effect as if the reference to the relevant public
authority concerned were a reference to force 1 and the collaborating
10police force.

(5) In a case falling within subsection (1)(b)(iii), section 73(4)(b) has effect as if the
references to the relevant public authority were references to the collaborating
police force.

(6) In this section—

  • 15“collaborating police force”, in relation to a police collaboration
    agreement, means a police force (other than force 1) whose chief officer
    of police is a party to the agreement,

  • “England and Wales police force” means—

    (a)

    any police force maintained under section 2 of the Police Act
    201996 (police forces in England and Wales outside London),

    (b)

    the metropolitan police force, or

    (c)

    the City of London police force,

  • “police collaboration agreement” has the same meaning as in section 75
    (see subsection (6) of that section),

25and references in this section to an England and Wales police force or a police
force include the National Crime Agency (and references to the chief officer of
police include the Director General of the National Crime Agency).

Further and supplementary provision

78 Lawfulness of conduct authorised by this Part

(1) 30Conduct is lawful for all purposes if—

(a) it is conduct in which any person is authorised to engage by an
authorisation or required to undertake by virtue of a notice given in
pursuance of an authorisation, and

(b) the conduct is in accordance with, or in pursuance of, the authorisation
35or notice.

(2) A person (whether or not the person so authorised or required) is not to be
subject to any civil liability in respect of conduct that—

(a) is incidental to, or is reasonably undertaken in connection with,
conduct that is lawful by virtue of subsection (1), and

(b) 40is not itself conduct for which an authorisation or warrant—

(i) is capable of being granted under any of the enactments
mentioned in subsection (3), and

(ii) might reasonably have been expected to have been sought in
the case in question.

(3) 45The enactments referred to in subsection (2)(b)(i) are—

(a) an enactment contained in this Act,

Investigatory Powers BillPage 63

(b) an enactment contained in the Regulation of Investigatory Powers Act
2000,

(c) an enactment contained in Part 3 of the Police Act 1997 (powers of the
police and of customs officers), or

(d) 5section 5 of the Intelligence Services Act 1994 (warrants for the
intelligence services).

79 Offence of making unauthorised disclosure

(1) It is an offence for a telecommunications operator, or any person employed or
engaged for the purposes of the business of a telecommunications operator, to
10disclose, without reasonable excuse, to any person the existence of—

(a) any requirement imposed on the operator by virtue of this Part to
disclose communications data relating to that person, or

(b) any request made in pursuance of an authorisation for the operator to
disclose such data.

(2) 15For the purposes of subsection (1), it is, in particular, a reasonable excuse if the
disclosure is made with the permission of the relevant public authority which
is seeking to obtain the data from the operator (whether the permission is
contained in any notice requiring the operator to disclose the data or
otherwise).

(3) 20A person guilty of an offence under this section is liable—

(a) on summary conviction in England and Wales—

(i) to imprisonment for a term not exceeding 12 months (or 6
months, if the offence was committed before the
commencement of section 154(1) of the Criminal Justice Act
252003), or

(ii) to a fine,

or to both;

(b) on summary conviction in Scotland—

(i) to imprisonment for a term not exceeding 12 months, or

(ii) 30to a fine not exceeding the statutory maximum,

or to both;

(c) on summary conviction in Northern Ireland—

(i) to imprisonment for a term not exceeding 6 months, or

(ii) to a fine not exceeding the statutory maximum,

35or to both;

(d) on conviction on indictment, to imprisonment for a term not exceeding
2 years or to a fine, or to both.

80 Certain transfer and agency arrangements with public authorities

(1) The Secretary of State may by regulations provide for—

(a) 40any function under sections 64 to 66 which is exercisable by the
Secretary of State to be exercisable instead by another public authority,
or

(b) any function under sections 64 to 66 which is exercisable by a public
authority by virtue of paragraph (a) to be exercisable instead by the
45Secretary of State.

Investigatory Powers BillPage 64

(2) The Secretary of State may by regulations modify any enactment about a public
authority for the purpose of enabling or otherwise facilitating any function
exercisable by the Secretary of State under this Part to be exercisable on behalf
of the Secretary of State by the authority concerned.

(3) 5Regulations under subsection (2) do not affect the Secretary of State’s
responsibility for the exercise of the functions concerned.

(4) Subsection (2) does not apply in relation to any function of the Secretary of
State of making regulations.

(5) Schedule 5 (which contains further safeguards and provisions supplementing
10this section) has effect.

81 Application of Part 3 to postal operators and postal services

(1) This Part applies to postal operators and postal services as it applies to
telecommunications operators and telecommunications services.

(2) In its application by virtue of subsection (1), this Part has effect as if—

(a) 15any reference to a telecommunications operator were a reference to a
postal operator,

(b) any reference to a telecommunications service were a reference to a
postal service,

(c) any reference to a telecommunication system were a reference to a
20postal service,

(d) sections 58(3)(a) and 59 were omitted, and

(e) in Part 2 of Schedule 4, for “which is entity data” there were substituted
“within paragraph (c) of the definition of “communications data” in
section 238(3)”.

82 25Extra-territorial application of Part 3

(1) An authorisation may relate to conduct outside the United Kingdom and
persons outside the United Kingdom.

(2) A notice given in pursuance of an authorisation may relate to conduct outside
the United Kingdom and persons outside the United Kingdom.

(3) 30Where such a notice is to be given to a person outside the United Kingdom, the
notice may be given to the person in any of the following ways (as well as by
electronic or other means of service)—

(a) by delivering it to the person’s principal office within the United
Kingdom or, if the person has no such office in the United Kingdom, to
35any place in the United Kingdom where the person carries on business
or conducts activities,

(b) if the person has specified an address in the United Kingdom as one at
which the person, or someone on the person’s behalf, will accept
documents of the same description as a notice, by delivering it to that
40address,

(c) by notifying the person by such other means as the authorised officer
considers appropriate (which may include notifying the person orally).

(4) In determining for the purposes of subsection (3) of section 63 whether it is
reasonably practicable for a telecommunications operator outside the United
45Kingdom to take any steps in a country or territory outside the United

Investigatory Powers BillPage 65

Kingdom for the purpose of complying with a duty imposed by virtue of
subsection (1) or (2) of that section, the matters to be taken into account include
the following—

(a) any requirements or restrictions under the law of that country or
5territory that are relevant to the taking of those steps, and

(b) the extent to which it is reasonably practicable to comply with the duty
in a way that does not breach any of those requirements or restrictions.

(5) Nothing in the definition of “telecommunications operator” limits the type of
communications data in relation to which an authorisation, or a request or
10requirement of a kind which gives rise to a duty under section 63(1) or (2), may
apply.

83 Part 3: interpretation

(1) In this Part—

  • “authorisation” means an authorisation under section 58 (including that
    15section as modified by sections 75 and 77),

  • “designated senior officer”—

    (a)

    in relation to a relevant public authority which is a local
    authority, has the meaning given by section 70(2), and

    (b)

    in relation to any other relevant public authority, has the
    20meaning given by section 67(3),

  • “filtering arrangements” means any arrangements under section 64(1),

  • “officer”, in relation to a relevant public authority, means a person
    holding an office, rank or position with that authority,

  • “relevant public authority” means a public authority which is a relevant
    25public authority for the purposes of this Part by virtue of section 67(2)
    or 70(1).

(2) In this Part “local authority” means—

(a) a district or county council in England,

(b) a London borough council,

(c) 30the Common Council of the City of London in its capacity as a local
authority,

(d) the Council of the Isles of Scilly,

(e) a county council or county borough council in Wales,

(f) a council constituted under section 2 of the Local Government etc.
35(Scotland) Act 1994, and

(g) a district council in Northern Ireland.

(3) See also—

  • section 237 (telecommunications definitions),

  • section 238 (postal definitions),

  • 40section 239 (general definitions),

  • section 240 (index of defined expressions).

Investigatory Powers BillPage 66

Part 4 Retention of communications data

General

84 Powers to require retention of certain data

(1) 5The Secretary of State may by notice (a “retention notice”) require a
telecommunications operator to retain relevant communications data if the
Secretary of State considers that the requirement is necessary and
proportionate for one or more of the purposes falling within paragraphs (a) to
(j) of section 58(7) (purposes for which communications data may be obtained).

(2) 10A retention notice may—

(a) relate to a particular operator or any description of operators,

(b) require the retention of all data or any description of data,

(c) identify the period or periods for which data is to be retained,

(d) contain other requirements, or restrictions, in relation to the retention
15of data,

(e) make different provision for different purposes,

(f) relate to data whether or not in existence at the time of the giving, or
coming into force, of the notice.

(3) A retention notice must not require any data to be retained for more than 12
20months beginning with—

(a) in the case of communications data relating to a specific
communication, the day of the communication concerned,

(b) in the case of entity data which does not fall within paragraph (a) above
but does fall within paragraph (a)(i) of the definition of
25“communications data” in section 237(5), the day on which the entity
concerned ceases to be associated with the telecommunications service
concerned or (if earlier) the day on which the data is changed, and

(c) in any other case, the day on which the data is first held by the operator
concerned.

(4) 30A retention notice which relates to data already in existence when the notice
comes into force imposes a requirement to retain the data for only so much of
a period of retention as occurs on or after the coming into force of the notice.

(5) A retention notice comes into force—

(a) when the notice is given to the operator (or description of operators)
35concerned, or

(b) (if later) at the time or times specified in the notice.

(6) A retention notice is given to an operator (or description of operators) by
giving, or publishing, it in such manner as the Secretary of State considers
appropriate for bringing it to the attention of the operator (or description of
40operators) to whom it relates.

(7) A retention notice must specify—

(a) the operator (or description of operators) to whom it relates,

(b) the data which is to be retained,

(c) the period or periods for which the data is to be retained,

Investigatory Powers BillPage 67

(d) any other requirements, or any restrictions, in relation to the retention
of the data,

(e) the information required by section 225(7) (the level or levels of
contribution in respect of costs incurred as a result of the notice).

(8) 5The requirements or restrictions mentioned in subsection (7)(d) may, in
particular, include—

(a) a requirement to retain the data in such a way that it can be transmitted
efficiently and effectively in response to requests,

(b) requirements or restrictions in relation to the obtaining (whether by
10collection, generation or otherwise), generation or processing of—

(i) data for retention, or

(ii) retained data.

(9) The fact that the data which would be retained under a retention notice relates
to the activities in the British Islands of a trade union is not, of itself, sufficient
15to establish that the requirement to retain the data is necessary for one or more
of the purposes falling within paragraphs (a) to (j) of section 58(7).

(10) In this Part “relevant communications data” means communications data
which may be used to identify, or assist in identifying, any of the following—

(a) the sender or recipient of a communication (whether or not a person),

(b) 20the time or duration of a communication,

(c) the type, method or pattern, or fact, of communication,

(d) the telecommunication system (or any part of it) from, to or through
which, or by means of which, a communication is or may be
transmitted, or

(e) 25the location of any such system,

and this expression therefore includes, in particular, internet connection
records.

Safeguards

85 Matters to be taken into account before giving retention notices

(1) 30Before giving a retention notice, the Secretary of State must, among other
matters, take into account—

(a) the likely benefits of the notice,

(b) the likely number of users (if known) of any telecommunications
service to which the notice relates,

(c) 35the technical feasibility of complying with the notice,

(d) the likely cost of complying with the notice, and

(e) any other effect of the notice on the telecommunications operator (or
description of operators) to whom it relates.

(2) Before giving such a notice, the Secretary of State must take reasonable steps to
40consult any operator to whom it relates.

86 Review by the Secretary of State

(1) A telecommunications operator to whom a retention notice is given may,
within such period or circumstances as may be provided for by regulations
made by the Secretary of State, refer the notice back to the Secretary of State.

Investigatory Powers BillPage 68

(2) Such a reference may be in relation to the whole of a notice or any aspect of it.

(3) In the case of a notice given to a description of operators—

(a) each operator falling within that description may make a reference
under subsection (1), but

(b) 5each such reference may only be in relation to the notice, or aspect of
the notice, so far as it applies to that operator.

(4) There is no requirement for an operator who has referred a retention notice
under subsection (1) to comply with the notice, so far as referred, until the
Secretary of State has reviewed the notice in accordance with subsection (5).

(5) 10The Secretary of State must review any notice so far as referred to the Secretary
of State under subsection (1).

(6) Before deciding the review, the Secretary of State must consult—

(a) the Technical Advisory Board, and

(b) the Investigatory Powers Commissioner.

(7) 15The Board must consider the technical requirements and the financial
consequences, for the operator who has made the reference, of the notice so far
as referred.

(8) The Commissioner must consider whether the notice so far as referred is
proportionate.

(9) 20The Board and the Commissioner must—

(a) give the operator concerned and the Secretary of State the opportunity
to provide evidence, or make representations, to them before reaching
their conclusions, and

(b) report their conclusions to—

(i) 25the operator, and

(ii) the Secretary of State.

(10) The Secretary of State may, after considering the conclusions of the Board and
the Commissioner—

(a) vary or revoke the retention notice under section 89, or

(b) 30give a notice under this section to the operator concerned confirming its
effect.

(11) A report or notice under this section is given to an operator by giving or
publishing it in such manner as the Secretary of State considers appropriate for
bringing it to the attention of the operator.

(12) 35The Secretary of State must keep a retention notice under review (whether or
not referred under subsection (1)).

87 Data integrity and security

(1) A telecommunications operator who retains relevant communications data by
virtue of this Part must—

(a) 40secure that the data is of the same integrity, and subject to at least the
same security and protection, as the data on any system from which it
is derived,

(b) secure, by appropriate technical and organisational measures, that the
data can be accessed only by specially authorised personnel, and

Investigatory Powers BillPage 69

(c) protect, by appropriate technical and organisational measures, the data
against accidental or unlawful destruction, accidental loss or alteration,
or unauthorised or unlawful retention, processing, access or disclosure.

(2) A telecommunications operator who retains relevant communications data by
5virtue of this Part must destroy the data if the retention of the data ceases to be
authorised by virtue of this Part and is not otherwise authorised by law.

(3) The destruction of the data may take place at such monthly or shorter intervals
as appear to the operator to be practicable.

88 Disclosure of retained data

10A telecommunications operator must put in place adequate security systems
(including technical and organisational measures) governing access to relevant
communications data retained by virtue of this Part in order to protect against
any unlawful disclosure.

Variation or revocation of notices

89 15Variation or revocation of notices

(1) The Secretary of State may vary a retention notice.

(2) The Secretary of State must give, or publish, notice of the variation in such
manner as the Secretary of State considers appropriate for bringing the
variation to the attention of the telecommunications operator (or description of
20operators) to whom it relates.

(3) A variation comes into force—

(a) when notice of it is given or published in accordance with subsection
(2), or

(b) (if later) at the time or times specified in the notice of variation.

(4) 25A retention notice may not be varied so as to require the retention of additional
relevant communications data unless the Secretary of State considers that the
requirement is necessary and proportionate for one or more of the purposes
falling within paragraphs (a) to (j) of section 58(7) (purposes for which
communications data may be obtained).

(5) 30The fact that additional relevant communications data which would be
retained under a retention notice as varied relates to the activities in the British
Islands of a trade union is not, of itself, sufficient to establish that the
requirement to retain the data is necessary for one or more of the purposes
falling within paragraphs (a) to (j) of section 58(7).

(6) 35Section 84(2) and (4) apply in relation to a retention notice as varied as they
apply in relation to a retention notice, but as if the references to the notice
coming into force included references to the variation coming into force.

(7) Sections 84(3) and (7), 90 and 92, and subsections (1), (4), (10) and (13) of this
section, apply in relation to a retention notice as varied as they apply in relation
40to a retention notice.

(8) Section 85 applies in relation to the making of a variation as it applies in
relation to the giving of a retention notice.