Legalize / United Kingdom / Public General Act

Investigatory Powers Act 2016

Type Public General Act

Publication 2016-11-29

Last updated 2026-04-07

State In force

Department Statute Law Database

Source legislation.gov.uk

articles Not indexed

Reform history JSON API

(ii) conduct authorised by section 46 which is not conduct by or on behalf of an intercepting authority (within the meaning given by section 18(1)), or

(f) the exercise of any function which is subject to review by the Information Commissioner or the Investigatory Powers Commissioner for Northern Ireland.

(4A) In keeping matters under review in accordance with subsection (3)(e), the Investigatory Powers Commissioner must, in particular, keep under review the exercise of the power to grant or renew authorisations under section 29B of the Regulation of Investigatory Powers Act 2000.

(4B) In keeping under review the exercise of the power mentioned in subsection (4A), the Investigatory Powers Commissioner must, in particular, keep under review whether public authorities are complying with any requirements imposed on them by virtue of Part 2 of the Regulation of Investigatory Powers Act 2000 in relation to juvenile criminal conduct authorisations and vulnerable adult criminal conduct authorisations.

(4C) For the purposes of subsection (4B)—

(a) “a juvenile criminal conduct authorisation” is an authorisation under section 29B of the Regulation of Investigatory Powers Act 2000 where the covert human intelligence source to whom the authorisation relates is under the age of 18; and

(b) “a vulnerable adult criminal conduct authorisation” is an authorisation under section 29B of the Regulation of Investigatory Powers Act 2000 where the covert human intelligence source to whom the authorisation relates is a vulnerable adult within the meaning of section 29D(3) of that Act.

(5) In keeping matters under review in accordance with this section, the Investigatory Powers Commissioner must, in particular, keep under review the operation of safeguards to protect privacy.

(6) In exercising functions under this Act, a Judicial Commissioner must not act in a way which the Commissioner considers to be contrary to the public interest or prejudicial to—

(a) national security,

(b) the prevention or detection of serious crime, or

(7) A Judicial Commissioner must, in particular, ensure that the Commissioner does not—

(a) jeopardise the success of an intelligence or security operation or a law enforcement operation,

(b) compromise the safety or security of those involved, or

(c) unduly impede the operational effectiveness of an intelligence service, a police force, a government department or Her Majesty's forces.

(8) Subsections (6) and (7) do not apply in relation to any of the following functions of a Judicial Commissioner—

(a) deciding—

(i) whether to serve, vary or cancel a monetary penalty notice under section 7 or paragraph 16 of Schedule 1, a notice of intent under paragraph 4 of that Schedule or an information notice under Part 2 of that Schedule, or

(ii) the contents of any such notice,

(b) deciding whether to approve the issue, modification or renewal of a warrant,

(i) a warrant issued, or modification made, for what was considered to be an urgent need is not approved, or

(ii) an item subject to legal privilege is retained, following its examination, for purposes other than the destruction of the item,

(d) deciding whether to—

(i) approve the grant, modification or renewal of an authorisation, or

(ii) quash or cancel an authorisation or renewal,

(e) deciding whether to approve—

(i) the giving , varying or renewal of a retention notice under Part 4 or a notice under section 252 or 253, or

(ii) the giving of a notice under section 90(10)(b) or 257(9)(b),

(f) participating in a review under section 90 or 257,

(fa) deciding whether—

(i) to approve the use of criteria under section 154(2)(a),

(ii) subsection 154(8) applies for the purposes of subsection 154(6) and (7),

(iii) the relevant condition is met for the purposes of subsection 154A(3)(a).

(fb) deciding whether—

(i) to approve the use of criteria under section 195(2)(a),

(ii) subsection 195(8) applies for the purposes of subsection 195(6) and (7),

(iii) the relevant condition is met for the purposes of subsection 195A(3)(a).

(g) deciding whether to approve an authorisation under section 219(3)(b),

(h) deciding whether to give approval under section 222(4),

(i) deciding whether to approve the giving or varying of a direction under section 225(3),

(j) making a decision under section 231(1),

(k) deciding whether to order the destruction of records under section 103 of the Police Act 1997, section 37 of the Regulation of Investigatory Powers Act 2000 or section 15 of the Regulation of Investigatory Powers (Scotland) Act 2000,

(l) deciding whether to make an order under section 103(6) of the Police Act 1997 (order enabling the taking of action to retrieve anything left on property in pursuance of an authorisation),

(m) deciding—

(i) an appeal against, or a review of, a decision by another Judicial Commissioner, and

(ii) any action to take as a result.

(8A) Subsections (6) and (7) also do not apply in relation to the functions of the Investigatory Powers Commissioner under section 60A or 65(3B).

(9) In this section—

“bulk personal dataset” is to be read in accordance with section 199 (and includes a third party bulk personal dataset (see section 226E)),

“equipment data” has the same meaning as in Part 5 (see section 100),

“judicial authority” means a judge, court or tribunal or any person exercising the functions of a judge, court or tribunal (but does not include a Judicial Commissioner),

“police force” has the same meaning as in Part 2 (see section 60(1)),

“related systems data” has the meaning given by section 15(6),

“relevant Minister” means a Minister of the Crown or government department, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department,

“secondary data” has the same meaning as in Part 2 (see section 16).

Additional directed oversight functions

230

(1) So far as directed to do so by the Prime Minister and subject to subsection (2), the Investigatory Powers Commissioner must keep under review the carrying out of any aspect of the functions of—

(a) an intelligence service,

(b) a head of an intelligence service, ...

(d) any public authority not mentioned in paragraphs (a) to (c), or any part of such an authority, so far as engaging in intelligence activities.

(2) Subsection (1) does not apply in relation to anything which is required to be kept under review by the Investigatory Powers Commissioner under section 229.

(3) The Prime Minister may give a direction under this section at the request of the Investigatory Powers Commissioner or the Intelligence and Security Committee of Parliament or otherwise.

(4) The Prime Minister must publish, in a manner which the Prime Minister considers appropriate, any direction under this section (and any revocation of such a direction) except so far as it appears to the Prime Minister that such publication would be contrary to the public interest or prejudicial to—

(a) national security,

(b) the prevention or detection of serious crime,

(d) the continued discharge of the functions of any public authority whose activities include activities that are subject to review by the Investigatory Powers Commissioner.

Error reporting

231

(1) The Investigatory Powers Commissioner must inform a person of any relevant error relating to that person of which the Commissioner is aware if the Commissioner considers that—

(a) the error is a serious error, and

(b) it is in the public interest for the person to be informed of the error.

(2) In making a decision under subsection (1)(a), the Investigatory Powers Commissioner may not decide that an error is a serious error unless the Commissioner considers that the error has caused significant prejudice or harm to the person concerned.

(3) Accordingly, the fact that there has been a breach of a person's Convention rights (within the meaning of the Human Rights Act 1998) is not sufficient by itself for an error to be a serious error.

(4) In making a decision under subsection (1)(b), the Investigatory Powers Commissioner must, in particular, consider—

(a) the seriousness of the error and its effect on the person concerned, and

(b) the extent to which disclosing the error would be contrary to the public interest or prejudicial to—

(i) national security,

(ii) the prevention or detection of serious crime,

(iii) the economic well-being of the United Kingdom, or

(iv) the continued discharge of the functions of any of the intelligence services.

(5) Before making a decision under subsection (1)(a) or (b), the Investigatory Powers Commissioner must ask the public authority which has made the error to make submissions to the Commissioner about the matters concerned.

(6) When informing a person under subsection (1) of an error, the Investigatory Powers Commissioner must—

(a) inform the person of any rights that the person may have to apply to the Investigatory Powers Tribunal, and

(b) provide such details of the error as the Commissioner considers to be necessary for the exercise of those rights, having regard in particular to the extent to which disclosing the details would be contrary to the public interest or prejudicial to anything falling within subsection (4)(b)(i) to (iv).

(7) The Investigatory Powers Commissioner may not inform the person to whom it relates of a relevant error except as provided by this section.

(8) A report under section 234(1) must include information about—

(a) the number of relevant errors of which the Investigatory Powers Commissioner has become aware during the year to which the report relates,

(b) the number of relevant errors which the Commissioner has decided during that year were serious errors, and

(9) In this section “relevant error” means an error—

(a) by a public authority in complying with any requirements which are imposed on it by virtue of this Act or any other enactment and which are subject to review by a Judicial Commissioner, and

(b) of a description identified for this purpose in a relevant code of practice,

and the Investigatory Powers Commissioner must keep under review the definition of “relevant error”.

(10) In subsection (9) “relevant code of practice” means a code of practice under—

(a) Schedule 7,

(b) the Police Act 1997,

(d) the Regulation of Investigatory Powers (Scotland) Act 2000.

Additional functions under this Part

232

(1) A Judicial Commissioner must give the Investigatory Powers Tribunal all such documents, information and other assistance (including the Commissioner's opinion as to any issue falling to be determined by the Tribunal) as the Tribunal may require—

(a) in connection with the investigation of any matter by the Tribunal, or

(b) otherwise for the purposes of the Tribunal's consideration or determination of any matter.

(2) A Judicial Commissioner may provide advice or information to any public authority or other person in relation to matters for which a Judicial Commissioner is responsible.

(3) But a Judicial Commissioner must consult the Secretary of State before providing any advice or information under subsection (2) if it appears to the Commissioner that providing the advice or information might be contrary to the public interest or prejudicial to—

(a) national security,

(b) the prevention or detection of serious crime,

(d) the continued discharge of the functions of any public authority whose activities include activities that are subject to review by the Investigatory Powers Commissioner.

(4) In addition to consulting the Secretary of State under subsection (3), the Judicial Commissioner must also consult the Scottish Ministers if it appears to the Commissioner that providing the advice or information might be prejudicial to—

(a) the prevention or detection of serious crime by a Scottish public authority, or

(b) the continued discharge of any devolved functions of a Scottish public authority whose activities include activities that are subject to review by the Investigatory Powers Commissioner.

(5) In subsection (4)—

“devolved function” means a function that does not relate to reserved matters (within the meaning of the Scotland Act 1998), and

“Scottish public authority” has the same meaning as in the Scotland Act 1998.

(6) Subsections (3) and (4) do not apply to any advice or information provided under subsection (2) to the Investigatory Powers Tribunal.

Functions under other Parts and other enactments

233

(1) The Investigatory Powers Commissioner and the other Judicial Commissioners have the functions that are exercisable by them by virtue of any other Part of this Act or by virtue of any other enactment.

(2) In Part 3 of the Police Act 1997 (authorisations of action in respect of property: approval by Commissioners)—

(a) in sections 96(1), 103(7)(b) and (8), 104(3) to (8) and 105(1) and (2) for “Chief Commissioner” substitute “ Investigatory Powers Commissioner ”,

(b) in sections 96(1), 97(1)(a) and 103(1), (2), (4) and (5)(b) for “a Commissioner appointed under section 91(1)(b)” substitute “ a Judicial Commissioner ”,

(d) in section 103(7) for “a Commissioner” substitute “ a Judicial Commissioner (other than the Investigatory Powers Commissioner) ”,

(e) in section 104(1) for “Chief Commissioner” substitute “ Investigatory Powers Commissioner (except where the original decision was made by that Commissioner) ”,

(f) in section 104(3) and (8)(a) for “the Commissioner” substitute “ the Judicial Commissioner concerned ”,

(g) in section 105(1)(a)(ii) and (b)(ii) for “the Commissioner” substitute “ the Judicial Commissioner ”, and

(h) in sections 97(5) and 103(9) for “A Commissioner” substitute “ A Judicial Commissioner ”.

(3) In Part 2 of the Regulation of Investigatory Powers Act 2000 (surveillance and covert human intelligence sources: approval by Commissioners)—

(a) in sections 35(1) and (4), 36(2)(a) and (5) and 37(2) to (6) and (8) for “an ordinary Surveillance Commissioner”, wherever it appears, substitute “ a Judicial Commissioner ”,

(b) in sections 35(2)(b), 36(6)(g), 37(9)(b), 38(1) and (4) to (6) and 39(1), (2) and (4) and in the heading of section 39 for “Chief Surveillance Commissioner”, wherever it appears, substitute “ Investigatory Powers Commissioner ”,

(d) in section 37(8)(b) for “Chief Surveillance Commissioner” substitute “ Investigatory Powers Commissioner (if he is not that Commissioner) ”,

(e) in section 38(1)(a) for “an ordinary Surveillance Commissioner” substitute “ a Judicial Commissioner (other than the Investigatory Powers Commissioner) ”,

(f) in sections 38(5)(b) and 39(1)(b) for “ordinary Surveillance Commissioner” substitute “ Judicial Commissioner ”, and

(g) in the heading of section 38 for “Surveillance Commissioners” substitute “ Judicial Commissioners ”.

(4) In Part 3 of the Act of 2000 (investigation of electronic data protected by encryption etc.)—

(a) in section 51(6) (notification to Intelligence Services Commissioner or Chief Surveillance Commissioner of certain directions relating to the disclosure of a key to protected information) for the words from “done so” to the end substitute “ done so to the Investigatory Powers Commissioner ”,

(b) in section 54(9) (tipping-off: protected disclosures to a relevant Commissioner) for “relevant Commissioner” substitute “ Judicial Commissioner ”,

(c) in section 55(7) (court to have regard to opinion of a relevant Commissioner in certain circumstances relating to a disclosed key) for “relevant Commissioner” substitute “ Judicial Commissioner or the Investigatory Powers Commissioner for Northern Ireland ”, and

(d) omit sections 54(11) and 55(8) (definitions of “relevant Commissioner”).

(5) In the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp 11) (surveillance and covert human intelligence sources: approval by Commissioners and review by the Chief Commissioner)—

(a) in sections 13(1) and (4), 14(1)(a) and (4) and 15(1) to (5) and (7) for “an ordinary Surveillance Commissioner”, wherever it appears, substitute “ a Judicial Commissioner ”,

(b) in sections 13(2)(b), 15(8)(b), 16(1) and (4) to (6) and 17 and in the heading of section 17 for “Chief Surveillance Commissioner”, wherever it appears, substitute “ Investigatory Powers Commissioner ”,

(d) in section 15(7)(b) for “Chief Surveillance Commissioner” substitute “ Investigatory Powers Commissioner (if the Commissioner is not that Commissioner) ”,

(e) in section 16(1)(a) for “an ordinary Surveillance Commissioner” substitute “ a Judicial Commissioner (other than the Investigatory Powers Commissioner) ”,

(f) in sections 16(5)(b) and 17(1)(b) for “ordinary Surveillance Commissioner” substitute “ Judicial Commissioner ”, and

(g) in section 16(5) for “ordinary Surveillance Commissioner's” substitute “Judicial Commissioner's”.

(6) In Part 2 of the Regulation of Investigatory Powers (Covert Human Intelligence Sources: Relevant Sources) Order 2013 (S.I. 2013/2788) (notification of certain authorisations to, and approval of certain authorisations by, ordinary Surveillance Commissioner)—

(a) in article 4(1), for “an ordinary Surveillance Commissioner” substitute “ a Judicial Commissioner ”,

(b) in article 5(8) and the heading of Part 2, for “ordinary Surveillance Commissioner” substitute “ Judicial Commissioner ”,

(d) in article 6(1) for “an ordinary Surveillance Commissioner” substitute “ a Judicial Commissioner (other than the Investigatory Powers Commissioner) ”, and

(e) in the heading of article 6 for “Surveillance Commissioners” substitute “ Judicial Commissioners ”.

Reports and investigation and information powers

Annual and other reports

234

(1) The Investigatory Powers Commissioner must, as soon as reasonably practicable after the end of each calendar year, make a report to the Prime Minister about the carrying out of the functions of the Judicial Commissioners.

(2) A report under subsection (1) must, in particular, include—

(a) statistics on the use of the investigatory powers which are subject to review by the Investigatory Powers Commissioner (including the number of warrants or authorisations issued, given, considered or approved during the year),

(b) information about the results of such use (including its impact),

(ba) information about the use of the power to grant or renew authorisations under section 29B of the Regulation of Investigatory Powers Act 2000,

(c) information about the operation of the safeguards conferred by this Act in relation to items subject to legal privilege, confidential journalistic material and sources of journalistic information,

(d) information about the following kinds of warrants issued, considered or approved during the year—

(i) targeted interception warrants or targeted examination warrants of the kind referred to in section 17(2),

(ii) targeted equipment interference warrants relating to matters within paragraph (b), (c), (e), (f), (g) or (h) of section 101(1), and

(iii) targeted examination warrants under Part 5 relating to matters within any of paragraphs (b) to (e) of section 101(2),

(e) information about the operational purposes specified during the year in warrants issued under Part 6 or 7,

(f) the information on errors required by virtue of section 231(8),

(g) information about the work of the Technology Advisory Panel,

(h) information about the funding, staffing and other resources of the Judicial Commissioners, and

(i) details of public engagements undertaken by the Judicial Commissioners or their staff.

(3) The Investigatory Powers Commissioner must, at any time, make any report to the Prime Minister which has been requested by the Prime Minister.

(4) The Investigatory Powers Commissioner may, at any time, make any such report to the Prime Minister, on any matter relating to the functions of the Judicial Commissioners, as the Investigatory Powers Commissioner considers appropriate.

(5) A report under subsection (1) or (4) may, in particular, include such recommendations as the Investigatory Powers Commissioner considers appropriate about any matter relating to the functions of the Judicial Commissioners.

(6) On receiving a report from the Investigatory Powers Commissioner under subsection (1), the Prime Minister must—

(a) publish the report, and

(b) lay a copy of the published report before Parliament together with a statement as to whether any part of the report has been excluded from publication under subsection (7).

(7) The Prime Minister may, after consultation with the Investigatory Powers Commissioner and (so far as the report relates to functions under Part 3 of the Police Act 1997) the Scottish Ministers, exclude from publication any part of a report under subsection (1) if, in the opinion of the Prime Minister, the publication of that part would be contrary to the public interest or prejudicial to—

(a) national security,

(b) the prevention or detection of serious crime,

(d) the continued discharge of the functions of any public authority whose activities include activities that are subject to review by the Investigatory Powers Commissioner.

(8) The Prime Minister must send a copy of every report and statement as laid before Parliament under subsection (6)(b) to the Scottish Ministers and the Scottish Ministers must lay the copy report and statement before the Scottish Parliament.

(9) The Investigatory Powers Commissioner may publish any report under subsection (3) or (4), or any part of such a report, if requested to do so by the Prime Minister.

(10) Subsection (11) applies if the Prime Minister receives a report from the Investigatory Powers Commissioner under subsection (1) or (4) which relates to an investigation, inspection or audit carried out by the Commissioner following a decision to do so of which the Intelligence and Security Committee of Parliament was informed under section 236(2).

(11) The Prime Minister must send to the Intelligence and Security Committee of Parliament a copy of the report so far as it relates to—

(a) the investigation, inspection or audit concerned, and

(b) the functions of the Committee falling within section 2 of the Justice and Security Act 2013.

Investigation and information powers

235

(1) A Judicial Commissioner may carry out such investigations, inspections and audits as the Commissioner considers appropriate for the purposes of the Commissioner's functions.

(2) Every relevant person must disclose or provide to a Judicial Commissioner all such documents and information as the Commissioner may require for the purposes of the Commissioner's functions.

(3) Every relevant person must provide a Judicial Commissioner with such assistance as the Commissioner may require in carrying out any investigation, inspection or audit for the purposes of the Commissioner's functions.

(4) Assistance under subsection (3) may, in particular, include such access to apparatus, systems or other facilities or services as the Judicial Commissioner concerned may require in carrying out any investigation, inspection or audit for the purposes of the Commissioner's functions.

(5) A public authority may report to the Investigatory Powers Commissioner any refusal by a telecommunications operator or postal operator to comply with any requirements imposed by virtue of this Act.

(6) A public authority, telecommunications operator or postal operator must report to the Investigatory Powers Commissioner any relevant error (within the meaning given by section 231(9)) of which it is aware.

(7) In this section “relevant person” means—

(a) any person who holds, or has held, an office, rank or position with a public authority,

(b) any telecommunications operator or postal operator who is, has been or may become subject to a requirement imposed by virtue of this Act,

(c) any person who is, has been or may become subject to a requirement to provide assistance by virtue of section 41, 43, 126, 128, 149, 168, 170 or 190, or

(d) any person to whom a notice is given under section 49 of the Regulation of Investigatory Powers Act 2000.

Referrals by the Intelligence and Security Committee of Parliament

236

(1) Subsection (2) applies if the Intelligence and Security Committee of Parliament refers a matter to the Investigatory Powers Commissioner with a view to the Commissioner carrying out an investigation, inspection or audit into it.

(2) The Investigatory Powers Commissioner must inform the Intelligence and Security Committee of Parliament of the Commissioner's decision as to whether to carry out the investigation, inspection or audit.

Information gateway

237

(1) A disclosure of information to the Investigatory Powers Commissioner or another Judicial Commissioner for the purposes of any function of the Commissioner does not breach—

(a) an obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of information (whether imposed by virtue of this Act or otherwise).

(2) But subsection (1) does not apply to a disclosure, in contravention of any provisions of the data protection legislation, of personal data which is not exempt from those provisions.

(3) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).

Supplementary provision

Funding, staff and facilities etc.

238

(1) There is to be paid to the Judicial Commissioners out of money provided by Parliament such remuneration and allowances as the Treasury may determine.

(2) The Secretary of State must, after consultation with the Investigatory Powers Commissioner and subject to the approval of the Treasury as to numbers of staff, provide the Judicial Commissioners with—

(a) such staff, and

(b) such accommodation, equipment and other facilities and services,

as the Secretary of State considers necessary for the carrying out of the Commissioners' functions.

(3) The Scottish Ministers may pay to the Judicial Commissioners such allowances as the Scottish Ministers consider appropriate in respect of the exercise by the Commissioners of functions which relate to the exercise by Scottish public authorities of devolved functions.

(4) In subsection (3)—

“devolved function” means a function that does not relate to reserved matters (within the meaning of the Scotland Act 1998), and

“Scottish public authority” has the same meaning as in the Scotland Act 1998.

(5) The Investigatory Powers Commissioner or any other Judicial Commissioner may, to such extent as the Commissioner concerned may decide, delegate the exercise of functions of that Commissioner to any member of staff of the Judicial Commissioners or any other person acting on behalf of the Commissioners.

(6) Subsection (5) does not apply to—

(a) the function of the Investigatory Powers Commissioner of making a recommendation under section 227(4)(e) or making an appointment under section 227(6A), 228A(2) or 247(1),

(b) any function which falls within section 229(8), or

but, subject to this and the terms of the delegation, does include functions which have been delegated to a Judicial Commissioner by the Investigatory Powers Commissioner.

(7) The delegation under subsection (5) to any extent of functions by the Investigatory Powers Commissioner or any other Judicial Commissioner does not prevent the exercise of the functions to that extent by the Commissioner concerned.

Power to modify functions

239

(1) The Secretary of State may by regulations modify the functions of the Investigatory Powers Commissioner or any other Judicial Commissioner.

(2) But such regulations may not modify any function conferred by virtue of this Act on a Judicial Commissioner to approve, quash or cancel—

(a) an authorisation or warrant, or

(b) the variation or renewal of an authorisation or warrant.

(3) The power to make regulations under this section (including that power as extended by section 267(1)(c)) may, in particular, be exercised by modifying any provision made by or under an enactment (including this Act).

Abolition of existing oversight bodies

240

(1) The offices of the following are abolished—

(a) the Interception of Communications Commissioner,

(b) the Intelligence Services Commissioner,

(d) the other Surveillance Commissioners,

(e) the Scottish Chief Surveillance Commissioner, and

(f) the other Scottish Surveillance Commissioners.

(2) Accordingly, the following enactments are repealed—

(a) sections 57 and 58 of the Regulation of Investigatory Powers Act 2000 (the Interception of Communications Commissioner),

(b) sections 59, 59A and 60 of that Act (the Intelligence Services Commissioner),

(d) sections 2(1) to (9), 3 and 4 of the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp 11) (the Scottish Surveillance Commissioners).

(3) The Secretary of State may by regulations, with the consent of the Northern Ireland Assembly, provide for the abolition of the office of the Investigatory Powers Commissioner for Northern Ireland.

(4) The power to make regulations under subsection (3) (including that power as extended by section 267(1)(c)) may, in particular, be exercised by modifying any provision made by or under an enactment (including this Act).

(5) Regulations made by virtue of subsection (4) may, in particular, repeal—

(a) section 61 of the Regulation of Investigatory Powers Act 2000 (the Investigatory Powers Commissioner for Northern Ireland), and

(b) the words “or the Investigatory Powers Commissioner for Northern Ireland” in section 229(4)(f) of this Act.

(6) In this section—

“the Chief Surveillance Commissioner” means the Chief Commissioner appointed under section 91(1)(a) of the Police Act 1997,

“the other Scottish Surveillance Commissioners” means—the Surveillance Commissioners appointed under section 2(1)(b) of the Regulation of Investigatory Powers (Scotland) Act 2000, andthe Assistant Surveillance Commissioners appointed under section 3 of that Act,

“the other Surveillance Commissioners” means—the Commissioners appointed under section 91(1)(b) of the Police Act 1997, andthe Assistant Surveillance Commissioners appointed under section 63(1) of the Regulation of Investigatory Powers Act 2000,

“the Scottish Chief Surveillance Commissioner” means the Chief Surveillance Commissioner appointed under section 2(1)(a) of the Regulation of Investigatory Powers (Scotland) Act 2000.

CHAPTER 2 — Other arrangements

Codes of practice

241

Schedule 7 (codes of practice) has effect.

Investigatory Powers Tribunal

Right of appeal from Tribunal

242

(1) After section 67 of the Regulation of Investigatory Powers Act 2000 insert—

(67A) (1) A relevant person may appeal on a point of law against any determination of the Tribunal of a kind mentioned in section 68(4) or any decision of the Tribunal of a kind mentioned in section 68(4C). (2) Before making a determination or decision which might be the subject of an appeal under this section, the Tribunal must specify the court which is to have jurisdiction to hear the appeal (the “relevant appellate court”). (3) This court is whichever of the following courts appears to the Tribunal to be the most appropriate— (a) the Court of Appeal in England and Wales, (b) the Court of Session. (4) The Secretary of State may by regulations, with the consent of the Northern Ireland Assembly, amend subsection (3) so as to add the Court of Appeal in Northern Ireland to the list of courts mentioned there. (5) The Secretary of State may by regulations specify criteria to be applied by the Tribunal in making decisions under subsection (2) as to the identity of the relevant appellate court. (6) An appeal under this section— (a) is to be heard by the relevant appellate court, but (b) may not be made without the leave of the Tribunal or, if that is refused, of the relevant appellate court. (7) The Tribunal or relevant appellate court must not grant leave to appeal unless it considers that— (a) the appeal would raise an important point of principle or practice, or (b) there is another compelling reason for granting leave. (8) In this section— - “relevant appellate court” has the meaning given by subsection (2), - “relevant person”, in relation to any proceedings, complaint or reference, means the complainant or— 1. in the case of proceedings, the respondent, 2. in the case of a complaint, the person complained against, and 3. in the case of a reference, any public authority to whom the reference relates.

(2) In section 67 of that Act (no appeal from the Investigatory Powers Tribunal except as provided by order of the Secretary of State)—

(a) in subsection (8) for “Except to such extent as the Secretary of State may by order otherwise provide,” substitute “ Except as provided by virtue of section 67A, ”, and

(b) omit subsections (9) to (12).

(3) After section 68(4) of that Act (requirement to give notice of determinations to complainant) insert—

(4A) Where the Tribunal make any determination of a kind mentioned in subsection (4), they must also give notice to— (a) in the case of proceedings, the respondent, (b) in the case of a complaint, the person complained against, and (c) in the case of a reference, any public authority to whom the reference relates. (4B) A notice under subsection (4A) is (subject to any rules made by virtue of section 69(2)(j)) to be confined, as the case may be, to either— (a) a statement that they have made a determination in the complainant's favour, or (b) a statement that no determination has been made in the complainant's favour. (4C) Where the Tribunal make any decision which— (a) is a final decision of a preliminary issue in relation to any proceedings, complaint or reference brought before or made to them, and (b) is neither a determination of a kind mentioned in subsection (4) nor a decision relating to a procedural matter, they must give notice of that decision to every person who would be entitled to receive notice of the determination under subsection (4) or (4A). (4D) A notice under subsection (4C) is (subject to any rules made by virtue of section 69(2)(i) or (j)) to be confined to a statement as to what the decision is. (4E) Subsections (4C) and (4D) do not apply so far as— (a) the Tribunal are prevented from giving notice of a decision to a person by rules made by virtue of section 69(4) or decide under such rules not to give such a notice, or (b) the giving of such a notice is inconsistent with such rules.

(4) In section 69(2) of that Act (Tribunal rules)—

(a) in paragraph (i), after “section 68(4)” insert “ or notice under section 68(4C) ”, and

(b) after paragraph (i), insert

; (j) require information about any determination, award, order or other decision made by the Tribunal in relation to any proceedings, complaint or reference to be provided (in addition to any statement under section 68(4A) or notice under section 68(4C)) to— (i) in the case of proceedings, the respondent, (ii) in the case of a complaint, the person complained against, and (iii) in the case of a reference, any public authority to whom the reference relates, or to the person representing their interests; (k) make provision about the making and determination of applications to the Tribunal for permission to appeal

(5) In section 78 of that Act (orders, regulations and rules)—

(a) in subsection (4), after “applies” insert “ (other than regulations under section 67A(5)) ”, and

(b) after subsection (4) insert—

(4A) A statutory instrument containing regulations under section 67A(5) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

Functions of Tribunal in relation to this Act etc.

243

(1) In section 65 of the Regulation of Investigatory Powers Act 2000 (the Investigatory Powers Tribunal)—

(a) in subsection (2)(c) (jurisdiction of the Investigatory Powers Tribunal where possible detriment due to evidential bar) for “section 17” substitute “ section 56 of the Investigatory Powers Act 2016 ”,

(b) in subsection (5) (conduct in relation to which the Tribunal has jurisdiction) after paragraph (b) insert—

(ba) conduct for or in connection with the obtaining of secondary data from communications transmitted by means of such a service or system; (bb) the issue, modification, renewal or service of a warrant under Part 2 or Chapter 1 of Part 6 of the Investigatory Powers Act 2016 (interception of communications);

(c) conduct of a kind which may be permitted or required by an authorisation or notice under Part 3 of that Act or a warrant under Chapter 2 of Part 6 of that Act (acquisition of communications data); (cza) the giving of an authorisation or notice under Part 3 of that Act or the issue, modification, renewal or service of a warrant under Chapter 2 of Part 6 of that Act; (czb) conduct of a kind which may be required or permitted by a retention notice under Part 4 of that Act (retention of communications data) but excluding any conduct which is subject to review by the Information Commissioner; (czc) the giving or varying of a retention notice under that Part of that Act; (czd) conduct of a kind which may be required or permitted by a warrant under Part 5 or Chapter 3 of Part 6 of that Act (equipment interference); (cze) the issue, modification, renewal or service of a warrant under Part 5 or Chapter 3 of Part 6 of that Act; (czf) the issue, modification, renewal or service of a warrant under Part 7 of that Act (bulk personal dataset warrants); (czg) the giving of an authorisation under section 219(3)(b) (authorisation for the retention, or retention and examination, of material following expiry of bulk personal dataset warrant); (czh) the giving or varying of a direction under section 225 of that Act (directions where no bulk personal dataset warrant required); (czi) conduct of a kind which may be required by a notice under section 252 or 253 of that Act (national security or technical capability notices); (czj) the giving or varying of such a notice; (czk) the giving of an authorisation under section 152(5)(c) or 193(5)(c) of that Act (certain authorisations to examine intercepted content or protected material); (czl) any failure to— (i) cancel a warrant under Part 2, 5, 6 or 7 of that Act or an authorisation under Part 3 of that Act; (ii) cancel a notice under Part 3 of that Act; (iii) revoke a notice under Part 4, or section 252 or 253, of that Act; or (iv) revoke a direction under section 225 of that Act; (czm) any conduct in connection with any conduct falling within paragraph (c), (czb), (czd) or (czi);

(d) in subsection (6) (limitation for certain purposes of what is conduct falling within subsection (5))—

(i) after “on behalf of” insert “ an immigration officer or ”, and

(ii) after paragraph (d) insert—

(dza) the Competition and Markets Authority;

(e) after subsection (6) insert—

(6A) Subsection (6) does not apply to anything mentioned in paragraph (d) or (f) of subsection (5) which also falls within paragraph (czd) of that subsection.

(f) in subsection (7) after “if” insert “ it is conduct of a public authority and ”,

(g) in subsection (7ZA) (role for Tribunal where judicial authority involved) for “under section 23A or 32A” substitute “ by a Judicial Commissioner or under section 32A of this Act or section 75 of the Investigatory Powers Act 2016 ”,

(h) after subsection (7ZA) insert—

(7ZB) For the purposes of this section conduct also takes place in challengeable circumstances if it is, or purports to be, conduct falling within subsection (5)(bb), (cza), (czc), (cze), (czf), (czg), (czh), (czj), (czk) or (czl) or (so far as the conduct is, or purports to be, the giving of a notice under section 49) subsection (5)(e).

(i) in subsection (8) (matters that may be challenged before the Tribunal) for paragraphs (a) and (b) substitute—

(a) a warrant under Part 2, 5, 6 or 7 of the Investigatory Powers Act 2016; (b) an authorisation or notice under Part 3 of that Act; (ba) a retention notice under Part 4 of that Act; (bb) a direction under section 225 of that Act; (bc) a notice under section 252 or 253 of that Act;

, and

(j) after subsection (9) insert—

(9A) In subsection (5)(ba) the reference to obtaining secondary data from communications transmitted by means of a postal service or telecommunication system is to be read in accordance with section 16 of the Investigatory Powers Act 2016.

(2) In section 67(7) of the Act of 2000 (powers of the Tribunal)—

(a) after paragraph (a) insert—

(aza) an order quashing or cancelling a notice under Part 3 of the Investigatory Powers Act 2016 or a retention notice under Part 4 of that Act; (azb) an order quashing or revoking a direction under section 225 of that Act; (azc) an order quashing or revoking a notice under section 252 or 253 of that Act;

(b) in paragraph (aa) for “section 23A or 32A” substitute “ section 75 of the Investigatory Powers Act 2016 or section 32A of this Act ”, and

(c) in paragraph (b)(i) after “authorisation” insert “ or by a notice under Part 3 of the Investigatory Powers Act 2016 ”.

(3) In section 68(5)(b) of the Act of 2000 (report of certain findings to the Prime Minister) after “permission” insert “ , or notice under Part 4 of the Investigatory Powers Act 2016 or under section 252 or 253 of that Act or direction under section 225 of that Act, ”.

(4) In section 68(6)(b) of the Act of 2000 (disclosures etc. to the Tribunal to enable the exercise of functions conferred by or under that Act) after “this Act” insert “ or the Investigatory Powers Act 2016 ”.

(5) In section 68(7) of the Act of 2000 (persons subject to duty to co-operate with the Tribunal)—

(a) in paragraph (e)—

(i) for “section 11” substitute “ section 41, 126, 149, 168 or 190 of the Investigatory Powers Act 2016 ”, and

(ii) for “an interception warrant” substitute “ a warrant ”,

(b) in paragraph (f) for “section 12” substitute “ section 252 or 253 of that Act ”,

(g) every person by or to whom an authorisation under Part 3 of that Act has been granted; (h) every person to whom a notice under Part 3 of that Act has been given; (ha) every person to whom a retention notice under Part 4 of that Act or a notice under section 252 or 253 of that Act has been given;

(d) in paragraph (k), for the words from “an authorisation” to the end substitute

— (i) an authorisation under Part 3 of the Investigatory Powers Act 2016, Part 2 of this Act or Part 3 of the Police Act 1997, or (ii) a warrant under Chapter 2 of Part 6 of the Investigatory Powers Act 2016;

(e) in paragraph (l) after “authorisation” insert “ or warrant ”, and

(f) in paragraph (n) after “(h)” insert “ , (ha) ”.

(6) In section 68(8) of the Act of 2000 (meaning of “relevant Commissioner”) for the words from “Interception” to the end substitute “ Investigatory Powers Commissioner or any other Judicial Commissioner or the Investigatory Powers Commissioner for Northern Ireland ”.

Information Commissioner

Oversight by Information Commissioner in relation to Part 4

244

The Information Commissioner must audit compliance with requirements or restrictions imposed by virtue of Part 4 in relation to the integrity, security or destruction of data retained by virtue of that Part.

Advisory bodies

Technical Advisory Board

245

(1) There is to continue to be a Technical Advisory Board consisting of such number of persons appointed by the Secretary of State as the Secretary of State may by regulations provide.

(2) The regulations providing for the membership of the Technical Advisory Board must also make provision which is calculated to ensure—

(a) that the membership of the Board includes persons likely effectively to represent the interests of persons on whom obligations may be imposed by virtue of retention notices under Part 4, national security notices under section 252 or technical capability notices under section 253,

(b) that the membership of the Board includes persons likely effectively to represent the interests of persons entitled to apply for warrants under Part 2, 5, 6 or 7 or authorisations under Part 3,

(c) that such other persons (if any) as the Secretary of State considers appropriate may be appointed to be members of the Board, and

(d) that the Board is so constituted as to produce a balance between the representation of the interests mentioned in paragraph (a) and the representation of those mentioned in paragraph (b).

(3) Regulations under this section may also make provision about quorum and the filling of vacancies.

Technology Advisory Panel

246

(1) The Investigatory Powers Commissioner must ensure that there is a Technology Advisory Panel to provide advice to the Investigatory Powers Commissioner, the Secretary of State and the Scottish Ministers about—

(a) the impact of changing technology on the exercise of investigatory powers whose exercise is subject to review by the Commissioner, and

(b) the availability and development of techniques to use such powers while minimising interference with privacy.

(2) The Technology Advisory Panel must provide advice to the Investigatory Powers Commissioner about such matters falling within subsection (1)(a) or (b) as the Commissioner may direct.

(3) Subject to this, the Panel may provide advice to the Investigatory Powers Commissioner about such matters falling within subsection (1)(a) or (b) as it considers appropriate (whether or not requested to do so).

(4) The Panel may provide advice to the Secretary of State or the Scottish Ministers about such matters falling within subsection (1)(a) or (b) as it considers appropriate (whether or not requested to do so) but such advice to the Scottish Ministers may only relate to matters for which the Scottish Ministers are responsible.

(5) The Panel must, as soon as reasonably practicable after the end of each calendar year, make a report to the Investigatory Powers Commissioner about the carrying out of the functions of the Panel.

(6) The Panel must, at the same time, send a copy of the report to the Secretary of State and (so far as relating to matters for which the Scottish Ministers are responsible) the Scottish Ministers.

Members of the Panel

247

(1) The Investigatory Powers Commissioner must appoint such number of persons as members of the Technology Advisory Panel as the Commissioner considers necessary for the carrying out of the functions of the Panel.

(2) Subject as follows, each member of the Panel holds and vacates office in accordance with the member's terms and conditions of appointment.

(3) A member of the Panel must not act in a way which the member considers to be contrary to the public interest or prejudicial to—

(a) national security,

(b) the prevention or detection of serious crime, or

(4) A member of the Panel must, in particular, ensure that the member does not—

(a) jeopardise the success of an intelligence or security operation or a law enforcement operation,

(b) compromise the safety or security of those involved, or

(c) unduly impede the operational effectiveness of an intelligence service, a police force, a government department or Her Majesty's forces.

(5) Section 235(2) and (7) (information powers) apply to a member of the Panel as they apply to a Judicial Commissioner.

Part 9 — Miscellaneous and general provisions

CHAPTER 1 — Miscellaneous

Combined warrants and authorisations

Combination of warrants and authorisations

248

Schedule 8 (which makes provision for the combination of certain warrants and authorisations in a single instrument) has effect.

Compliance with Act

Payments towards certain compliance costs

249

(1) The Secretary of State must ensure that arrangements are in force for securing that telecommunications operators and postal operators receive an appropriate contribution in respect of such of their relevant costs as the Secretary of State considers appropriate.

(2) In subsection (1) “relevant costs” means costs incurred, or likely to be incurred, by telecommunications operators and postal operators in complying with this Act.

(3) The arrangements may provide for payment of a contribution to be subject to terms and conditions determined by the Secretary of State.

(4) Such terms and conditions may, in particular, include a condition on the operator concerned to comply with any audit that may reasonably be required to monitor the claim for costs.

(5) The arrangements may provide for the Secretary of State to determine—

(a) the scope and extent of the arrangements, and

(b) the appropriate level of contribution which should be made in each case.

(6) Different levels of contribution may apply for different cases or descriptions of case but the appropriate contribution must never be nil.

(7) A retention notice under Part 4 given to a telecommunications operator or a postal operator, or a national security notice under section 252 given to a telecommunications operator, must specify the level or levels of contribution which the Secretary of State has determined should be made in respect of the costs incurred, or likely to be incurred, by the operator as a result of the notice in complying with that Part or (as the case may be) with the national security notice.

(8) For the purpose of complying with this section the Secretary of State may make, or arrange for the making of, payments out of money provided by Parliament.

Power to develop compliance systems etc.

250

(1) The Secretary of State may—

(a) develop, provide, maintain or improve, or

(b) enter into financial or other arrangements with any person for the development, provision, maintenance or improvement of,

such apparatus, systems or other facilities or services as the Secretary of State considers appropriate for enabling or otherwise facilitating compliance by the Secretary of State, another public authority or any other person with this Act.

(2) Arrangements falling within subsection (1)(b) may, in particular, include arrangements consisting of the giving of financial assistance by the Secretary of State.

(3) Such financial assistance—

(a) may, in particular, be given by way of—

(i) grant,

(ii) loan,

(iii) guarantee or indemnity,

(iv) investment, or

(v) incurring expenditure for the benefit of the person assisted, and

(b) may be given subject to terms and conditions determined by the Secretary of State.

(4) Terms and conditions imposed by virtue of subsection (3)(b) may include terms and conditions as to repayment with or without interest.

Additional powers

Amendments of the Intelligence Services Act 1994

251

(1) The Intelligence Services Act 1994 is amended as follows.

(2) In section 3 (the Government Communications Headquarters)—

(a) in subsection (1)(a), after “monitor” insert “ , make use of ”, and

(b) in the words following subsection (1)(b)(ii), for the words from “or to any other organisation” to the end substitute “ or, in such cases as it considers appropriate, to other organisations or persons, or to the general public, in the United Kingdom or elsewhere. ”

(3) In section 5 (warrants: general)—

(a) in subsection (2), omit “, subject to subsection (3) below,”,

(b) omit subsection (3), and

(c) in subsection (3A), after “1989” insert “ , or on the application of the Intelligence Service or GCHQ for the purposes of the exercise of their functions by virtue of section 1(2)(c) or 3(2)(c), ”.

National security notices

252

(1) The Secretary of State may give any telecommunications operator in the United Kingdom a national security notice under this section if—

(a) the Secretary of State considers that the notice is necessary in the interests of national security,

(b) the Secretary of State considers that the conduct required by the notice is proportionate to what is sought to be achieved by that conduct, and

(2) A “national security notice” is a notice requiring the operator to take such specified steps as the Secretary of State considers necessary in the interests of national security.

(3) A national security notice may, in particular, require the operator to whom it is given—

(a) to carry out any conduct, including the provision of services or facilities, for the purpose of—

(i) facilitating anything done by an intelligence service under any enactment other than this Act, or

(ii) dealing with an emergency (within the meaning of Part 1 of the Civil Contingencies Act 2004);

(b) to provide services or facilities for the purpose of assisting an intelligence service to carry out its functions more securely or more effectively.

(4) In a case where—

(a) a national security notice would require the taking of any steps, and

(b) in the absence of such a notice requiring the taking of those steps, the taking of those steps would be lawful only if a warrant or authorisation under a relevant enactment had been obtained,

the notice may require the taking of those steps only if such a warrant or authorisation has been obtained.

(5) But the Secretary of State may not give any telecommunications operator a national security notice the main purpose of which is to require the operator to do something for which a warrant or authorisation under a relevant enactment is required.

(6) In this section “relevant enactment” means—

(a) this Act;

(b) the Intelligence Services Act 1994;

(d) the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp 11).

(7) A national security notice must specify such period as appears to the Secretary of State to be reasonable as the period within which the steps specified in the notice are to be taken.

(8) Conduct required by a national security notice is to be treated as lawful for all purposes (to the extent that it would not otherwise be so treated).

(9) Sections 254 to 258 contain further provision about national security notices.

Technical capability notices

253

(1) The Secretary of State may give a relevant operator a technical capability notice under this section if—

(a) the Secretary of State considers that the notice is necessary for securing that the operator or another relevant operator has the capability to provide any assistance which such operator may be required to provide in relation to any relevant authorisation,

(b) the Secretary of State considers that the conduct required by the notice is proportionate to what is sought to be achieved by that conduct, and

(2) A “technical capability notice” is a notice—

(a) imposing on the relevant operator (to whom the notice is given) any applicable obligations specified in the notice, and

(b) requiring the person to take all the steps specified in the notice for the purpose of complying with those obligations.

(3) In this section—

“applicable obligation”, in relation to a relevant operator of a particular description, means an obligation specified by the Secretary of State in regulations as an obligation that may be imposed on relevant operators, or on relevant operators of that description;

“relevant authorisation” means—any warrant issued under Part 2, 5 or 6, orany authorisation or notice given under Part 3;

“relevant operator” means—a postal operator,a telecommunications operator, ora person who is proposing to become a postal operator or a telecommunications operator.

(4) Regulations under this section may specify an obligation that may be imposed on any relevant operators only if the Secretary of State considers it is reasonable to do so for the purpose of securing—

(a) that it is (and remains) practicable to impose requirements on those relevant operators to provide assistance in relation to relevant authorisations, and

(b) that it is (and remains) practicable for those relevant operators to comply with those requirements.

(5) The obligations that may be specified in regulations under this section include, among other things—

(a) obligations to provide facilities or services of a specified description;

(b) obligations relating to apparatus owned or operated by a relevant operator;

(c) obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data;

(d) obligations relating to the security of any postal or telecommunications services provided by a relevant operator;

(e) obligations relating to the handling or disclosure of any information.

(6) Before making any regulations under this section, the Secretary of State must consult the following persons—

(a) the Technical Advisory Board,

(b) persons appearing to the Secretary of State to be likely to be subject to any obligations specified in the regulations,

(d) persons with statutory functions in relation to persons falling within that paragraph.

(7) A technical capability notice—

(a) must specify such period as appears to the Secretary of State to be reasonable as the period within which the steps specified in the notice are to be taken, and

(b) may specify different periods in relation to different steps.

(8) A technical capability notice may be given to persons outside the United Kingdom (and may require things to be done, or not to be done, outside the United Kingdom).

(9) Sections 254 to 258 contain further provision about technical capability notices.

Approval of notices by Judicial Commissioners

254

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) In deciding whether to approve a decision to give a relevant notice, a Judicial Commissioner must review the Secretary of State's conclusions as to the following matters—

(a) whether the notice is necessary as mentioned in section 252(1)(a) or (as the case may be) section 253(1)(a), and

(b) whether the conduct that would be required by the notice is proportionate to what is sought to be achieved by that conduct.

(3) In doing so, the Judicial Commissioner must—

(a) apply the same principles as would be applied by a court on an application for judicial review, and

(b) consider the matters referred to in subsection (2) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

(4) Where a Judicial Commissioner refuses to approve a decision to give a relevant notice, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.

(5) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to give a relevant notice, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to give the notice.

Further provision about notices under section 252 or 253

255

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) Before giving a relevant notice to a person, the Secretary of State must consult that person.

(3) Before giving a relevant notice, the Secretary of State must, among other matters, take into account—

(a) the likely benefits of the notice,

(b) the likely number of users (if known) of any postal or telecommunications service to which the notice relates,

(d) the likely cost of complying with the notice, and

(e) any other effect of the notice on the person (or description of person) to whom it relates.

(4) In the case of a technical capability notice that would impose any obligations relating to the removal by a person of electronic protection applied by or on behalf of that person to any communications or data, in complying with subsection (3) the Secretary of State must in particular take into account the technical feasibility, and likely cost, of complying with those obligations.

(5) A relevant notice must be in writing.

(5A) A relevant notice ceases to have effect at the end of the relevant period unless before the end of that period—

(a) it is varied in accordance with section 256(4)(c) or (5)(c) so as to impose further requirements on the person to whom the notice was given,

(b) it is renewed (see section 256A), or

(5B) In subsection (5A) the “relevant period” means the period of two years beginning with—

(a) in the case of a relevant notice that has not been varied as mentioned in subsection (5A)(a) or renewed, the day on which the notice was given, or

(b) in the case of a relevant notice that has been so varied or renewed, the day after the day at the end of which the relevant notice would have ceased to have effect if it had not been so varied or renewed.

(6) A technical capability notice may be given to a person outside the United Kingdom in any of the following ways (as well as by electronic or other means of giving a notice)—

(a) by delivering it to the person's principal office within the United Kingdom or, if the person has no such office in the United Kingdom, to any place in the United Kingdom where the person carries on business or conducts activities;

(b) if the person has specified an address in the United Kingdom as one at which the person, or someone on the person's behalf, will accept documents of the same description as a notice, by delivering it to that address.

(7) The Secretary of State may by regulations make further provision about the giving of relevant notices.

(8) A person to whom a relevant notice is given, or any person employed or engaged for the purposes of that person's business, must not disclose the existence or contents of the notice to any other person without the permission of the Secretary of State.

(9) A person to whom a relevant notice is given must comply with the notice.

(10) The duty imposed by subsection (8) or (9), or by section 257(3A), is enforceable—

(a) in relation to a person in the United Kingdom, and

(b) so far as relating to a technical capability notice within subsection (11), in relation to a person outside the United Kingdom,

by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.

(11) A technical capability notice is within this subsection if it relates to any of the following—

(a) a targeted interception warrant or mutual assistance warrant under Chapter 1 of Part 2;

(b) a bulk interception warrant;

(12) Subsection (9) applies to a person to whom a national security notice is given despite any other duty imposed on the person by or under Part 1, or Chapter 1 of Part 2, of the Communications Act 2003.

Variation and revocation of notices

256

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) The Secretary of State must keep each relevant notice under review.

(3) The Secretary of State may—

(a) vary a relevant notice;

(b) revoke a relevant notice (whether wholly or in part).

(4) The Secretary of State may vary a national security notice given to a person only if—

(a) the Secretary of State considers that the variation is necessary in the interests of national security,

(b) the Secretary of State considers that the conduct required by the notice as varied is proportionate to what is sought to be achieved by that conduct, and

(c) if the variation would impose further requirements on the person, the decision to vary the notice has been approved by a Judicial Commissioner (but see subsection (6)).

(5) The Secretary of State may vary a technical capability notice given to a person only if—

(a) the Secretary of State considers that the variation is necessary for securing that the person has the capability to provide any assistance which the person may be required to provide in relation to any relevant authorisation (within the meaning of section 253),

(b) the Secretary of State considers that the conduct required by the notice as varied is proportionate to what is sought to be achieved by that conduct, and

(c) if the variation would impose further requirements on the person, the decision to vary the notice has been approved by a Judicial Commissioner (but see subsection (6)).

(6) The condition in subsection (4)(c) or (as the case may be) subsection (5)(c) does not apply in the case of a variation to which section 257(10) applies.

(7) If the Secretary of State varies or revokes a relevant notice given to any person, the Secretary of State must give that person notice of the variation or revocation.

(8) Section 254 (approval of notices by Judicial Commissioners) applies in relation to a decision to vary a relevant notice (other than a decision to which section 257(10) applies) as it applies in relation to a decision to give a relevant notice, but as if—

(a) the reference in section 254(2)(a) to the notice were to the variation, and

(b) the reference in section 254(2)(b) to the notice were to the notice as varied.

(9) Subsections (2) to (4) and (7) of section 255 apply in relation to varying or revoking a relevant notice as they apply in relation to giving a relevant notice (and in the application of section 255(3) and (4) in relation to varying a relevant notice, references to the notice are to be read as references to the notice as varied).

(10) Subsections (5) and (6) of section 255 apply to any notice of the variation or revocation of a relevant notice as they apply to a relevant notice.

(11) The fact that a relevant notice has been revoked in relation to a particular person (or description of persons) does not prevent the giving of another relevant notice of the same kind in relation to the same person (or description of persons).

(12) Any reference in this section or section 255(8) to (12) to a notice given under section 252 or 253 includes a reference to such a notice as varied under this section.

Review of notices by the Secretary of State

257

(1) A person who is given a notice under section 252 or 253 may, within such period or circumstances as may be provided for by regulations made by the Secretary of State, refer the notice back to the Secretary of State.

(2) Such a reference may be in relation to the whole of a notice or any aspect of it.

(3) Where a person who is given a notice under section 252 or 253 refers the notice under subsection (1)—

(a) there is no requirement for the person to comply with the notice, so far as referred, and

(b) subsection (3A) applies to the person,

until the Secretary of State has reviewed the notice in accordance with subsection (4).

(3A) Where this subsection applies to a person, the person must not make any relevant changes to telecommunications or postal services, or telecommunication systems, to which obligations imposed by the notice given under section 252 or 253 relate.

(3B) In subsection (3A) “relevant change” means a change that, if implemented, would have a negative effect on the capability of the person to provide any assistance which the person may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act.

(4) The Secretary of State must , before the end of the review period, review any notice so far as referred to the Secretary of State under subsection (1) (and accordingly decide what action to take under subsection (9)).

(4A) In subsection (4) “the review period” means—

(a) such period as may be provided for by regulations made by the Secretary of State, or

(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (13)), such extended period.

(5) Before deciding the review, the Secretary of State must consult—

(a) the Technical Advisory Board, and

(b) a Judicial Commissioner.

(6) The Board must consider the technical requirements and the financial consequences, for the person who has made the reference, of the notice so far as referred.

(7) The Commissioner must consider whether the notice so far as referred is proportionate.

(8) The Board and the Commissioner must—

(a) give the person concerned and the Secretary of State the opportunity to provide evidence, or make representations, to them before reaching their conclusions, and

(b) report their conclusions to—

(i) the person, and

(ii) the Secretary of State.

(8A) The Commissioner may give a direction to the person concerned or the Secretary of State specifying the period within which the person or the Secretary of State (as the case may be) may provide evidence, or make representations, in accordance with subsection (8)(a).

(8B) If the Commissioner gives such a direction to the person or the Secretary of State, the Board and the Commissioner are not required to take into account any evidence provided, or representations made, by the person or the Secretary of State (as the case may be) after the end of that period.

(9) The Secretary of State must, after considering the conclusions of the Board and the Commissioner but before the end of the relevant period, decide whether to—

(a) vary or revoke the notice under section 256, or

(b) give a notice under this section to the person confirming its effect.

(10) But the Secretary of State may vary the notice, or give a notice under subsection (9)(b) confirming its effect, only if the Secretary of State's decision to do so has been approved by the Investigatory Powers Commissioner.

(10A) In subsection (9) “the relevant period” means—

(a) such period as may be provided for by regulations made by the Secretary of State, or

(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (14)), such extended period.

(11) Subsections (5) to (8) of section 255 apply in relation to a notice under subsection (9)(b) above as they apply in relation to a notice under section 252 or 253.

(12) Any reference in this section or section 258 to a notice under section 252 or 253 includes such a notice as varied under section 256, but only so far as the variation is concerned.

But it does not include a notice varied as mentioned in subsection (9)(a) above.

(13) Regulations under subsection (4A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State where the extension is agreed by the Secretary of State, the person concerned and a Judicial Commissioner.

(14) Regulations under subsection (10A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State—

(a) where the Secretary of State considers that there are exceptional circumstances that justify the extension, or

(b) in any other circumstances specified in the regulations.

(15) Where regulations under subsection (10A)(a) include provision mentioned in subsection (14), the regulations must also include provision requiring the Secretary of State to notify a Judicial Commissioner and the person concerned of the duration of any extended period.

Approval of notices following review under section 257

258

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) In deciding whether to approve a decision to vary a relevant notice as mentioned in section 257(9)(a), or to give a notice under section 257(9)(b) confirming the effect of a relevant notice, the Investigatory Powers Commissioner must review the Secretary of State's conclusions as to the following matters—

(a) whether the relevant notice as varied or confirmed is necessary as mentioned in section 252(1)(a) or (as the case may be) section 253(1)(a), and

(b) whether the conduct required by the relevant notice, as varied or confirmed, is proportionate to what is sought to be achieved by that conduct.

(3) In doing so, the Investigatory Powers Commissioner must—

(a) apply the same principles as would be applied by a court on an application for judicial review, and

(b) consider the matters referred to in subsection (2) with a sufficient degree of care as to ensure that the Investigatory Powers Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

(4) Where the Investigatory Powers Commissioner refuses to approve a decision to vary a relevant notice as mentioned in section 257(9)(a), or to give a notice under section 257(9)(b) confirming the effect of a relevant notice, the Investigatory Powers Commissioner must give the Secretary of State written reasons for the refusal.

Wireless telegraphy

Amendments of the Wireless Telegraphy Act 2006

259

(1) The Wireless Telegraphy Act 2006 is amended as follows.

(2) Section 48 (interception and disclosure of messages) is amended as follows.

(3) In subsection (1), for “otherwise than under the authority of a designated person” substitute “ without lawful authority ”.

(4) After subsection (3) insert—

(3A) A person does not commit an offence under this section consisting in any conduct if the conduct— (a) constitutes an offence under section 3(1) of the Investigatory Powers Act 2016 (offence of unlawful interception), or (b) would do so in the absence of any lawful authority (within the meaning of section 6 of that Act).

(5) Omit subsection (5).

(6) Omit section 49 (interception authorities).

(7) In consequence of the repeal made by subsection (6)—

(a) in sections 50(5) and 119(2)(a), for “49” substitute “ 48 ”;

(b) in section 121(2), omit paragraph (b).

CHAPTER 2 — General

Review of operation of Act

260

(1) The Secretary of State must, within the period of 6 months beginning with the end of the initial period, prepare a report on the operation of this Act.

(2) In subsection (1) “the initial period” is the period of 5 years and 6 months beginning with the day on which this Act is passed.

(3) In preparing the report under subsection (1), the Secretary of State must, in particular, take account of any report on the operation of this Act made by a Select Committee of either House of Parliament (whether acting alone or jointly).

(4) The Secretary of State must—

(a) publish the report prepared under subsection (1), and

(b) lay a copy of it before Parliament.

Interpretation

Telecommunications definitions

261

(1) The definitions in this section have effect for the purposes of this Act.

Communication2“Communication”, in relation to a telecommunications operator, telecommunications service or telecommunication system, includes—aanything comprising speech, music, sounds, visual images or data of any description, andbsignals serving either for the impartation of anything between persons, between a person and a thing or between things or for the actuation or control of any apparatus.

Entity data3“Entity data” means any data which—ais about—ian entity,iian association between a telecommunications service and an entity, oriiian association between any part of a telecommunication system and an entity,bconsists of, or includes, data which identifies or describes the entity (whether or not by reference to the entity's location), andcis not events data.

Events data4“Events data” means any data which identifies or describes an event (whether or not by reference to its location) on, in or by means of a telecommunication system where the event consists of one or more entities engaging in a specific activity at a specific time.

Communications data5“Communications data”, in relation to a telecommunications operator, telecommunications service or telecommunication system, means entity data or events data—awhich is (or is to be or is capable of being) held or obtained by, or on behalf of, a telecommunications operator and—iis about an entity to which a telecommunications service is provided and relates to the provision of the service,iiis comprised in, included as part of, attached to or logically associated with a communication (whether by the sender or otherwise) for the purposes of a telecommunication system by means of which the communication is being or may be transmitted, oriiidoes not fall within sub-paragraph (i) or (ii) but does relate to the use of a telecommunications service or a telecommunication system,bwhich is available directly from a telecommunication system and falls within sub-paragraph (ii) of paragraph (a), orcwhich—iis (or is to be or is capable of being) held or obtained by, or on behalf of, a telecommunications operator,iiis about the architecture of a telecommunication system, andiiiis not about a specific person,but (subject to subsection (5A)) does not include any content of a communication or anything which, in the absence of subsection (6)(b), would be content of a communication.5AIn subsection (5) the words after paragraph (c) do not apply to relevant subscriber data.5BIn subsection (5A) “relevant subscriber data” means entity data, other than data comprised in a recording of speech, which—aconstitutes any or all of the content of a communication made for the purpose of initiating or maintaining an entity’s access to a telecommunications service, andbis about an entity to which that telecommunications service is (or is to be) provided.

Content of a communication6“Content”, in relation to a communication and a telecommunications operator, telecommunications service or telecommunication system, means any element of the communication, or any data attached to or logically associated with the communication, which reveals anything of what might reasonably be considered to be the meaning (if any) of the communication, but—aany meaning arising from the fact of the communication or from any data relating to the transmission of the communication is to be disregarded, andbanything which is systems data is not content.

Other definitions7“Entity” means a person or thing.8“Public telecommunications service” means any telecommunications service which is offered or provided to the public, or a substantial section of the public, in any one or more parts of the United Kingdom.9“Public telecommunication system” means a telecommunication system located in the United Kingdom—aby means of which any public telecommunications service is provided, orbwhich consists of parts of any other telecommunication system by means of which any such service is provided.10“Telecommunications operator” means a person who—aoffers or provides a telecommunications service to persons in the United Kingdom, ...bcontrols or provides a telecommunication system which is (wholly or partly)—iin the United Kingdom, oriicontrolled from the United Kingdom, orccontrols or provides a telecommunication system which—iis not (wholly or partly) in, or controlled from, the United Kingdom, andiiis used by another person to offer or provide a telecommunications service to persons in the United Kingdom.11“Telecommunications service” means any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system (whether or not one provided by the person providing the service).12For the purposes of subsection (11), the cases in which a service is to be taken to consist in the provision of access to, and of facilities for making use of, a telecommunication system include any case where a service consists in or includes facilitating the creation, management or storage of communications transmitted, or that may be transmitted, by means of such a system.13“Telecommunication system” means a system (including the apparatus comprised in it) that exists (whether wholly or partly in the United Kingdom or elsewhere) for the purpose of facilitating the transmission of communications by any means involving the use of electrical or electromagnetic energy.14“Private telecommunication system” means any telecommunication system which—ais not a public telecommunication system,bis attached, directly or indirectly, to a public telecommunication system (whether or not for the purposes of the communication in question), andcincludes apparatus which is both located in the United Kingdom and used (with or without other apparatus) for making the attachment to that public telecommunication system.

Postal definitions

262

(1) The definitions in this section have effect for the purposes of this Act.

Communication2“Communication”, in relation to a postal operator or postal service (but not in the definition of “postal service” in this section), includes anything transmitted by a postal service.

Communications data3“Communications data”, in relation to a postal operator or postal service, means—apostal data comprised in, included as part of, attached to or logically associated with a communication (whether by the sender or otherwise) for the purposes of a postal service by means of which it is being or may be transmitted,binformation about the use made by any person of a postal service (but excluding any content of a communication (apart from information within paragraph (a)), orcinformation not within paragraph (a) or (b) that is (or is to be or is capable of being) held or obtained by or on behalf of a person providing a postal service, is about those to whom the service is provided by that person and relates to the service so provided.

Postal data4“Postal data” means data which—aidentifies, or purports to identify, any person, apparatus or location to or from which a communication is or may be transmitted,bidentifies or selects, or purports to identify or select, apparatus through which, or by means of which, a communication is or may be transmitted,cidentifies, or purports to identify, the time at which an event relating to a communication occurs, ordidentifies the data or other data as data comprised in, included as part of, attached to or logically associated with a particular communication.For the purposes of this definition “data”, in relation to a postal item, includes anything written on the outside of the item.

Other definitions5“Postal item” means—aany letter, postcard or other such thing in writing as may be used by the sender for imparting information to the recipient, orbany packet or parcel.6“Postal operator” means a person providing a postal service to persons in the United Kingdom.7“Postal service” means a service that—aconsists in the following, or in any one or more of them, namely, the collection, sorting, conveyance, distribution and delivery (whether in the United Kingdom or elsewhere) of postal items, andbhas as its main purpose, or one of its main purposes, to make available, or to facilitate, a means of transmission from place to place of postal items containing communications.8“Public postal service” means a postal service that is offered or provided to the public, or a substantial section of the public, in any one or more parts of the United Kingdom.

General definitions

263

(1) In this Act—

“apparatus” includes any equipment, machinery or device (whether physical or logical) and any wire or cable,

“civil proceedings” means any proceedings in or before any court or tribunal that are not criminal proceedings,

“crime” means conduct which—constitutes one or more criminal offences, oris, or corresponds to, any conduct which, if it all took place in any one part of the United Kingdom, would constitute one or more criminal offences,

“criminal proceedings” includes proceedings before a court in respect of a service offence within the meaning of the Armed Forces Act 2006 (and references to criminal prosecutions are to be read accordingly),

“data” includes data which is not electronic data and any information (whether or not electronic),

“Deputy Investigatory Powers Commissioner” means a person appointed under section 227(6A) (and the expression is also to be read in accordance with section 227(13)(b)),

“destroy”, in relation to electronic data, means delete the data in such a way as to make access to the data impossible (and related expressions are to be read accordingly),

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.