Urgent: changes to communications data acquisition in the UK
The Investigatory Powers Act 2016 (Commencement No. 12) Regulations 2020 passed through Parliament yesterday.
The Regulations bring into force almost all of the remaining provisions in the Investigatory Powers Act 2016, but the key bit is that they bring into force the bits in the IP Act restricting which powers public authorities can use to obtain communications data.
They come into force tomorrow — 22nd July 2020 — which gives operators (and, perhaps, public authorities) very little time to prepare.
Which powers are no longer available?
The IP Act removes some specific powers, and places limits on others. Here's the breakdown of powers which are no longer available:
General powers Any general information power which— (a) would enable a public authority to secure the disclosure by a telecommunications operator of communications data without the consent of the operator, and (b) does not involve a court order or other judicial authorisation or warrant and is not a regulatory power.
A "general power" is any power to obtain information or documents (however expressed) which does not deal (whether alone or with other matters) specifically with telecommunications operators or any class of telecommunications operators. It does not cover IPA or RIPA powers.
A "regulatory power" is any power to obtain information or documents (however expressed) which is exercisable in connection with the regulation of telecommunications operators, telecommunications services or telecommunication systems. Again, it does not cover IPA or RIPA powers.
Regulatory powers A public authority can only use a regulatory power to obtain communications data if the authority cannot use a power under this IPA to secure the disclosure of the data.
Chapter II, Part 1, Regulation of Investigatory Powers 2000
This could probably sit under the "Specific powers" bit below but, because CD acquisition authorisations / notices under RIPA 2000 were commonplace, I thought it worth calling out specifically that these powers are removed from the statute book tomorrow.
The following specific powers are no longer available.
- s20 Health and Safety at Work etc. Act 1974
- ss2 Criminal Justice Act 1987
- ss29 Consumer Protection Act 1987
- ss71 Environmental Protection Act 1990
- ss109B Social Security Administration Act 1992
- ss109C Social Security Administration Act 1992
- ss103B Social Security Administration (Northern Ireland) Act 1992
- ss103C Social Security Administration (Northern Ireland) Act 1992
- ss175 Financial Services and Markets Act 2000
- sParagraph 19, Schedule 36, Finance Act 2008
- sRegulation 4 Prevention of Social Housing Fraud (Power to Require Information) (England) Regulations 2014
You can check Schedule 2 to the Investigatory Powers Act 2016 to see exactly how the modifications are made, if you are interested in that kind of thing.
I'm not sure if this power is available or not
There may be requests where it is unclear whether they are now prohibited or not — for example, whether something is a “general power” or a “regulatory power".
Telecoms operator clients (and those of you who want to become a client!) are welcome to get in touch so I can check these for you.