The High Court ruled last week on the latest challenge against parts of the Investigatory Powers Act 2016.

There's relatively little to note, from a practical point of view, for telecommunications operators, if only because all bar one of Liberty's challenges were dismissed.

One challenge succeeded, and it is an important one, but, in practice, it is unlikely to have a material impact on telecommunications operators.

Prior independent authorisation for certain acquisitions of communications data by a security or intelligence service

The context

Today, s61 Investigatory Powers Act 2016 permits a security or intelligence service to obtain an internal authorisation from a designated senior officer to gain access to data for the “applicable crime purpose” (as opposed to one of the other statutory purposes).

The authorisation here is granted internally, by the designated senior officer, and not - unlike requests for authorisation in other cases - by the Office for Communications Data Authorisations (OCDA) on behalf of the Investigatory Powers Commissioner.

What the High Court held

The High Court held that, following case law of the CJEU, the Court of Appeal, the Divisional Court, this is impermissible:

When the security and intelligence agencies act for an ordinary criminal purpose, we cannot see any logical or practical reason why they should not be subject to the same legal regime as the police. The mere fact that in general they operate in the field of national security cannot suffice for this purpose.

And, crucially:

Prior authorisation by a court or independent administrative body is required for access under Part 3 to data retained under Part 4 [the data retention part of the Investigatory Powers Act 2016]. The ability of the security and intelligence agencies to obtain access to retained data for the “applicable crime purpose” by relying upon section 61 rather than section 60A is incompatible with retained EU law.

What next?

I suspect, absent an appeal, there will be a tweak to the Investigatory Powers Act 2016, to provide for independent authorisation of requests by security or intelligence agencies before obtaining communications data, retained under Part 4 Investigatory Powers Act 2016, for the applicable crime purpose.

The other two purposes - "in the interests of national security" and "in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security" - have been left untouched by this judgment, and do not require a tweak to mandate prior independent authorisation.

I also note that the High Court has - seemingly? - limited the finding of incompatibility to the acquisition by a security or intelligence service of communications data retained under [a data retention notice issued to a telecommunications operator under] Part 4.

If so, use of a Part 3 authorisation on the basis of internal authorisation for the applicable crime purpose would remain acceptable in respect of all communications data other than those retained by a telecommunications operator under a Part 4 data retention notice. For example, communications data held by telecommunications operators which have not been served with a Part 4 data retention notice, or for data which fall outside the scope of a Part 4 data retention notice (since these do not necessarily cover all communications data held by or available to a telecommunications operator).

If that is the correct scope of the judgment, then the Investigatory Powers Act 2016's authorisation regime could be further fragmented, with only some authorisations sought by a security or intelligence service for the applicable crime purpose needing prior independent authorisation, while others could still be granted on an internal basis by a designated senior officer.

There is unlikely to be an impact on telecommunications operators

While important, this decision is unlikely to have a material impact on telecommunications operators, whether it applies to all communications data or only communications data retained by a telecommunications operator under Part 4.

This is because it relates to what happens "behind the scenes" before a Part 3 authorisation or notice is served on a telecommunications operator.

The impact of a Part 3 authorisation or notice has not changed, nor has the obligation to provide data in response to a notice.

I suppose that it might have an impact in the short term on the volume of requests, if OCDA is to have an increased workload - presumably, if that is the case, there would be a plan to increase OCDA's staffing.

A reminder of other forthcoming revisions to the IPA / procedures under it

The judgment reminds readers of the Home Secretary's written statement from 31 March 2022, on how the Home Office intends to respond to the ECHR's decision in Big Brother Watch & others v UK, in respect of:

• use of so-called "strong selectors" in the context of the examination of bulk interception product, following prior internal (i.e. not independent / external) authorisation; and

• prior judicial authorisation where targeting with strong selectors using bulk interception will lead to the targeting of journalists or the acquisition and retention of confidential journalistic material.

Personally, I would like to see a few other changes to the Investigatory Powers Act 2016 too, but I suspect that the appetite for doing much in the way of revision is pretty limited at the moment.