Investigatory Powers Act 2016

[^key-64c99cc91fc7f9ff5959431dc15cf8be]: S. 257(10A) inserted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 18(5)(f), 32(2); S.I. 2025/722, reg. 2(a)

[^key-014dbd693d21cd9d09ddb09a9f8b6220]: S. 257(13)-(15) inserted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 18(5)(g), 32(2); S.I. 2025/722, reg. 2(a)

[^key-9586b4b5fc61efbf47f9448eb1c36f83]: Words in s. 257(4) inserted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 18(5)(b)(i), 32(2); S.I. 2025/722, reg. 2(a)

[^key-4fbb0b21492aa2cf96daefafdd7f3ccc]: Words in s. 257(4) inserted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 18(5)(b)(ii), 32(2); S.I. 2025/722, reg. 2(a)

[^key-5cd348fed186277dfd444ab95ea428f0]: Word in s. 257(9) substituted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 18(5)(e)(i), 32(2); S.I. 2025/722, reg. 2(a)

[^key-80ec0b510b4dc4b86f94b94a3ed43dd1]: Words in s. 257(9) inserted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 18(5)(e)(ii), 32(2); S.I. 2025/722, reg. 2(a)

[^key-b8891af0a6682568b38e071fc6c4c2d7]: Words in s. 267(3)(e) inserted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 18(6)(a), 32(2); S.I. 2025/722, reg. 2(a)

[^key-cfb9a806f1c2507e0f4a95a80eae12a0]: Word in s. 267(3) omitted (20.6.2025) by virtue of Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 21(3)(a), 32(2); S.I. 2025/722, reg. 2(b)

[^key-6c4f72f9b65020767671a5a04eebd811]: S. 267(3)(ja) inserted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 21(3)(b), 32(2); S.I. 2025/722, reg. 2(b)

[^key-ac4625fa254b340c7486894dadc746a8]: Words in s. 267(3)(j) inserted (20.6.2025) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 18(6)(b), 32(2); S.I. 2025/722, reg. 2(a)

[^key-1ed649e81e927f592509661bde832336]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(2)

[^key-2ae55f78d8ec427e8c958cc3e58ad858]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(3)

[^key-73b6f8f0b3460a9e87559c86457150bc]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(4)

[^key-77caeaa2a3383187cbc8880ddb98a030]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(5)

[^key-499383ca7b7a6e45e0f5f66743c99f79]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(6)

[^key-c1f1eac30f2c4cf4a2140fb730f315f8]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(7)

[^key-be72095099dc7b67f3fa2429473a4bfa]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(8)

[^key-31c0138b41196bc30954f0a0db3e8d53]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(9)

[^key-f01d67a8506b81357135a819c426114b]: Words in Sch. 4 Pt. 1 table inserted (8.7.2025) by The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(10)

[^key-34faab180969cc38065740619ee263e6]: Words in Sch. 4 Pt. 1 table omitted (8.7.2025) by virtue of The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(11)(a)

[^key-fc53fc3190c6542a687bbf5941d659ea]: Words in Sch. 4 Pt. 1 table omitted (8.7.2025) by virtue of The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(11)(b)

[^key-20f1c26d2b09d4d6e1632ea2794ad7b5]: Words in Sch. 4 Pt. 1 table omitted (8.7.2025) by virtue of The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(11)(c)

[^key-30cc6f95e64e08153c17006bbcfd48a5]: Words in Sch. 4 Pt. 1 table omitted (8.7.2025) by virtue of The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 2(11)(d)

[^key-eb23563c6445d0e9f43b3f7ff2f9d1e9]: Words in Sch. 4 Pt. 2 para. 1 omitted (8.7.2025) by virtue of The Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025 (S.I. 2025/808), regs. 1(1), 3

[^key-881bbea13e4ee81b50dd2aa19fcfe96a]: S. 202A inserted (19.6.2025 for specified purposes, 20.8.2025 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 74(12), 142(1)(2)(h); S.I. 2025/904, reg. 2(c)

[^key-d241e732c58df5751a51090f0df17135]: Words in s. 202(4) substituted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 74(11), 142(1); S.I. 2025/904, reg. 2(c)

[^key-d1d1709f3551042d44788352641c53e0]: S. 267(3)(ea) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 74(13), 142(1); S.I. 2025/904, reg. 2(c)

[^key-417a8555d2b8c6dd156c0271341acbb6]: Words in s. 199(2)(a) inserted (17.11.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 90(10), 142(1); S.I. 2025/996, reg. 2(2)(b)

[^key-60df6e1ec19143bfb505db1e237d1965]: Words in Sch. 4 Pt. 1 table inserted (1.4.2026) by Public Authorities (Fraud, Error and Recovery) Act 2025 (c. 28), ss. 6, 109(1) (with ss. 72, 105); S.I. 2026/371, reg. 2(a)

[^key-aa0600eefdd655e8c655f89f51351dc4]: Words in Sch. 4 Pt. 1 Table omitted (7.4.2026) by virtue of Employment Rights Act 2025 (c. 36), s. 159(3), Sch. 10 para. 88(2) (with s. 147 Sch. 11); S.I. 2026/323, reg. 4(1)(55)(e)

[^key-b98e65e7b208185069b77e998f5fd5da]: Words in Sch. 4 Pt. 1 table inserted (7.4.2026) by The Employment Rights Act 2025 (Investigatory Powers) (Consequential Amendments) Regulations 2026 (S.I. 2026/351), regs. 1(2)(a), 2(2)

[^key-da39de892d5feca4908f6c2128ed637d]: Sch. 10 para. 35 omitted (7.4.2026) by virtue of Employment Rights Act 2025 (c. 36), s. 159(3), Sch. 10 para. 88(3) (with s. 147 Sch. 11); S.I. 2026/323, reg. 4(1)(55)(e)

Offence of making unauthorised disclosure

Annual and other reports

Functions of Tribunal in relation to this Act etc.

Oversight by Information Commissioner in relation to Part 4

National security notices

Review of operation of Act

Commencement, extent and short title

Sanctions proceedings

9A

• (1) Section 56(1) does not apply in relation to any proceedings—

• (a) on an application under section 38 of the Sanctions and Anti-Money Laundering Act 2018 (court review of decisions), or

• (b) on a claim arising from any matter to which such an application relates,

or any proceedings arising out of such proceedings.

• (2) But sub-paragraph (1) does not permit the disclosure of anything to—

• (a) any person, other than the Secretary of State or the Treasury (as the case may be), who is or was a party to the proceedings, or

• (b) any person who—

• (i) represents such a person for the purposes of the proceedings, and

• (ii) does so otherwise than by virtue of appointment as a special advocate.

Targeted authorisations for obtaining data: the Investigatory Powers Commissioner

60A

• (1) Subsection (2) applies if the Investigatory Powers Commissioner, on an application made by a relevant public authority, considers—

• (a) that it is necessary for the relevant public authority to obtain communications data for a purpose falling within subsection (7),

• (b) that it is necessary for the relevant public authority to obtain the data—

• (i) for the purposes of a specific investigation or a specific operation, or

• (ii) for the purposes of testing, maintaining or developing equipment, systems or other capabilities relating to the availability or obtaining of communications data, and

• (c) that the conduct authorised by the authorisation is proportionate to what is sought to be achieved.

• (2) The Investigatory Powers Commissioner may authorise the relevant public authority to engage in any conduct which—

• (a) is for the purpose of obtaining the data from any person, and

• (b) relates to—

• (i) a telecommunication system, or

• (ii) data derived from a telecommunication system.

• (3) Subsections (1) and (2) are subject to—

• (a) section 62 (restrictions in relation to internet connection records),

• (b) sections 70, 73 and 75 and Schedule 4 (restrictions relating to certain relevant public authorities),

• (c) section 76 (requirement to consult a single point of contact), and

• (d) section 77 (Commissioner approval for authorisations to identify or confirm journalistic sources).

• (4) Authorised conduct may, in particular, consist of the relevant public authority—

• (a) obtaining the communications data itself from any person or telecommunication system,

• (b) asking any person whom the relevant public authority believes is, or may be, in possession of the communications data or capable of obtaining it—

• (i) to obtain the data (if not already in possession of it), and

• (ii) to disclose the data (whether already in the person’s possession or subsequently obtained by that person) to the relevant public authority, or

• (c) requiring by notice a telecommunications operator whom the relevant public authority believes is, or may be, in possession of the communications data or capable of obtaining it—

• (i) to obtain the data (if not already in possession of it), and

• (ii) to disclose the data (whether already in the operator’s possession or subsequently obtained by the operator) to the relevant public authority.

• (5) An authorisation—

• (a) may relate to data whether or not in existence at the time of the authorisation,

• (b) may authorise the obtaining or disclosure of data by a person other than the relevant public authority, or any other conduct by such a person, which enables or facilitates the obtaining of the communications data concerned, and

• (c) may, in particular, require a telecommunications operator who controls or provides a telecommunications system to obtain or disclose data relating to the use of a telecommunications service provided by another telecommunications operator in relation to that system.

• (6) An authorisation may not authorise any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system.

• (7) It is necessary to obtain communications data for a purpose falling within this subsection if it is necessary to obtain the data—

• (a) in the interests of national security,

• (b) for the applicable crime purpose (see subsection (8)),

• (c) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,

• (d) in the interests of public safety,

• (e) for the purpose of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health,

• (f) to assist investigations into alleged miscarriages of justice, or

• (g) where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition—

• (i) to assist in identifying P, or

• (ii) to obtain information about P’s next of kin or other persons connected with P or about the reasons for P’s death or condition.

• (8) In subsection (7)(b), “the applicable crime purpose” means—

• (a) where the communications data is wholly or partly events data, the purpose of preventing or detecting serious crime;

• (b) in any other case, the purpose of preventing or detecting crime or of preventing disorder.

• (9) The fact that the communications data which would be obtained in pursuance of an authorisation relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that it is necessary to obtain the data for a purpose falling within subsection (7).

• (10) See—

• (a) sections 70 and 73 for the meaning of “relevant public authority”;

• (b) section 84 for the way in which this Part applies to postal operators and postal services;

• (c) section 86(2A) for the meaning of “serious crime”.

61A

• (1) Subsection (2) applies if a designated senior officer of a relevant public authority considers—

• (a) that it is necessary to obtain communications data for a purpose falling within subsection (7),

• (b) that it is necessary to obtain the data for the purposes of a specific investigation or a specific operation,

• (c) that there is an urgent need to obtain the data, and

• (d) that the conduct authorised by the authorisation is proportionate to what is sought to be achieved.

• (2) The designated senior officer may authorise any officer of the relevant public authority to engage in any conduct which—

• (a) is for the purpose of obtaining the data from any person, and

• (b) relates to—

• (i) a telecommunication system, or

• (ii) data derived from a telecommunication system.

• (3) Subsections (1) and (2) are subject to—

• (a) section 62 (restrictions in relation to internet connection records),

• (b) sections 70, 73 and 75 and Schedule 4 (restrictions relating to certain relevant public authorities),

• (d) section 76 (requirement to consult a single point of contact), and

• (e) section 77 (Commissioner approval for authorisations to identify or confirm journalistic sources).

• (4) Authorised conduct may, in particular, consist of an authorised officer—

• (a) obtaining the communications data themselves from any person or telecommunication system,

• (b) asking any person whom the authorised officer believes is, or may be, in possession of the communications data or capable of obtaining it—

• (i) to obtain the data (if not already in possession of it), and

• (ii) to disclose the data (whether already in the person’s possession or subsequently obtained by that person) to a person identified by, or in accordance with, the authorisation, or

• (c) requiring by notice a telecommunications operator whom the authorised officer believes is, or may be, in possession of the communications data or capable of obtaining it—

• (i) to obtain the data (if not already in possession of it), and

• (ii) to disclose the data (whether already in the operator’s possession or subsequently obtained by the operator) to a person identified by, or in accordance with, the authorisation.

• (5) An authorisation—

• (a) may relate to data whether or not in existence at the time of the authorisation,

• (b) may authorise the obtaining or disclosure of data by a person who is not an authorised officer, or any other conduct by such a person, which enables or facilitates the obtaining of the communications data concerned, and

• (c) may, in particular, require a telecommunications operator who controls or provides a telecommunications system to obtain or disclose data relating to the use of a telecommunications service provided by another telecommunications operator in relation to that system.

• (6) An authorisation—

• (a) may not authorise any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system, and

• (b) may not authorise an authorised officer to ask or require, in the circumstances mentioned in subsection (4)(b) or (c), a person to disclose the data to any person other than—

• (i) an authorised officer, or

• (ii) an officer of the same relevant public authority as an authorised officer.

• (7) It is necessary to obtain communications data for a purpose falling within this subsection if it is necessary to obtain the data—

• (a) for the applicable crime purpose (see subsection (8)),

• (b) in the interests of public safety,

• (c) for the purpose of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health,

• (d) to assist investigations into alleged miscarriages of justice, or

• (e) where a person (“P”) has died or is unable to identify themselves because of a physical or mental condition—

• (i) to assist in identifying P, or

• (ii) to obtain information about P’s next of kin or other persons connected with P or about the reasons for P’s death or condition.

• (8) In subsection (7)(a), “the applicable crime purpose” means—

• (a) where the communications data is wholly or partly events data, the purpose of preventing or detecting serious crime;

• (b) in any other case, the purpose of preventing or detecting crime or of preventing disorder.

• (9) The fact that the communications data which would be obtained in pursuance of an authorisation relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that it is necessary to obtain the data for a purpose falling within subsection (7).

• (10) See—

• (a) sections 70 and 73 for the meanings of “designated senior officer” and “relevant public authority”;

• (b) section 84 for the way in which this Part applies to postal operators and postal services;

• (c) section 86(2A) for the meaning of “serious crime”.

Further provision about authorisations

Proceedings under Part 2 of the National Security Act 2023

8A

• (1) Section 56(1) does not apply in relation to—

• (a) any proceedings which are relevant proceedings within the meaning of Part 2 of the National Security Act 2023 (see section 62(1) of that Act), or

• (b) any proceedings arising out of any proceedings within paragraph (a).

• (2) But sub-paragraph (1) does not permit the disclosure of anything to—

• (a) any person, other than the Secretary of State, who is or was a party to the proceedings, or

• (b) any person who—

• (i) represents such a person for the purposes of the proceedings, and

• (ii) does so otherwise than by virtue of an appointment as a special advocate under Schedule 10 to the National Security Act 2023.

154A

• (1) This section applies where intercepted content or secondary data is selected for examination using criteria the use of which was approved by a senior official under section 154(2).

• (2) The Secretary of State must, as soon as reasonably practicable, inform the Investigatory Powers Commissioner that the approval has been given.

• (3) The Investigatory Powers Commissioner must, as soon as reasonably practicable—

• (a) consider whether the relevant condition is met as regards the use of the criteria for the selection of the intercepted content or secondary data for examination, and

• (b) notify the Secretary of State of their decision.

• (4) For this purpose, “the relevant condition” is that—

• (a) the public interest in obtaining the information that would be obtained by the selection of the intercepted content or secondary data for examination outweighs the public interest in the confidentiality of confidential journalistic material or sources of journalistic information, and

• (b) there are no less intrusive means by which the information may reasonably be obtained.

• (5) On the giving of a notification of a decision that the relevant condition is not met, the senior official’s approval ceases to have effect.

• (6) Nothing in subsection (5) affects the lawfulness of—

• (a) anything done by virtue of the approval before it ceases to have effect, or

• (b) if anything is in the process of being done by virtue of the approval when it ceases to have effect—

• (i) anything done before that thing could be stopped, or

• (ii) anything done which it is not reasonably practicable to stop.

Overview of Act

94A

• (1) If the renewal conditions are met, a retention notice may be renewed, at any time during the renewal period, by a notice given by the Secretary of State.

• (2) The renewal conditions are—

• (a) that the Secretary of State considers that the requirement in the retention notice for a telecommunications operator to retain relevant communications data is still necessary and proportionate for one or more of the purposes falling within sub-paragraphs (i) to (vi) of section 87(1)(a), and

• (b) that the decision to renew the notice has been approved by a Judicial Commissioner.

• (3) The renewal period means the period of 30 days ending with the day at the end of which the retention notice would otherwise cease to have effect.

• (4) The Secretary of State must give, or publish, notice of the renewal in such manner as the Secretary of State considers appropriate for bringing the renewal to the attention of the telecommunications operator (or description of operators) to whom it relates.

• (5) Sections 87(10), 88, 89 and 90 apply in relation to the renewal of a retention notice as they apply in relation to the giving of a retention notice.

195A

• (1) This section applies where material obtained under a bulk equipment interference warrant is selected for examination using criteria the use of which was approved by a senior official under section 195(2).

• (2) The Secretary of State must, as soon as reasonably practicable, inform the Investigatory Powers Commissioner that the approval has been given.

• (3) The Investigatory Powers Commissioner must, as soon as reasonably practicable—

• (a) consider whether the relevant condition is met as regards the use of the criteria for the selection of the material for examination, and

• (b) notify the Secretary of State of their decision.

• (4) For this purpose, “the relevant condition” is that—

• (a) the public interest in obtaining the information that would be obtained by the selection of the material for examination outweighs the public interest in the confidentiality of confidential journalistic material or sources of journalistic information, and

• (b) there are no less intrusive means by which the information may reasonably be obtained.

• (5) On the giving of a notification of a decision that the relevant condition is not met, the senior official’s approval ceases to have effect.

• (6) Nothing in subsection (5) affects the lawfulness of—

• (a) anything done by virtue of the approval before it ceases to have effect, or

• (b) if anything is in the process of being done by virtue of the approval when it ceases to have effect—

• (i) anything done before that thing could be stopped, or

• (ii) anything done which it is not reasonably practicable to stop.

Restriction on use of class BPD warrants etc

202A

• (1) The Secretary of State may by regulations—

• (a) make provision so that a description of Part 4 sensitive processing, or of processing that would be such processing if the information processed related to a living individual, is sensitive processing for the purposes of section 202, and

• (b) make provision so that added processing is not sensitive processing for the purposes of that section.

• (2) In this section—

• “added processing” means a description of processing that is sensitive processing for the purposes of section 202 by virtue of provision made under subsection (1)(a);

• “Part 4 sensitive processing” means processing of personal data that, at the time the regulations are made, is sensitive processing for the purposes of Part 4 of the Data Protection Act 2018 by virtue of regulations made under section 91A of that Act.

• (3) Regulations under this section may amend section 202.

Part 7A — Bulk personal dataset authorisations

Low or no reasonable expectation of privacy

226A

• (1) This section applies to a bulk personal dataset if the nature of the bulk personal dataset is such that the individuals to whom the personal data relates could have no, or only a low, reasonable expectation of privacy in relation to the data.

• (2) In considering whether this section applies to a bulk personal dataset, regard must be had to all the circumstances, including in particular the factors in subsection (3).

• (3) Those factors are—

• (a) the nature of the data;

• (b) the extent to which—

• (i) the data has been made public by the individuals, or

• (ii) the individuals have consented to the data being made public;

• (c) if the data has been published, the extent to which it was published subject to editorial control or by a person acting in accordance with professional standards;

• (d) if the data has been published or is otherwise in the public domain, the extent to which the data is widely known about;

• (e) the extent to which the data has already been used in the public domain.

Issue of authorisations

226B

• (1) In this Part “an individual authorisation” is an authorisation that authorises an intelligence service to retain, or to retain and examine, any bulk personal dataset described in the authorisation.

• (2) See section 200 (requirement for authorisation) for provision about when an individual authorisation under this Part is required.

• (3) The head of an intelligence service, or a person acting on their behalf, may grant an individual authorisation where the conditions in subsections (4) and (5) are met.

This is subject to subsection (6).

• (4) The condition in this subsection is that the person granting the authorisation considers that—

• (a) section 226A applies to the bulk personal dataset described in the authorisation,

• (b) the authorisation is necessary for the purpose of the exercise of any function of the intelligence service,

• (c) the conduct being authorised is proportionate to what is sought to be achieved by the conduct, and

• (d) there are for the time being in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section 226A applies and for protecting them from unauthorised disclosure.

• (5) The condition in this subsection is that the decision to grant the authorisation has been approved by a Judicial Commissioner.

• (6) The condition in subsection (5) does not apply where—

• (a) the bulk personal dataset described in the individual authorisation falls within a category of bulk personal datasets authorised for the purposes of this Part by a category authorisation (see section 226BA), or

• (b) the person granting the individual authorisation considers that there is an urgent need to grant the authorisation.

• (7) But subsection (6)(a) does not prevent a person granting an individual authorisation from seeking the approval of a Judicial Commissioner in a case where subsection (6)(a) applies if the person considers that it would be appropriate to seek such approval.

• (8) An individual authorisation relating to a bulk personal dataset (“dataset A”) may also authorise the retention or examination of other bulk personal datasets (“replacement datasets”) that do not exist at the time of the grant of the authorisation but may reasonably be regarded as replacements for dataset A.

226BA

• (1) In this Part “a category authorisation” is an authorisation that authorises a category of bulk personal datasets described in the authorisation for the purposes of this Part.

• (2) The head of an intelligence service, or a person acting on their behalf, may grant a category authorisation where—

• (a) they consider that section 226A applies to any dataset that falls within the category of datasets described in the authorisation, and

• (b) the decision to grant the authorisation has been approved by a Judicial Commissioner.

• (3) A category authorisation may describe a category of bulk personal datasets by reference to (among other things) the use to which the datasets will be put.

226BB

• (1) In deciding whether to approve a decision to grant an individual authorisation or a category authorisation, a Judicial Commissioner must review the conclusions of the person who granted the authorisation as to the following matters—

• (a) in relation to an individual authorisation, whether section 226A applies to the bulk personal dataset described in the authorisation, and

• (b) in relation to a category authorisation, whether section 226A applies to any dataset that falls within the category of datasets described in the authorisation.

• (2) In doing so, the Judicial Commissioner must—

• (a) apply the same principles as would be applied by a court on an application for judicial review, and

• (b) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

• (3) Where a Judicial Commissioner refuses to approve a decision to grant an individual authorisation or a category authorisation, the Judicial Commissioner must give the person who decided to grant the authorisation written reasons for the refusal.

• (4) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to grant an individual authorisation or a category authorisation, the head of the intelligence service, or a person acting on their behalf, may ask the Investigatory Powers Commissioner to decide whether to approve the decision to grant the authorisation.

226BC

• (1) This section applies where—

• (a) an individual authorisation is granted without the approval of a Judicial Commissioner, and

• (b) the person who granted the authorisation considered that there was an urgent need to grant it.

• (2) The person who granted the authorisation must inform a Judicial Commissioner that it has been granted.

• (3) The Judicial Commissioner must, before the end of the relevant period—

• (a) decide whether to approve the decision to grant the authorisation, and

• (b) notify the person who granted the authorisation of the Judicial Commissioner’s decision.

The “relevant period” means the period ending with the third working day after the day on which the authorisation was granted.

• (4) Subsections (5) to (7) apply if a Judicial Commissioner refuses to approve the decision to grant an individual authorisation.

• (5) The authorisation—

• (a) ceases to have effect (unless already cancelled), and

• (b) may not be renewed,

and section 226BB(4) does not apply in relation to the refusal to approve the decision.

• (6) The head of the intelligence service must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the authorisation stops as soon as possible.

• (7) Section 220 (Part 7 initial examinations: time limits) applies in relation to the bulk personal dataset described in the authorisation as if the intelligence service had obtained that dataset at the time when the person who granted the authorisation is notified that the Judicial Commissioner has refused to approve the decision to grant the authorisation.

• (8) Nothing in subsection (5) or (6) affects the lawfulness of—

• (a) anything done in reliance on the authorisation before it ceases to have effect;

• (b) if anything is in the process of being done in reliance on the authorisation when it ceases to have effect—

• (i) anything done before that thing could be stopped, or

• (ii) anything done that it is not reasonably practicable to stop.

Duration, renewal and cancellation

226C

• (1) An individual authorisation or a category authorisation ceases to have effect at the end of the relevant period unless—

• (a) it is renewed before the end of that period (see section 226CA), or

• (b) it is cancelled or otherwise ceases to have effect before the end of that period (see sections 226BC, 226CB, and 226CD).

• (2) In this section the “relevant period”—

• (a) in the case of an urgent individual authorisation, means the period ending with the fifth working day after the day on which the authorisation was granted;

• (b) in any other case, means the period of 12 months beginning with—

• (i) the day on which the authorisation was granted, or

• (ii) in the case of an authorisation that has been renewed, the day after the day at the end of which the authorisation would have ceased to have effect if it had not been renewed.

• (3) For the purposes of subsection (2)(a), an individual authorisation is an “urgent individual authorisation” if—

• (a) the authorisation was granted without the approval of a Judicial Commissioner, and

• (b) the person who granted the authorisation considered that there was an urgent need to grant it.

226CA

• (1) If the renewal conditions are met for an individual authorisation or a category authorisation, the head of an intelligence service, or a person acting on their behalf, may, at any time during the renewal period, renew the authorisation.

• (2) The renewal conditions for an individual authorisation are that—

• (a) the person renewing the authorisation considers that—

• (i) section 226A continues to apply to the bulk personal dataset described in the authorisation,

• (ii) the authorisation continues to be necessary for the purpose of the exercise of any function of the intelligence service,

• (iii) the conduct being authorised continues to be proportionate to what is sought to be achieved by the conduct, and

• (iv) there are for the time being in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section 226A applies and for protecting them from unauthorised disclosure, and

• (b) the decision to renew the authorisation has been approved by a Judicial Commissioner.

• (3) But the condition in subsection (2)(b) does not apply where the bulk personal dataset described in the individual authorisation falls within a category of bulk personal datasets authorised for the purposes of this Part by a category authorisation.

• (4) The renewal conditions for a category authorisation are that—

• (a) the person renewing the authorisation considers that section 226A continues to apply to any dataset that falls within the category of datasets described in the authorisation, and

• (b) the decision to renew the authorisation has been approved by a Judicial Commissioner.

• (5) In this section the “renewal period” means—

• (a) in the case of an urgent individual authorisation which has not been renewed, the relevant period;

• (b) in the case of an individual authorisation to which section 226CD (non-renewal or cancellation of category authorisation) applies, the period of three months ending with the day at the end of which the authorisation would otherwise cease to have effect;

• (c) in any other case, the period of 30 days ending with the day at the end of which the authorisation would otherwise cease to have effect.

• (6) Section 226BB (approval of authorisations by Judicial Commissioner) applies in relation to a decision to renew an authorisation under this section as it applies in relation to a decision to grant an authorisation under this Part.

• (7) In this section—

• “the relevant period” has the same meaning as in section 226C;

• “urgent individual authorisation” is to be read in accordance with subsection (3) of that section.

226CB

• (1) The head of an intelligence service, or a person acting on their behalf, may, at any time, cancel an individual authorisation or a category authorisation.

• (2) If the head of an intelligence service, or a person acting on their behalf, considers that any of the cancellation conditions are met in relation to an individual authorisation, or that the cancellation condition is met in relation to a category authorisation, they must cancel the authorisation.

• (3) The cancellation conditions for an individual authorisation are—

• (a) that section 226A no longer applies to the dataset described in the authorisation;

• (b) that the authorisation is no longer necessary for the purpose of the exercise of any function of the intelligence service;

• (c) that the conduct authorised by the authorisation is no longer proportionate to what is sought to be achieved by the conduct;

• (d) that there are no longer in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section 226A applies and for protecting them from unauthorised disclosure.

• (4) The cancellation condition for a category authorisation is that section 226A no longer applies to any dataset that falls within the category of datasets described in the authorisation.

226CC

• (1) This section applies where an individual authorisation ceases to have effect because it expires without having been renewed or because it is cancelled.

• (2) The head of the intelligence service, or a person acting on their behalf, may, before the end of the period of 5 working days beginning with the day on which the authorisation ceases to have effect, decide to grant a new individual authorisation (see section 226B) to retain, or to retain and examine, any material retained by the intelligence service in reliance on the authorisation which has ceased to have effect.

• (3) Where an individual authorisation ceases to have effect because it expires without having been renewed or because it is cancelled, an intelligence service is not to be regarded as in breach of section 200(1) or (2) by virtue of its retention or examination of any material to which the authorisation related during the following periods—

• (a) the period of 5 working days beginning with the day on which the authorisation ceases to have effect;

• (b) if the head of the intelligence service, or a person acting on their behalf, decides to grant a new individual authorisation as mentioned in subsection (2), any period when a Judicial Commissioner is deciding whether to approve the decision.

226CD

• (1) This section applies where—

• (a) a category authorisation ceases to have effect because it expires without having been renewed or because it is cancelled, and

• (b) an individual authorisation describing a bulk personal dataset that falls within the category of datasets described in the category authorisation has been granted without the approval of a Judicial Commissioner in accordance with section 226B(6)(a).

• (2) The individual authorisation ceases to have effect at the end of the relevant period unless—

• (a) it is renewed before the end of that period, or

• (b) it is cancelled or otherwise ceases to have effect before the end of that period.

• (3) In this section the “relevant period” means the period of three months beginning with the day after the day at the end of which the category authorisation ceased to have effect.

Further and supplementary provision

226D

• (1) Subsections (2) to (4) apply where—

• (a) an individual authorisation is granted under this Part in relation to any bulk personal dataset, and

• (b) in the course of examining the dataset in accordance with the authorisation, the head of the intelligence service, or a person acting on their behalf, believes that section 226A does not apply, or no longer applies, to part of the dataset.

• (2) The head of the intelligence service must, so far as is reasonably practicable, secure that anything in the process of being done in relation to that part of the bulk personal dataset in reliance on the authorisation stops as soon as possible.

• (3) Section 220 (Part 7 initial examinations: time limits) applies in relation to that part of the bulk personal dataset as if the intelligence service had obtained that part of the dataset at the time when the head of the intelligence service, or the person acting on their behalf, first formed the beliefs mentioned in subsection (1)(b).

• (4) The individual authorisation in relation to that part of the bulk personal dataset is to be treated as if it had been cancelled under section 226CB at that time.

• (5) Nothing in this section affects the lawfulness of—

• (a) anything done in reliance on the authorisation before it ceases to have effect;

• (b) if anything is in the process of being done in reliance on the authorisation when it ceases to have effect—

• (i) anything done before that thing could be stopped, or

• (ii) anything done that it is not reasonably practicable to stop.

226DA

• (1) The head of each intelligence service must provide an annual report to the Secretary of State about the bulk personal datasets that were authorised under this Part to be retained, or retained and examined, by the intelligence service during the period to which the report relates.

• (2) The first report must relate to a period of at least one year and no more than two years, beginning with the day on which this Part comes fully into force.

• (3) Subsequent reports must relate to a period of no more than one year, beginning with the end of the period to which the previous report related.

• (4) Each report must be provided to the Secretary of State as soon as reasonably practicable after the end of the period to which the report relates.

226DB

• (1) The Secretary of State must for each relevant period provide to the Intelligence and Security Committee of Parliament a report setting out information about category authorisations and renewals of category authorisations granted in that period.

• (2) In subsection (1) “relevant period” means—

• (a) a period of at least one year and no more than two years beginning with the date on which this Part comes fully into force, and

• (b) subsequent periods of no more than one year, beginning with the end of the period to which the previous report related.

• (3) Each report must be provided to the Committee as soon as reasonably practicable after the end of the period to which the report relates.

226DC

• (1) In this Part—

• “category authorisation” has the meaning given by section 226BA(1);

• “individual authorisation” has the meaning given by section 226B(1).

• (2) See also—

• section 199 (bulk personal datasets: interpretation),

• section 263 (general definitions),

• section 265 (index of defined expressions).

• (3) For the purposes of this Part, only a person holding office under the Crown may act on behalf of the head of an intelligence service.

Part 7B — Third party bulk personal datasets

Interpretation

226E

• (1) For the purposes of this Part, an intelligence service examines a third party bulk personal dataset if—

• (a) the intelligence service has relevant access, whether on payment or otherwise, to a set of information that is held electronically by a person other than an intelligence service,

• (b) the set includes personal data relating to a number of individuals,

• (c) the nature of the set is such that the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions, and

• (d) after any initial inspection of the contents (see section 226I), the intelligence service examines the set electronically (but does not obtain the set) for the purpose of the exercise of its functions.

• (2) For the purposes of subsection (1)(a), an intelligence service has “relevant access” to a set of information that is held electronically by another person where—

• (a) the access is made available to the intelligence service as a result of arrangements made directly between the intelligence service and that other person,

• (b) the type and extent of the access available to the intelligence service is not generally available (whether on a commercial basis or otherwise), and

• (c) the access is electronic.

Requirement for warrant

226F

• (1) An intelligence service may not exercise a power to examine a third party bulk personal dataset unless the examination of the dataset is authorised by a third party BPD warrant.

• (2) A “third party BPD warrant” is a warrant issued under this Part authorising an intelligence service to examine any third party bulk personal dataset described in the warrant.

• (3) A third party BPD warrant may authorise the examination of a bulk personal dataset—

• (a) the content of which may vary from time to time, or

• (b) that does not exist at the time of the issue of the warrant.

226FA

• (1) Section 226F(1) does not apply to the exercise of a power of an intelligence service to examine a third party bulk personal dataset if the intelligence service examines the bulk personal dataset under any other warrant or authorisation issued or given under this Act.

• (2) See section 226I(5) (initial inspection) for a further exception to 226F(1).

Issue of warrants

226G

• (1) The head of an intelligence service, or a person acting on their behalf, may apply to the Secretary of State for a third party BPD warrant.

• (2) The application must include a general description of the bulk personal dataset (or datasets) to which the application relates.

• (3) Where the person making the application knows that subsection (6) applies to any bulk personal dataset to which the application relates, the application must also include a statement to that effect.

• (4) The Secretary of State may issue the warrant if—

• (a) the Secretary of State considers that the warrant is necessary—

• (i) in the interests of national security,

• (ii) for the purposes of preventing or detecting serious crime, or

• (iii) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,

• (b) the Secretary of State considers that the conduct authorised by the warrant is proportionate to what is sought to be achieved by the conduct,

• (c) the Secretary of State considers that the arrangements made by the intelligence service for examining the bulk personal dataset (or datasets) to which the application relates are satisfactory, and

• (d) except where the Secretary of State considers that there is an urgent need to issue the warrant, the decision to issue the warrant has been approved by a Judicial Commissioner.

• (5) The fact that a third party BPD warrant would authorise the examination of bulk personal datasets relating to activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary on grounds falling within subsection (4)(a).

• (6) This subsection applies to a bulk personal dataset if—

• (a) the dataset consists of, or includes, protected data or health records,

• (b) a substantial proportion of the dataset consists of sensitive personal data, or

• (c) the nature of the dataset, or the circumstances in which it was created, is or are such that its examination by the intelligence service is likely to raise novel or contentious issues.

• (7) In this section—

• “health record” means a record, or a copy of a record which—consists of information relating to the physical or mental health or condition of an individual,was made by or on behalf of a health professional in connection with the care of that individual, andwas obtained, by the person (mentioned in section 226E(1)(a)) who holds the dataset, from a health professional or a health service body or from a person acting on behalf of a health professional or a health service body in relation to the record or the copy;

• “sensitive personal data” has the meaning given by section 202(4).

• (8) In subsection (7), “health professional” and “health service body” have the meaning given by section 206(7).

• (9) An application for a third party BPD warrant may only be made on behalf of the head of an intelligence service by a person holding office under the Crown.

226GA

• (1) In deciding whether to approve a decision to issue a third party BPD warrant, a Judicial Commissioner must review the Secretary of State’s conclusions as to the following matters—

• (a) whether the warrant is necessary on grounds falling within section 226G(4)(a), and

• (b) whether the conduct that would be authorised by the warrant is proportionate to what is sought to be achieved by that conduct.

• (2) In doing so, the Judicial Commissioner must—

• (a) apply the same principles as would be applied by a court on an application for judicial review, and

• (b) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

• (3) Where a Judicial Commissioner refuses to approve a decision to issue a third party BPD warrant, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.

• (4) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to issue a third party BPD warrant, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to issue the warrant.

226GB

• (1) This section applies where—

• (a) a third party BPD warrant is issued without the approval of a Judicial Commissioner, and

• (b) the Secretary of State considered that there was an urgent need to issue it.

• (2) The Secretary of State must inform a Judicial Commissioner that it has been issued.

• (3) The Judicial Commissioner must, before the end of the relevant period—

• (a) decide whether to approve the decision to issue the warrant, and

• (b) notify the Secretary of State of the Judicial Commissioner’s decision.

The “relevant period” means the period ending with the third working day after the day on which the warrant was issued.

• (4) Subsections (5) and (6) apply if a Judicial Commissioner refuses to approve the decision to issue a third party BPD warrant.

• (5) The warrant—

• (a) ceases to have effect (unless already cancelled), and

• (b) may not be renewed,

and section 226GA(4) does not apply in relation to the refusal to approve the decision.

• (6) The head of the intelligence service to whom the warrant was addressed must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the warrant stops as soon as possible.

• (7) Nothing in subsection (5) or (6) affects the lawfulness of—

• (a) anything done in reliance on the warrant before it ceases to have effect;

• (b) if anything is in the process of being done in reliance on the warrant when it ceases to have effect—

• (i) anything done before that thing could be stopped, or

• (ii) anything done that it is not reasonably practicable to stop.

226GC

• (1) The decision to issue a third party BPD warrant must be taken personally by the Secretary of State.

• (2) Before a third party BPD warrant is issued, it must be signed by the Secretary of State.

• (3) But if it is not reasonably practicable for a third party BPD warrant to be signed by the Secretary of State, it may be signed by a senior official designated by the Secretary of State for that purpose.

• (4) In such a case, the warrant must contain a statement that—

• (a) it is not reasonably practicable for the warrant to be signed by the Secretary of State, and

• (b) the Secretary of State has personally and expressly authorised the issue of the warrant.

226GD

A third party BPD warrant must—

• (a) be addressed to the head of the intelligence service by whom, or on whose behalf, the application for the warrant was made, and

• (b) include a general description of the bulk personal dataset (or datasets) to which the warrant relates.

Duration, renewal and cancellation

226H

• (1) A third party BPD warrant ceases to have effect at the end of the relevant period unless—

• (a) it is renewed before the end of that period (see section 226HA), or

• (b) it is cancelled or otherwise ceases to have effect before the end of that period (see sections 226GB and 226HB).

• (2) In this section “the relevant period”—

• (a) in the case of an urgent third party BPD warrant, means the period ending with the fifth working day after the day on which the warrant was issued, and

• (b) in any other case, means the period of 12 months beginning with—

• (i) the day on which the warrant was issued, or

• (ii) in the case of a warrant that has been renewed, the day after the day at the end of which the warrant would have ceased to have effect if it had not been renewed.

• (3) For the purposes of this section, a third party BPD warrant is an “urgent third party BPD warrant” if—

• (a) the warrant was issued without the approval of a Judicial Commissioner, and

• (b) the Secretary of State considered that there was an urgent need to issue it.

226HA

• (1) If the renewal conditions are met, a third party BPD warrant may be renewed, at any time during the renewal period, by an instrument issued by the Secretary of State.

• (2) The renewal conditions are—

• (a) that the Secretary of State considers that the warrant continues to be necessary on grounds falling within section 226G(4)(a),

• (b) that the Secretary of State considers that the conduct that would be authorised by the renewed warrant continues to be proportionate to what is sought to be achieved by the conduct, and

• (c) that the decision to renew the warrant has been approved by a Judicial Commissioner.

• (3) In this section the “renewal period” means—

• (a) in the case of an urgent third party BPD warrant which has not been renewed, the relevant period;

• (b) in any other case, the period of 30 days ending with the day at the end of which the warrant would otherwise cease to have effect.

• (4) The decision to renew a third party BPD warrant must be taken personally by the Secretary of State, and the instrument renewing the warrant must be signed by the Secretary of State.

• (5) Section 226GA (approval of warrants by Judicial Commissioner) applies in relation to a decision to renew a warrant as it applies in relation to a decision to issue a warrant.

• (6) In this section—

• “the relevant period” has the same meaning as in section 226H;

• “urgent third party BPD warrant” is to be read in accordance with subsection (3) of that section.

226HB

• (1) The Secretary of State, or a senior official acting on behalf of the Secretary of State, may cancel a third party BPD warrant at any time.

• (2) If the Secretary of State, or a senior official acting on behalf of the Secretary of State, considers that any of the cancellation conditions are met in relation to a third party BPD warrant, the person must cancel the warrant.

• (3) The cancellation conditions are—

• (a) that the warrant is no longer necessary on any grounds falling within section 226G(4)(a);

• (b) that the conduct authorised by the warrant is no longer proportionate to what is sought to be achieved by that conduct.

226HC

• (1) This section applies where a third party BPD warrant ceases to have effect because it expires without having been renewed or because it is cancelled.

• (2) The head of the intelligence service to whom the warrant was addressed must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the warrant stops as soon as possible.

• (3) Nothing in this section affects the lawfulness of—

• (a) anything done in reliance on the warrant before it ceases to have effect;

• (b) if anything is in the process of being done in reliance on the warrant when it ceases to have effect—

• (i) anything done before that thing could be stopped, or

• (ii) anything done that it is not reasonably practicable to stop.

Further and supplementary provision

226I

• (1) This section applies where—

• (a) an intelligence service has relevant access, whether on payment or otherwise, to a set of information that is held electronically by a person other than an intelligence service,

• (b) the intelligence service is considering examining the set of information electronically for the purpose of the exercise of its functions,

• (c) the examination would be otherwise than in the exercise of a power conferred by a warrant or other authorisation issued or given under this Act, and

• (d) the head of the intelligence service, or a person acting on their behalf, believes that—

• (i) the set includes, or may include, personal data relating to a number of individuals, and

• (ii) the nature of the set is, or may be, such that the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions.

• (2) The head of the intelligence service, or a person acting on their behalf, may carry out an initial inspection of the contents of the set for the purpose of deciding whether, if the intelligence service were to examine it after that initial inspection—

• (a) the intelligence service would be examining a third party bulk personal dataset (see section 226E), and

• (b) such examination would be necessary and proportionate in all the circumstances.

• (3) Subsection (4) applies if, after the initial inspection is carried out, the head of the intelligence service, or a person acting on their behalf, decides that—

• (a) the intelligence service would be examining a third party bulk personal dataset (as mentioned in subsection (2)(a)), and

• (b) such examination would be necessary and proportionate in all the circumstances.

• (4) The head of the intelligence service, or a person acting on their behalf, must—

• (a) decide whether to examine the third party bulk personal dataset, and

• (b) if they decide to do so, apply for a third party BPD warrant.

• (5) If the head of the intelligence service, or a person acting on their behalf, applies for such a third party BPD warrant, the intelligence service is not to be regarded as in breach of section 226F(1) by virtue of examining the bulk personal dataset if the examination is necessary for the purposes of the making of the application for the warrant.

• (6) For the purposes of subsection (1)(a), “relevant access” is to be read in accordance with section 226E(2).

• (7) For the purposes of this section, only a person holding office under the Crown may act on behalf of the head of an intelligence service.

226IA

• (1) The Secretary of State must ensure, in relation to every third party BPD warrant which authorises the examination of a bulk personal dataset, that arrangements are in force for securing that any examination of data contained in the dataset is necessary and proportionate in all the circumstances.

• (2) In doing so, the Secretary of State must in particular have regard to the information that is reasonably available to the intelligence services in relation to the examination of such data.

226IB

• (1) Subsections (2) and (3) apply if, in a case where protected data contained in a third party bulk personal dataset is to be examined in reliance on a third party BPD warrant—

• (a) the purpose, or one of the purposes, of using the criteria to be used for the examination of the data (“the relevant criteria”) is to identify any items subject to legal privilege, or

• (b) the use of the relevant criteria is likely to identify such items.

• (2) If the relevant criteria are referable to an individual known to be in the British Islands at the time of the examination, the data may be examined using the relevant criteria only if the Secretary of State has approved the use of those criteria.

• (3) In any other case, the data may be examined using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.

• (4) The Secretary of State may give approval for the purposes of subsection (2) only with the approval of a Judicial Commissioner.

• (5) Approval may be given under subsection (2) or (3) only if, where subsection (1)(a) applies, the Secretary of State or (as the case may be) the senior official considers that there are exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria.

• (6) In deciding whether to give an approval under subsection (2) or (3) in a case where subsection (1)(a) applies, the Secretary of State or (as the case may be) the senior official must have regard to the public interest in the confidentiality of items subject to legal privilege.

• (7) For the purposes of subsection (5), there cannot be exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria unless—

• (a) the public interest in obtaining the information that would be obtained by the examination of the data outweighs the public interest in the confidentiality of items subject to legal privilege,

• (b) there are no other means by which the information may reasonably be obtained, and

• (c) obtaining the information is necessary in the interests of national security or for the purpose of preventing death or significant injury.

• (8) In deciding whether to give approval for the purposes of subsection (4), the Judicial Commissioner must—

• (a) apply the same principles as would be applied by a court on an application for judicial review, and

• (b) consider the matter with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

• (9) Subsections (10) and (11) apply if, in a case where protected data contained in a third party bulk personal dataset is to be examined in reliance on a third party BPD warrant—

• (a) the purpose, or one of the purposes, of using the criteria to be used for the examination of the data (“the relevant criteria”) is to identify data that, if the data or any underlying material were not created or held with the intention of furthering a criminal purpose, would be an item subject to legal privilege, and

• (b) the person to whom the warrant is addressed considers that the data (“the targeted data”) or any underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose.

• (10) If the relevant criteria are referable to an individual known to be in the British Islands at the time of the examination, the data may be examined using the relevant criteria only if the Secretary of State has approved the use of those criteria.

• (11) In any other case, the data may be examined using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.

• (12) Approval may be given under subsection (10) or (11) only if the Secretary of State or (as the case may be) the senior official considers that the targeted data or the underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose.

• (13) In this section “underlying material”, in relation to data contained in a third party bulk personal dataset that is to be examined in reliance on a third party BPD warrant, means any communications or other items of information from which the data was produced.

226IC

• (1) Subsection (2) applies where—

• (a) an intelligence service examines a third party bulk personal dataset in reliance on a third party BPD warrant,

• (b) as part of the examination, the intelligence service examines an item subject to legal privilege,

• (c) the intelligence service retains the item, and

• (d) the retention of the item may not be authorised by a warrant under Part 7 (bulk personal dataset warrants).

• (2) The person to whom the third party BPD warrant (mentioned in subsection (1)(a)) is addressed must inform the Investigatory Powers Commissioner as soon as reasonably practicable after retaining the item.

• (3) Unless the Investigatory Powers Commissioner considers that subsection (5) applies to the item, the Commissioner must—

• (a) direct that the item is destroyed, or

• (b) impose one or more conditions as to the use or retention of that item.

• (4) If the Investigatory Powers Commissioner considers that subsection (5) applies to the item, the Commissioner may nevertheless impose such conditions under subsection (3)(b) as the Commissioner considers necessary for the purpose of protecting the public interest in the confidentiality of items subject to legal privilege.

• (5) This subsection applies to an item subject to legal privilege if—

• (a) the public interest in retaining the item outweighs the public interest in the confidentiality of items subject to legal privilege, and

• (b) retaining the item is necessary in the interests of national security or for the purpose of preventing death or significant injury.

• (6) The Investigatory Powers Commissioner—

• (a) may require an affected party to make representations about how the Commissioner should exercise any function under subsection (3), and

• (b) must have regard to any such representations made by an affected party (whether or not as a result of a requirement imposed under paragraph (a)).

• (7) Each of the following is an “affected party” for the purposes of subsection (6)—

• (a) the Secretary of State;

• (b) the person to whom the third party BPD warrant is or was addressed.

226ID

• (1) A person commits an offence if—

• (a) the person examines, in reliance on a third party BPD warrant, any data contained in a third party bulk personal dataset,

• (b) the person knows or believes that the examination of that data is in breach of the requirement specified in subsection (2), and

• (c) the person deliberately examines that data in breach of that requirement.

• (2) The requirement specified in this subsection is that any examination of the data is necessary and proportionate.

• (3) A person guilty of an offence under this section is liable—

• (a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court, to a fine or to both;

• (b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;

• (c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both;

• (d) on conviction on indictment, to imprisonment for a term not exceeding 2 years, to a fine or to both.

• (4) No proceedings for any offence which is an offence by virtue of this section may be instituted—

• (a) in England and Wales, except by or with the consent of the Director of Public Prosecutions;

• (b) in Northern Ireland, except by or with the consent of the Director of Public Prosecutions for Northern Ireland.

226IE

• (1) In this Part—

• “personal data” has the same meaning as in Part 7 (see section 199(2));

• “protected data” has the same meaning as in Part 7 (see section 203);

• “senior official” means a member of the Senior Civil Service or a member of the Senior Management Structure of His Majesty’s Diplomatic Service;

• “third party BPD warrant” has the meaning given by section 226F.

• (3) See also—

• section 263 (general definitions),

• section 265 (index of defined expressions).

228A

• (1) The power in subsection (2) is exercisable where the Investigatory Powers Commissioner and the Secretary of State consider that—

• (a) as a result of exceptional circumstances, there is a shortage of persons able to carry out Judicial Commissioner functions, and

• (b) the power in subsection (2) needs to be exercised in order to deal with that shortage.

• (2) The Investigatory Powers Commissioner may appoint one or more persons to carry out Judicial Commissioner functions.

• (3) A person appointed under subsection (2) is referred to in this section as a “temporary Judicial Commissioner”.

• (4) A temporary Judicial Commissioner may be appointed under subsection (2) for one or more terms not exceeding six months each and not exceeding three years in total.

• (5) As soon as practicable after the appointment of any temporary Judicial Commissioner, the Investigatory Powers Commissioner must notify the following persons of the appointment—

• (a) the Prime Minister;

• (b) the Secretary of State;

• (c) the Scottish Ministers;

• (d) the Lord Chancellor;

• (e) the Lord Chief Justice of England and Wales;

• (f) the Lord President of the Court of Session;

• (g) the Lord Chief Justice of Northern Ireland.

• (6) A reference to a Judicial Commissioner in any enactment (including this Act) is to be read (so far as the context allows) as referring also to a temporary Judicial Commissioner.