Investigatory Powers Act 2016

• (7) But subsections (1) and (4) to (6) of section 227 and section 228(2) (appointment requirements etc) do not apply in relation to temporary Judicial Commissioners.

• (8) In this section “Judicial Commissioner functions” means the functions conferred on Judicial Commissioners by any enactment (including this Act).

Annual and other reports

235A

• (1) This section applies where a telecommunications operator would, but for a relevant restriction, be required by regulation 5A(2) of the 2003 Regulations to notify a personal data breach to the Information Commissioner.

• (2) The telecommunications operator must report the personal data breach to the Investigatory Powers Commissioner.

• (3) Where a telecommunications operator reports a personal data breach to the Investigatory Powers Commissioner under subsection (2), a Judicial Commissioner must disclose information about the breach to the Information Commissioner.

• (4) Where a Judicial Commissioner discloses information about a personal data breach to the Information Commissioner under subsection (3), the Information Commissioner must—

• (a) consider whether the breach is serious, and

• (b) if the Information Commissioner considers that the breach is serious, notify the Investigatory Powers Commissioner.

• (5) The Investigatory Powers Commissioner must inform an individual of any personal data breach relating to that individual of which the Commissioner is notified under subsection (4)(b) if the Commissioner considers that it is in the public interest for the individual to be informed of the breach.

• (6) In making a decision under subsection (5), the Investigatory Powers Commissioner must, in particular, consider—

• (a) the seriousness of the breach and its effect on the individual concerned, and

• (b) the extent to which disclosing the breach would be contrary to the public interest or prejudicial to—

• (i) national security,

• (ii) the prevention or detection of serious crime,

• (iii) the economic well-being of the United Kingdom, or

• (iv) the continued discharge of the functions of any of the intelligence services.

• (7) Before making a decision under subsection (5), the Investigatory Powers Commissioner must ask—

• (a) the Secretary of State, and

• (b) any public authority that the Investigatory Powers Commissioner considers appropriate,

to make submissions to the Commissioner about the matters concerned.

• (8) When informing an individual under subsection (5) of a breach, the Investigatory Powers Commissioner must—

• (a) inform the individual of any rights that the individual may have to apply to the Investigatory Powers Tribunal in relation to the breach, and

• (b) provide such details of the breach as the Commissioner considers to be necessary for the exercise of those rights, having regard in particular to the extent to which disclosing the details would be contrary to the public interest or prejudicial to anything falling within subsection (6)(b)(i) to (iv).

• (9) The Investigatory Powers Commissioner may not inform the individual to whom it relates of a personal data breach notified to the Commissioner under subsection (4)(b) except as provided by this section.

• (10) For the purposes of this section, a personal data breach is serious if the breach is likely to result in a high risk to the rights and freedoms of individuals.

• (11) In this section—

• “2003 Regulations” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426);

• “personal data breach” has the same meaning as in the 2003 Regulations (see regulation 2(1) of those Regulations);

• “relevant restriction” means any of the following—section 57(1) (duty not to make unauthorised disclosures) (including as applied by section 156);section 132(1) (duty not to make unauthorised disclosures) (including as applied by section 197);section 174(1) (offence of making unauthorised disclosure),(read with regulation 29(1)(a)(i) of the 2003 Regulations).

Functions of Tribunal in relation to this Act etc.

Oversight by Information Commissioner in relation to Part 4

National security notices

256A

• (1) If the renewal conditions are met, a relevant notice may be renewed, at any time during the renewal period, by a notice given by the Secretary of State.

• (2) The renewal conditions for a national security notice given under section 252 are that—

• (a) the Secretary of State considers that the notice is still necessary in the interests of national security,

• (b) the Secretary of State considers that the conduct required by the notice is still proportionate to what is sought to be achieved by that conduct, and

• (c) the decision to renew the notice has been approved by a Judicial Commissioner.

• (3) The renewal conditions for a technical capability notice given under section 253 are that—

• (a) the Secretary of State considers that the notice is still necessary for securing that the relevant operator has the capability to provide any assistance which the operator may be required to provide in relation to any relevant authorisation,

• (b) the Secretary of State considers that the conduct required by the notice is still proportionate to what is sought to be achieved by that conduct, and

• (c) the decision to renew the notice has been approved by a Judicial Commissioner.

• (4) The renewal period means the period of 30 days ending with the day at the end of which the relevant notice would otherwise cease to have effect.

• (5) If the Secretary of State renews a relevant notice given to any person, the Secretary of State must give that person notice in writing of the renewal.

• (6) Sections 254, 255(2) to (4) and (7) and 257 apply in relation to the renewal of a relevant notice as they apply in relation to the giving of a relevant notice.

• (7) Section 255(6) applies to any notice of the renewal of a technical capability notice as it applies to a technical capability notice.

• (8) In this section—

• “relevant authorisation” has the meaning given by section 253;

• “relevant notice” means—a national security notice under section 252, ora technical capability notice under section 253;

• “relevant operator” has the meaning given by section 253.

Review of operation of Act

Commencement, extent and short title

Schedule 2A

1

The Treasury.

2

A local authority.

Proceedings relating to release of prisoners etc in England and Wales

12A

• (1) Section 56(1) does not apply in relation to—

• (a) any proceedings before the Parole Board, or

• (b) any proceedings arising out of such proceedings.

• (2) But sub-paragraph (1) does not permit the disclosure of anything to—

• (a) any person, other than the Secretary of State, who is or was a party to the proceedings, or

• (b) any person who—

• (i) represents such a person for the purposes of the proceedings, and

• (ii) does so otherwise than by virtue of appointment as a special advocate.

25

• (1) Nothing in section 56(1) prohibits—

• (a) a disclosure to a relevant coroner conducting an NI investigation or inquest, or

• (b) a disclosure to a qualified person—

• (i) appointed as legal adviser to an inquest conducted by the coroner, or

• (ii) employed under section 11(3) of the Coroners Act (Northern Ireland) 1959 (c. 15) (“the 1959 Act”) by a relevant coroner to assist the coroner in an investigation conducted by the coroner,

where, in the course of the investigation or inquest, the relevant coroner (“C”) has ordered the disclosure to be made to C alone or (as the case may be) to C and any qualified person appointed or employed by C as mentioned in paragraph (b).

• (2) A relevant coroner may order a disclosure under sub-paragraph (1) only if the coroner considers that the exceptional circumstances of the case make the disclosure essential in the interests of justice.

• (3) In a case where a coroner (“C”) conducting, or who has been conducting, an NI investigation or inquest is not a relevant coroner, nothing in section 56(1) prohibits—

• (a) a disclosure to C that there is intercepted material in existence which is, or may be, relevant to the investigation or inquest;

• (b) a disclosure to a qualified person appointed by C as legal adviser to the inquest or employed by C under section 11(3) of the 1959 Act to assist C in the investigation, which is made for the purposes of determining—

• (i) whether any intercepted material is, or may be, relevant to the investigation, and

• (ii) if so, whether it is necessary for the material to be disclosed to the person conducting the investigation.

• (4) In sub-paragraph (3) “intercepted material” means—

• (a) any content of an intercepted communication (within the meaning of section 56), or

• (b) any secondary data obtained from a communication.

• (5) In this paragraph—

• “the 1959 Act” has the meaning given by sub-paragraph (1);

• “coroner” means a coroner appointed under section 2 of the 1959 Act;

• “NI investigation or inquest” means an investigation under section 11(1) of the 1959 Act or an inquest under section 13 or 14 of that Act;

• “qualified person” means a member of the Bar of Northern Ireland, or a solicitor of the Court of Judicature of Northern Ireland);

• “relevant coroner” means a coroner who is a judge of the High Court or of a county court in Northern Ireland.

26

• (1) Nothing in section 56(1) prohibits—

• (a) a disclosure to a relevant person conducting an inquiry under the Inquiries into Fatal Accidents and Sudden Deaths etc. (Scotland) Act 2016 (2016 asp 2) (“IFASDA 2016”), or

• (b) a disclosure to a qualified person appointed under section 24 of that Act to assist a relevant person in the inquiry,

where, in the course of the inquiry, the person conducting the inquiry has ordered the disclosure to be made to that person alone or (as the case may be) to that person and any qualified person appointed to assist a relevant person in the inquiry.

• (2) A relevant person may order a disclosure under sub-paragraph (1) only if the person considers that the exceptional circumstances of the case make the disclosure essential in the interests of justice.

• (3) Nothing in section 56(1) prohibits—

• (a) a disclosure to a relevant person conducting an inquiry under IFASDA 2016, or

• (b) a disclosure to a qualified person appointed under section 24 of that Act to assist a relevant person in the inquiry,

that there is intercepted material in existence which is, or may be, relevant to the inquiry.

• (4) In sub-paragraph (3) “intercepted material” means—

• (a) any content of an intercepted communication (within the meaning of section 56), or

• (b) any secondary data obtained from a communication.

• (5) In this paragraph “relevant person” means—

• (a) a sheriff principal,

• (b) a temporary sheriff principal, or

• (c) a sheriff or part-time sheriff (but not a summary sheriff or part-time summary sheriff) designated as a specialist under section 37(1) or (3) of IFASDA 2016.

• (6) In this paragraph “qualified person” means an advocate or solicitor; and “advocate” and “solicitor” have the same meaning as in IFASDA 2016 (see section 40 of that Act).

258A

• (1) The Secretary of State may give a relevant operator a notice in writing under this section requiring the operator to notify the Secretary of State of any proposals of the operator to make any relevant changes specified in the notice.

• (2) In this section “relevant change” means a change—

• (a) to a service or system within subsection (3), and

• (b) that is specified in regulations made by the Secretary of State as a change that may be included in a notice given under this section.

• (3) The following are within this subsection—

• (a) telecommunications services offered or provided by the operator;

• (b) telecommunication systems controlled or provided by the operator;

• (c) postal services provided by the operator.

• (4) Regulations under subsection (2) may in particular specify changes by reference to the impact of the changes on the capability of a relevant operator to provide any assistance which the operator may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act.

• (5) The Secretary of State may give a relevant operator a notice under this section only if the Secretary of State considers that—

• (a) the notice is necessary for maintaining the capability of the relevant operator to provide any assistance which the operator may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act, and

• (b) the conduct required by the notice is proportionate to what is sought to be achieved by that conduct.

• (6) Before giving a notice under this section, the Secretary of State must among other matters take into account—

• (a) the likely benefits of the notice,

• (b) the likely number of users (if known) of any postal or telecommunications service to which the notice relates,

• (c) the likely cost of complying with the notice, and

• (d) any other effect of the notice on the operator to whom it relates.

• (7) Before giving a notice under this section to a relevant operator, the Secretary of State must consult that operator.

• (8) A relevant operator to whom a notice is given under this section, or any person employed or engaged for the purposes of that relevant operator’s business, must not disclose the existence or contents of the notice to any other person without the permission of the Secretary of State.

• (9) A relevant operator to whom a notice is given under this section must comply with the notice a reasonable time before making any relevant changes to which the notice relates.

• (10) The duty imposed by subsection (8) or (9) is enforceable by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.

• (11) In this section “relevant operator” means—

• (a) a postal operator,

• (b) a telecommunications operator, or

• (c) a person who is proposing to become a postal operator or a telecommunications operator,

who meets the condition in subsection (12).

• (12) The condition in this subsection is that the operator or person provides (or has provided) assistance in relation to any warrant, authorisation or notice issued or given under this Act.

258B

• (1) In this section—

• “relevant notice” means a notice given under section 258A;

• “relevant operator” has the same meaning as in that section.

• (2) The Secretary of State may—

• (a) vary a relevant notice;

• (b) revoke a relevant notice (whether wholly or in part).

• (3) The Secretary of State may vary a relevant notice only if the Secretary of State considers that—

• (a) the variation is necessary for maintaining the capability of the relevant operator to provide any assistance which the operator may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act, and

• (b) the conduct required by the notice, as varied, is proportionate to what is sought to be achieved by that conduct.

• (4) If the Secretary of State varies or revokes a relevant notice given to any relevant operator, the Secretary of State must give that relevant operator notice in writing of the variation or revocation.

• (5) The fact that a relevant notice has been revoked in relation to a particular relevant operator does not prevent the giving of another relevant notice of the same kind in relation to the same relevant operator.

• (6) Subsections (6) and (7) of section 258A apply in relation to varying or revoking a relevant notice as they apply in relation to giving a relevant notice.

• (7) Any reference in this section or section 258A(8) or (9) to a notice given under section 258A includes a reference to such a notice as varied under this section.