Investigatory Powers Act 2016

87 Powers to require retention of certain data U.K.

(1) The Secretary of State may, by notice (a “retention notice”) and subject as follows, require a telecommunications operator to retain relevant communications data if—

(a) the Secretary of State considers that the requirement is necessary and proportionate for one or more of the [F1 following purposes—

(i) in the interests of national security,

(ii) for the applicable crime purpose (see subsection (10A)),

(iii) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,

(iv) in the interests of public safety,

(v) for the purpose of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health,

(vi) to assist investigations into alleged miscarriages of justice,]

and

(b) the decision to give the notice has been approved by a Judicial Commissioner.

(2) A retention notice may—

(a) relate to a particular operator or any description of operators,

(b) require the retention of all data or any description of data,

(c) identify the period or periods for which data is to be retained,

(d) contain other requirements, or restrictions, in relation to the retention of data,

(e) make different provision for different purposes,

(f) relate to data whether or not in existence at the time of the giving, or coming into force, of the notice.

(3) A retention notice must not require any data to be retained for more than 12 months beginning with—

(a) in the case of communications data relating to a specific communication, the day of the communication concerned,

(b) in the case of entity data which does not fall within paragraph (a) above but does fall within paragraph (a)(i) of the definition of “communications data” in section 261(5), the day on which the entity concerned ceases to be associated with the telecommunications service concerned or (if earlier) the day on which the data is changed, and

(c) in any other case, the day on which the data is first held by the operator concerned.

(4) A retention notice must not require an operator who controls or provides a telecommunication system (“the system operator”) to retain data [F2 , other than data which is, or can only be obtained by processing, an internet connection record,] which—

(a) relates to the use of a telecommunications service provided [F3 (solely or jointly with another person)] by another telecommunications operator in relation to that system,

[F4 (aa) does not relate to a relevant roaming service,]

(b) is (or is capable of being) processed by the system operator as a result of being comprised in, included as part of, attached to or logically associated with a communication transmitted by means of the system as a result of the use mentioned in paragraph (a),

(c) is not needed by the system operator for the functioning of the system in relation to that communication, and

(d) is not retained or used by the system operator for any other lawful purpose,

and which it is reasonably practicable to separate from other data which is subject to the notice.

[F5 (4A) In subsection (4) “relevant roaming service” means a telecommunications service provided by the system operator under an agreement with a telecommunications operator outside the United Kingdom (the “non-UK operator”) which facilitates the use by persons in the United Kingdom of the system operator’s telecommunication system to access one or more telecommunications services of the non-UK operator.]

(5) A retention notice which relates to data already in existence when the notice comes into force imposes a requirement to retain the data for only so much of a period of retention as occurs on or after the coming into force of the notice.

(6) A retention notice comes into force—

(a) when the notice is given to the operator (or description of operators) concerned, or

(b) (if later) at the time or times specified in the notice.

[F6 (6A) A retention notice ceases to have effect at the end of the relevant period unless before the end of that period—

(a) it is varied in accordance with section 94(4) so as to require the retention of additional relevant communications data,

(b) it is renewed (see section 94A), or

(c) it is revoked or otherwise ceases to have effect (see sections 90(10) and 94).

(6B) In subsection (6A) the “relevant period” means the period of two years beginning with—

(a) in the case of a retention notice that has not been varied as mentioned in subsection (6A)(a) or renewed, the day on which the notice comes into force, or

(b) in the case of a retention notice that has been so varied or renewed, the day after the day at the end of which the retention notice would have ceased to have effect if it had not been so varied or renewed.]

(7) A retention notice is given to an operator (or description of operators) by giving, or publishing, it in such manner as the Secretary of State considers appropriate for bringing it to the attention of the operator (or description of operators) to whom it relates.

(8) A retention notice must specify—

(a) the operator (or description of operators) to whom it relates,

[F7 (aa) each telecommunications service (or description of telecommunications service) to which it relates,]

(b) the data which is to be retained,

(c) the period or periods for which the data is to be retained,

(d) any other requirements, or any restrictions, in relation to the retention of the data,

(e) the information required by section 249(7) (the level or levels of contribution in respect of costs incurred as a result of the notice).

(9) The requirements or restrictions mentioned in subsection (8)(d) may, in particular, include—

(a) a requirement to retain the data in such a way that it can be transmitted efficiently and effectively in response to requests,

(b) requirements or restrictions in relation to the obtaining (whether by collection, generation or otherwise), generation or processing of—

(i) data for retention, or

(ii) retained data.

(10) The fact that the data which would be retained under a retention notice relates to the activities in the British Islands of a trade union is not, of itself, sufficient to establish that the requirement to retain the data is necessary for one or more of the purposes falling within [F8 sub-paragraphs (i) to (vi) of subsection (1)(a)].

[F9 (10A) In this section, “the applicable crime purpose” means—

(a) to the extent that a retention notice relates to events data, the purpose of preventing or detecting serious crime;

(b) to the extent that a retention notice relates to entity data, the purpose of preventing or detecting crime or of preventing disorder.

(10B) In subsection (10A)(a), “serious crime” means, in addition to crime which falls within paragraph (a) or (b) of the definition of “serious crime” in section 263(1), crime where the offence, or one of the offences, which is or would be constituted by the conduct concerned is—

(a) an offence for which an individual who has reached the age of 18 (or, in relation to Scotland or Northern Ireland, 21) is capable of being sentenced to imprisonment for a term of 12 months or more (disregarding any enactment prohibiting or restricting the imprisonment of individuals who have no previous convictions), or

(b) an offence—

(i) by a person who is not an individual, or

(ii) which involves, as an integral part of it, the sending of a communication or a breach of a person’s privacy.]

(11) In this Part “relevant communications data” means communications data which may be used to identify, or assist in identifying, any of the following—

(a) the sender or recipient of a communication (whether or not a person),

(b) the time or duration of a communication,

(c) the type, method or pattern, or fact, of communication,

(d) the telecommunication system (or any part of it) from, to or through which, or by means of which, a communication is or may be transmitted, or

(e) the location of any such system,

[F10 (and] this expression therefore includes, in particular, internet connection [F11 records)].

Textual Amendments

F1 S. 87(1)(a)(i)-(vi) substituted (1.11.2018) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), regs. 1(3)(c), 8(2)

F2 Words in s. 87(4) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 16(2)(a), 32(2); S.I. 2024/1021, reg. 2(p)

F3 Words in s. 87(4)(a) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 16(2)(b), 32(2); S.I. 2024/1021, reg. 2(p)

F4 S. 87(4)(aa) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 16(2)(c), 32(2); S.I. 2024/1021, reg. 2(p)

F5 S. 87(4A) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 16(3), 32(2); S.I. 2024/1021, reg. 2(p)

F6 S. 87(6A)(6B) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 20(2), 32(2); S.I. 2024/1021, reg. 2(s) (with regs. 3, 4)

F7 S. 87(8)(aa) inserted (1.11.2018) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), regs. 1(3)(c), 8(3)

F8 Words in s. 87(10) substituted (1.11.2018) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), regs. 1(3)(c), 8(4)

F9 S. 87(10A)(10B) inserted (1.11.2018) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), regs. 1(3)(c), 8(5)

F10 Word in s. 87(11) substituted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 16(4)(a), 32(2); S.I. 2024/1021, reg. 2(p)

F11 Word in s. 87(11) substituted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 16(4)(b), 32(2); S.I. 2024/1021, reg. 2(p)

Commencement Information

I1 S. 87(1)(a)(2)-(11) in force at 30.12.2016 by S.I. 2016/1233, reg. 2(c)

I2 S. 87(1)(b) in force at 1.11.2018 by S.I. 2018/873, reg. 4(a)