Part III Investigation of electronic data protected by encryption etc.
Power to require disclosure
49 Notices requiring disclosure.
1
This section applies where any protected information—
a
has come into the possession of any person by means of the exercise of a statutory power to seize, detain, inspect, search or otherwise to interfere with documents or other property, or is likely to do so;
b
has come into the possession of any person by means of the exercise of any statutory power to intercept communications, or is likely to do so;
c
has come into the possession of any person by means of the exercise of any power conferred by an authorisation under section 22(3) F8or (3B) or under Part II, or as a result of the giving of a notice under section 22(4), or is likely to do so;
d
has come into the possession of any person as a result of having been provided or disclosed in pursuance of any statutory duty (whether or not one arising as a result of a request for information), or is likely to do so; or
C1e
has, by any other lawful means not involving the exercise of statutory powers, come into the possession of any of the intelligence services, the police, F14the National Crime AgencyF9... or F1Her Majesty's Revenue and Customs, or is likely so to come into the possession of any of those services, the police, F14the National Crime AgencyF9... or F1Her Majesty's Revenue and Customs.
2
If any person with the appropriate permission under Schedule 2 believes, on reasonable grounds—
a
that a key to the protected information is in the possession of any person,
b
that the imposition of a disclosure requirement in respect of the protected information is—
i
necessary on grounds falling within subsection (3), or
ii
necessary for the purpose of securing the effective exercise or proper performance by any public authority of any statutory power or statutory duty,
c
that the imposition of such a requirement is proportionate to what is sought to be achieved by its imposition, and
d
that it is not reasonably practicable for the person with the appropriate permission to obtain possession of the protected information in an intelligible form without the giving of a notice under this section,
the person with that permission may, by notice to the person whom he believes to have possession of the key, impose a disclosure requirement in respect of the protected information.
3
A disclosure requirement in respect of any protected information is necessary on grounds falling within this subsection if it is necessary—
a
in the interests of national security;
b
for the purpose of preventing or detecting crime; or
c
in the interests of the economic well-being of the United Kingdom.
4
A notice under this section imposing a disclosure requirement in respect of any protected information—
a
must be given in writing or (if not in writing) must be given in a manner that produces a record of its having been given;
b
must describe the protected information to which the notice relates;
c
must specify the matters falling within subsection (2)(b)(i) or (ii) by reference to which the notice is given;
d
must specify the office, rank or position held by the person giving it;
e
must specify the office, rank or position of the person who for the purposes of Schedule 2 granted permission for the giving of the notice or (if the person giving the notice was entitled to give it without another person’s permission) must set out the circumstances in which that entitlement arose;
f
must specify the time by which the notice is to be complied with; and
g
must set out the disclosure that is required by the notice and the form and manner in which it is to be made;
and the time specified for the purposes of paragraph (f) must allow a period for compliance which is reasonable in all the circumstances.
5
Where it appears to a person with the appropriate permission—
a
that more than one person is in possession of the key to any protected information,
b
that any of those persons is in possession of that key in his capacity as an officer or employee of any body corporate, and
c
that another of those persons is the body corporate itself or another officer or employee of the body corporate,
a notice under this section shall not be given, by reference to his possession of the key, to any officer or employee of the body corporate unless he is a senior officer of the body corporate or it appears to the person giving the notice that there is no senior officer of the body corporate and (in the case of an employee) no more senior employee of the body corporate to whom it is reasonably practicable to give the notice.
6
Where it appears to a person with the appropriate permission—
(a)that more than one person is in possession of the key to any protected information,
b
that any of those persons is in possession of that key in his capacity as an employee of a firm, and
c
that another of those persons is the firm itself or a partner of the firm,
a notice under this section shall not be given, by reference to his possession of the key, to any employee of the firm unless it appears to the person giving the notice that there is neither a partner of the firm nor a more senior employee of the firm to whom it is reasonably practicable to give the notice.
7
Subsections (5) and (6) shall not apply to the extent that there are special circumstances of the case that mean that the purposes for which the notice is given would be defeated, in whole or in part, if the notice were given to the person to whom it would otherwise be required to be given by those subsections.
8
A notice under this section shall not require the making of any disclosure to any person other than—
a
the person giving the notice; or
b
such other person as may be specified in or otherwise identified by, or in accordance with, the provisions of the notice.
9
A notice under this section shall not require the disclosure of any key which—
a
is intended to be used for the purpose only of generating electronic signatures; and
b
has not in fact been used for any other purpose.
10
In this section “senior officer”, in relation to a body corporate, means a director, manager, secretary or other similar officer of the body corporate; and for this purpose “director”, in relation to a body corporate whose affairs are managed by its members, means a member of the body corporate.
11
Schedule 2 (definition of the appropriate permission) shall have effect.
50 Effect of notice imposing disclosure requirement.
1
Subject to the following provisions of this section, the effect of a section 49 notice imposing a disclosure requirement in respect of any protected information on a person who is in possession at a relevant time of both the protected information and a means of obtaining access to the information and of disclosing it in an intelligible form is that he—
a
shall be entitled to use any key in his possession to obtain access to the information or to put it into an intelligible form; and
b
shall be required, in accordance with the notice imposing the requirement, to make a disclosure of the information in an intelligible form.
2
A person subject to a requirement under subsection (1)(b) to make a disclosure of any information in an intelligible form shall be taken to have complied with that requirement if—
a
he makes, instead, a disclosure of any key to the protected information that is in his possession; and
b
that disclosure is made, in accordance with the notice imposing the requirement, to the person to whom, and by the time by which, he was required to provide the information in that form.
3
Where, in a case in which a disclosure requirement in respect of any protected information is imposed on any person by a section 49 notice—
a
that person is not in possession of the information,
b
that person is incapable, without the use of a key that is not in his possession, of obtaining access to the information and of disclosing it in an intelligible form, or
c
the notice states, in pursuance of a direction under section 51, that it can be complied with only by the disclosure of a key to the information,
the effect of imposing that disclosure requirement on that person is that he shall be required, in accordance with the notice imposing the requirement, to make a disclosure of any key to the protected information that is in his possession at a relevant time.
4
Subsections (5) to (7) apply where a person (“the person given notice”)—
a
is entitled or obliged to disclose a key to protected information for the purpose of complying with any disclosure requirement imposed by a section 49 notice; and
b
is in possession of more than one key to that information.
5
It shall not be necessary, for the purpose of complying with the requirement, for the person given notice to make a disclosure of any keys in addition to those the disclosure of which is, alone, sufficient to enable the person to whom they are disclosed to obtain access to the information and to put it into an intelligible form.
6
Where—
a
subsection (5) allows the person given notice to comply with a requirement without disclosing all of the keys in his possession, and
b
there are different keys, or combinations of keys, in the possession of that person the disclosure of which would, under that subsection, constitute compliance,
the person given notice may select which of the keys, or combination of keys, to disclose for the purpose of complying with that requirement in accordance with that subsection.
7
Subject to subsections (5) and (6), the person given notice shall not be taken to have complied with the disclosure requirement by the disclosure of a key unless he has disclosed every key to the protected information that is in his possession at a relevant time.
8
Where, in a case in which a disclosure requirement in respect of any protected information is imposed on any person by a section 49 notice—
a
that person has been in possession of the key to that information but is no longer in possession of it,
b
if he had continued to have the key in his possession, he would have been required by virtue of the giving of the notice to disclose it, and
c
he is in possession, at a relevant time, of information to which subsection (9) applies,
the effect of imposing that disclosure requirement on that person is that he shall be required, in accordance with the notice imposing the requirement, to disclose all such information to which subsection (9) applies as is in his possession and as he may be required, in accordance with that notice, to disclose by the person to whom he would have been required to disclose the key.
9
This subsection applies to any information that would facilitate the obtaining or discovery of the key or the putting of the protected information into an intelligible form.
10
In this section “relevant time”, in relation to a disclosure requirement imposed by a section 49 notice, means the time of the giving of the notice or any subsequent time before the time by which the requirement falls to be complied with.
51 Cases in which key required.
1
A section 49 notice imposing a disclosure requirement in respect of any protected information shall not contain a statement for the purposes of section 50(3)(c) unless—
a
the person who for the purposes of Schedule 2 granted the permission for the giving of the notice in relation to that information, or
b
any person whose permission for the giving of a such a notice in relation to that information would constitute the appropriate permission under that Schedule,
has given a direction that the requirement can be complied with only by the disclosure of the key itself.
2
A direction for the purposes of subsection (1) by F2the police, F15the National Crime Agency, F10...,F3Her Majesty's Revenue and Customs or a member of Her Majesty’s forces shall not be given—
a
in the case of a direction by the police or by a member of Her Majesty’s forces who is a member of a police force, except by or with the permission of a chief officer of police;
F4aa
F11ab
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
b
c
in the case of a direction by a member of Her Majesty’s forces who is not a member of a police force, except by or with the permission of a person of or above the rank of brigadier or its equivalent.
3
A permission given for the purposes of subsection (2) by a chief officer of police, F6the F18Director General of the National Crime Agency,F12... F5the Commissioners for Her Majesty's Revenue and Customs or a person of or above any such rank as is mentioned in paragraph (c) of that subsection must be given expressly in relation to the direction in question.
4
A person shall not give a direction for the purposes of subsection (1) unless he believes—
a
that there are special circumstances of the case which mean that the purposes for which it was believed necessary to impose the requirement in question would be defeated, in whole or in part, if the direction were not given; and
b
that the giving of the direction is proportionate to what is sought to be achieved by prohibiting any compliance with the requirement in question otherwise than by the disclosure of the key itself.
5
The matters to be taken into account in considering whether the requirement of subsection (4)(b) is satisfied in the case of any direction shall include—
a
the extent and nature of any protected information, in addition to the protected information in respect of which the disclosure requirement is imposed, to which the key is also a key; and
b
any adverse effect that the giving of the direction might have on a business carried on by the person on whom the disclosure requirement is imposed.
6
Where a direction for the purposes of subsection (1) is given by a chief officer of police, F7by the F19Director General of the National Crime Agency,F13... by F5the Commissioners for Her Majesty's Revenue and Customs or by a member of Her Majesty’s forces, the person giving the direction shall give a notification that he has F20done so to the Investigatory Powers Commissioner.
7
A notification under subsection (6)—
a
must be given not more than seven days after the day of the giving of the direction to which it relates; and
b
may be given either in writing or by being transmitted to F21the Investigatory Powers Commissioner by electronic means.