Investigatory Powers Act 2016

[F1 Further provision about authorisations] U.K.

Textual Amendments

F1 S. 62 cross-heading inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 2 (see S.I. 2019/174, reg. 2(c))

62 Restrictions in relation to internet connection records U.K.

[F2 (A1) The Investigatory Powers Commissioner may not, on the application of a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record.

(A2) The Investigatory Powers Commissioner may not, on the application of a relevant public authority which is not a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B [F3 , C or D1] is met.]

F4 (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(2) A designated senior officer of a relevant public authority which is not a local authority may not grant an authorisation [F5 under section 61 or 61A] for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B [F6 , C or D2] is met.

(3) Condition A is that [F7 the person with power to grant the authorisation] considers that it is necessary, for a purpose falling within [F8 section 60A(7), 61(7) or 61A(7) (as applicable)], to obtain the data to identify which person or apparatus is using an internet service where—

(a) the service and time of use are already known, but

(b) the identity of the person or apparatus using the service is not known.

(4) Condition B is that—

(a) the purpose for which the data is to be obtained falls within [F9 section 60A(7), 61(7) or 61A(7) (as applicable) but is not the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a) or the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b),] and

(b) [F10 the person with power to grant the authorisation] considers that it is necessary to obtain the data to identify—

(i) which internet communications service is being used, and when and how it is being used, by a person or apparatus whose identity is already known,

(ii) where or when a person or apparatus whose identity is already known is obtaining access to, or running, a computer file or computer program which wholly or mainly involves making available, or acquiring, material whose possession is a crime, or

(iii) which internet service is being used, and when and how it is being used, by a person or apparatus whose identity is already known.

(5) Condition C is that—

[F11 (a) either—

(i) the purpose for which the data is to be obtained is the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a), or

(ii) the purpose for which the data is to be obtained is the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b) and the crime to be prevented or detected is serious crime, and]

F12 (b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c) [F13 the person with power to grant the authorisation] considers that it is necessary to obtain the data to identify—

(i) which internet communications service is being used, and when and how it is being used, by a person or apparatus whose identity is already known,

(ii) where or when a person or apparatus whose identity is already known is obtaining access to, or running, a computer file or computer program which wholly or mainly involves making available, or acquiring, material whose possession is a crime, or

(iii) which internet service is being used, and when and how it is being used, by a person or apparatus whose identity is already known.

[F14 (5A) Condition D1 is that—

(a) the application is made by a relevant public authority which is specified in column 1 of the table (see below), and

(b) the Investigatory Powers Commissioner considers that it is necessary, for a purpose described in the corresponding entry in column 2 of the table, to identify which persons or apparatuses are using one or more specified internet services in a specified period.

1 (applicant)	2 (description(s) of purpose)
Security Service, Secret Intelligence Service or GCHQ	A purpose falling within subsection (7)(a) or (c) of section 60A, or falling within subsection (7)(b) of that section by virtue of subsection (8)(a) of that section.
National Crime Agency	A purpose falling within subsection (7)(b) of section 60A by virtue of subsection (8)(a) of that section.

(5B) Condition D2 is that—

(a) the relevant public authority whose designated senior officer has power to grant the authorisation is specified in column 1 of the table (see below), and

(b) that officer considers that it is necessary, for a purpose described in the corresponding entry in column 2 or 3 of the table (as applicable), to identify which persons or apparatuses are using one or more specified internet services in a specified period.

1 (relevant public authority)	2 (description of purpose: authorisation under section 61)	3 (description of purpose: authorisation under section 61A)
Security Service, Secret Intelligence Service or GCHQ	A purpose falling within section 61(7)(a) or (c).	A purpose falling within subsection (7)(a) of section 61A by virtue of subsection (8)(a) of that section.
National Crime Agency		A purpose falling within subsection (7)(a) of section 61A by virtue of subsection (8)(a) of that section.

(5C) In subsections (5A)(b) and (5B)(b) “specified” means specified in the application for the authorisation.]

F15 (6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) In this Act “internet connection record” means communications data which—

(a) may be used to identify, or assist in identifying, a telecommunications service to which a communication is transmitted by means of a telecommunication system for the purpose of obtaining access to, or running, a computer file or computer program, and

(b) comprises data generated or processed by a telecommunications operator in the process of supplying the telecommunications service to the sender of the communication (whether or not a person).

Textual Amendments

F2 S. 62(A1)(A2) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(2) (see S.I. 2019/174, reg. 2(c))

F3 Words in s. 62(A2) substituted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 15(2), 32(2); S.I. 2024/1021, reg. 2(o)

F4 S. 62(1) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(3) (see S.I. 2019/174, reg. 2(c))

F5 Words in s. 62(2) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 15(3)(a), 32(2); S.I. 2024/1021, reg. 2(o)

F6 Words in s. 62(2) substituted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 15(3)(b), 32(2); S.I. 2024/1021, reg. 2(o)

F7 Words in s. 62(3) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(4)(a) (see S.I. 2019/174, reg. 2(c))

F8 Words in s. 62(3) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(4)(b) (see S.I. 2019/174, reg. 2(c))

F9 Words in s. 62(4)(a) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(5)(a) (see S.I. 2019/174, reg. 2(c))

F10 Words in s. 62(4)(b) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(5)(b) (see S.I. 2019/174, reg. 2(c))

F11 S. 62(5)(a) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(6)(a) (see S.I. 2019/174, reg. 2(c))

F12 S. 62(5)(b) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(6)(b) (see S.I. 2019/174, reg. 2(c))

F13 Words in s. 62(5)(c) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(6)(c) (see S.I. 2019/174, reg. 2(c))

F14 S. 62(5A)-(5C) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 15(4), 32(2); S.I. 2024/1021, reg. 2(o)

F15 S. 62(6) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 3(7) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I1 S. 62 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

63 Additional restrictions on grant of authorisations [F16 under section 61] U.K.

(1) A designated senior officer may not grant an authorisation [F17 under section 61] for the purposes of a specific investigation or a specific operation if the officer is working on that investigation or operation.

(2) But, if the designated senior officer considers that there are exceptional circumstances which mean that subsection (1) should not apply in a particular case, that subsection does not apply in that case.

(3) Examples of exceptional circumstances include—

(a) an imminent threat to life or another emergency,

(b) the investigation or operation concerned is one where there is an exceptional need, in the interests of national security, to keep knowledge of it to a minimum, [F18 or]

(c) there is an opportunity to obtain information where—

(i) the opportunity is rare,

(ii) the time to act is short, and

(iii) the need to obtain the information is significant and in the interests of national security.

F19 (d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F16 Words in s. 63 heading inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 4(2) (see S.I. 2019/174, reg. 2(c))

F17 Words in s. 63(1) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 4(3) (see S.I. 2019/174, reg. 2(c))

F18 Word in s. 63(3)(b) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 4(4)(a) (see S.I. 2019/174, reg. 2(c))

F19 S. 63(3)(d) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 4(4)(b) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I2 S. 63 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

64 Procedure for authorisations and authorised notices U.K.

(1) An authorisation must specify—

F20 (a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F21 (aa) whether the authorisation has been granted by the Investigatory Powers Commissioner under section 60A or by a designated senior officer under section 61 or 61A;]

(b) the matters falling within [F22 section 60A(7), 61(7) or 61A(7) (as applicable)] by reference to which it is granted,

(c) the conduct that is authorised,

(d) the data or description of data to be obtained, and

(e) the persons or descriptions of persons to whom the data is to be, or may be, disclosed or how to identify such persons.

[F23 (1A) An authorisation granted by a designated senior officer under section 61 or 61A must also specify the office, rank or position held by the officer.]

(2) An authorisation which authorises a person to impose requirements by notice on a telecommunications operator must also specify—

(a) the operator concerned, and

(b) the nature of the requirements that are to be imposed,

but need not specify the other contents of the notice.

(3) The notice itself—

(a) must specify—

(i) the office, rank or position held by the person giving it,

(ii) the requirements that are being imposed, and

(iii) the telecommunications operator on whom the requirements are being imposed, and

(b) must be given in writing or (if not in writing) in a manner that produces a record of its having been given.

(4) An authorisation must be applied for, and granted, in writing or (if not in writing) in a manner that produces a record of its having been applied for or granted.

Textual Amendments

F20 S. 64(1)(a) omitted (5.2.2019) by virtue of The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 5(2)(a) (see S.I. 2019/174, reg. 2(c))

F21 S. 64(1)(aa) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 5(2)(b) (see S.I. 2019/174, reg. 2(c))

F22 Words in s. 64(1)(b) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 5(2)(c) (see S.I. 2019/174, reg. 2(c))

F23 S. 64(1A) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 5(3) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I3 S. 64 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

65 Duration and cancellation of authorisations and notices U.K.

(1) An authorisation [F24 under section 60A or 61] ceases to have effect at the end of the period of one month beginning with the date on which it is granted.

(2) An authorisation [F25 under section 60A or 61] may be renewed at any time before the end of that period by the grant of a further authorisation.

(3) Subsection (1) has effect in relation to a renewed authorisation as if the period of one month mentioned in that subsection did not begin until the end of the period of one month applicable to the authorisation that is current at the time of the renewal.

[F26 (3A) An authorisation under section 61A ceases to have effect at the end of the period of 3 days beginning with the date on which it is granted.]

[F27 (3B) Where the Investigatory Powers Commissioner has granted an authorisation under section 60A to a relevant public authority—

(a) the Investigatory Powers Commissioner or an officer of the authority may cancel it at any time, and

(b) the Investigatory Powers Commissioner or an officer of the authority must cancel it if the Commissioner or (as the case may be) the officer considers that the requirements of this Part would not be satisfied in relation to granting an equivalent new authorisation.]

(4) A designated senior officer who has granted an authorisation [F28 under section 61 or 61A]—

(a) may cancel it at any time, and

(b) must cancel it if the designated senior officer considers that the requirements of this Part would not be satisfied in relation to granting an equivalent new authorisation.

(5) The Secretary of State may by regulations provide for the person by whom any function under subsection (4) is to be exercised where the person who would otherwise have exercised it is no longer available to do so.

(6) Such regulations may, in particular, provide for the person by whom the function is to be exercised to be a person appointed in accordance with the regulations.

(7) A notice given in pursuance of an authorisation (and any requirement imposed by the notice)—

(a) is not affected by the authorisation subsequently ceasing to have effect under subsection (1) [F29 or (3A)], but

(b) is cancelled if the authorisation is cancelled under [F30 subsection (3B) or (4)].

Textual Amendments

F24 Words in s. 65(1) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(2) (see S.I. 2019/174, reg. 2(c))

F25 Words in s. 65(2) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(3) (see S.I. 2019/174, reg. 2(c))

F26 S. 65(3A) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(4) (see S.I. 2019/174, reg. 2(c))

F27 S. 65(3B) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(5) (see S.I. 2019/174, reg. 2(c))

F28 Words in s. 65(4) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(6) (see S.I. 2019/174, reg. 2(c))

F29 Words in s. 65(7)(a) inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(7)(a) (see S.I. 2019/174, reg. 2(c))

F30 Words in s. 65(7)(b) substituted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 6(7)(b) (see S.I. 2019/174, reg. 2(c))

Commencement Information

I4 S. 65 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)

66 Duties of telecommunications operators in relation to authorisations U.K.

(1) It is the duty of a telecommunications operator on whom a requirement is imposed by notice given in pursuance of an authorisation to comply with that requirement.

(2) It is the duty of a telecommunications operator who is obtaining or disclosing communications data, in response to a request or requirement for the data in pursuance of an authorisation, to obtain or disclose the data in a way that minimises the amount of data that needs to be processed for the purpose concerned.

(3) A person who is under a duty by virtue of subsection (1) or (2) is not required to take any steps in pursuance of that duty which it is not reasonably practicable for that person to take.

(4) For the purposes of subsection (3), where obligations have been imposed on a telecommunications operator (“P”) under section 253 (maintenance of technical capability), the steps which it is reasonably practicable for P to take include every step which it would have been reasonably practicable for P to take if P had complied with all of those obligations.

(5) The duty imposed by subsection (1) or (2) is enforceable by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.

Commencement Information

I5 S. 66 in force at 5.2.2019 by S.I. 2019/174, reg. 2(d)