Part 3Authorisations for obtaining communications data
F1Further provision about authorisations
I162Restrictions in relation to internet connection records
F3A1
The Investigatory Powers Commissioner may not, on the application of a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record.
A2
The Investigatory Powers Commissioner may not, on the application of a relevant public authority which is not a local authority, grant an authorisation under section 60A for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B or C is met.
F41
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2
A designated senior officer of a relevant public authority which is not a local authority may not grant an authorisation for the purpose of obtaining data which is, or can only be obtained by processing, an internet connection record unless condition A, B or C is met.
3
Condition A is that F5the person with power to grant the authorisation considers that it is necessary, for a purpose falling within F6section 60A(7), 61(7) or 61A(7) (as applicable), to obtain the data to identify which person or apparatus is using an internet service where—
a
the service and time of use are already known, but
b
the identity of the person or apparatus using the service is not known.
4
Condition B is that—
a
the purpose for which the data is to be obtained falls within F7section 60A(7), 61(7) or 61A(7) (as applicable) but is not the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a) or the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b), and
b
F8the person with power to grant the authorisation considers that it is necessary to obtain the data to identify—
i
which internet communications service is being used, and when and how it is being used, by a person or apparatus whose identity is already known,
ii
where or when a person or apparatus whose identity is already known is obtaining access to, or running, a computer file or computer program which wholly or mainly involves making available, or acquiring, material whose possession is a crime, or
iii
which internet service is being used, and when and how it is being used, by a person or apparatus whose identity is already known.
5
Condition C is that—
F9a
either—
i
the purpose for which the data is to be obtained is the purpose of preventing or detecting serious crime mentioned in section 60A(8)(a), 61(7A)(a) or 61A(8)(a), or
ii
the purpose for which the data is to be obtained is the purpose of preventing or detecting crime mentioned in section 60A(8)(b), 61(7A)(b) or 61A(8)(b) and the crime to be prevented or detected is serious crime, and
F10b
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
c
F11the person with power to grant the authorisation considers that it is necessary to obtain the data to identify—
i
which internet communications service is being used, and when and how it is being used, by a person or apparatus whose identity is already known,
ii
where or when a person or apparatus whose identity is already known is obtaining access to, or running, a computer file or computer program which wholly or mainly involves making available, or acquiring, material whose possession is a crime, or
iii
which internet service is being used, and when and how it is being used, by a person or apparatus whose identity is already known.
F126
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7
In this Act “internet connection record” means communications data which—
a
may be used to identify, or assist in identifying, a telecommunications service to which a communication is transmitted by means of a telecommunication system for the purpose of obtaining access to, or running, a computer file or computer program, and
b
comprises data generated or processed by a telecommunications operator in the process of supplying the telecommunications service to the sender of the communication (whether or not a person).
I263Additional restrictions on grant of authorisations F2under section 61
1
A designated senior officer may not grant an authorisation F13under section 61 for the purposes of a specific investigation or a specific operation if the officer is working on that investigation or operation.
2
But, if the designated senior officer considers that there are exceptional circumstances which mean that subsection (1) should not apply in a particular case, that subsection does not apply in that case.
3
Examples of exceptional circumstances include—
a
an imminent threat to life or another emergency,
b
the investigation or operation concerned is one where there is an exceptional need, in the interests of national security, to keep knowledge of it to a minimum, F14or
c
there is an opportunity to obtain information where—
i
the opportunity is rare,
ii
the time to act is short, and
iii
the need to obtain the information is significant and in the interests of national security.
F15d
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
I364Procedure for authorisations and authorised notices
1
An authorisation must specify—
F17a
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
F18aa
whether the authorisation has been granted by the Investigatory Powers Commissioner under section 60A or by a designated senior officer under section 61 or 61A;
b
the matters falling within F19section 60A(7), 61(7) or 61A(7) (as applicable) by reference to which it is granted,
c
the conduct that is authorised,
d
the data or description of data to be obtained, and
e
the persons or descriptions of persons to whom the data is to be, or may be, disclosed or how to identify such persons.
F161A
An authorisation granted by a designated senior officer under section 61 or 61A must also specify the office, rank or position held by the officer.
2
An authorisation which authorises a person to impose requirements by notice on a telecommunications operator must also specify—
a
the operator concerned, and
b
the nature of the requirements that are to be imposed,
but need not specify the other contents of the notice.
3
The notice itself—
a
must specify—
i
the office, rank or position held by the person giving it,
ii
the requirements that are being imposed, and
iii
the telecommunications operator on whom the requirements are being imposed, and
b
must be given in writing or (if not in writing) in a manner that produces a record of its having been given.
4
An authorisation must be applied for, and granted, in writing or (if not in writing) in a manner that produces a record of its having been applied for or granted.
I465Duration and cancellation of authorisations and notices
1
An authorisation F22under section 60A or 61 ceases to have effect at the end of the period of one month beginning with the date on which it is granted.
2
An authorisation F23under section 60A or 61 may be renewed at any time before the end of that period by the grant of a further authorisation.
3
Subsection (1) has effect in relation to a renewed authorisation as if the period of one month mentioned in that subsection did not begin until the end of the period of one month applicable to the authorisation that is current at the time of the renewal.
F203A
An authorisation under section 61A ceases to have effect at the end of the period of 3 days beginning with the date on which it is granted.
F213B
Where the Investigatory Powers Commissioner has granted an authorisation under section 60A to a relevant public authority—
a
the Investigatory Powers Commissioner or an officer of the authority may cancel it at any time, and
b
the Investigatory Powers Commissioner or an officer of the authority must cancel it if the Commissioner or (as the case may be) the officer considers that the requirements of this Part would not be satisfied in relation to granting an equivalent new authorisation.
4
A designated senior officer who has granted an authorisation F24under section 61 or 61A—
a
may cancel it at any time, and
b
must cancel it if the designated senior officer considers that the requirements of this Part would not be satisfied in relation to granting an equivalent new authorisation.
5
The Secretary of State may by regulations provide for the person by whom any function under subsection (4) is to be exercised where the person who would otherwise have exercised it is no longer available to do so.
6
Such regulations may, in particular, provide for the person by whom the function is to be exercised to be a person appointed in accordance with the regulations.
7
A notice given in pursuance of an authorisation (and any requirement imposed by the notice)—
a
is not affected by the authorisation subsequently ceasing to have effect under subsection (1) F25or (3A), but
b
is cancelled if the authorisation is cancelled under F26subsection (3B) or (4).
I566Duties of telecommunications operators in relation to authorisations
1
It is the duty of a telecommunications operator on whom a requirement is imposed by notice given in pursuance of an authorisation to comply with that requirement.
2
It is the duty of a telecommunications operator who is obtaining or disclosing communications data, in response to a request or requirement for the data in pursuance of an authorisation, to obtain or disclose the data in a way that minimises the amount of data that needs to be processed for the purpose concerned.
3
A person who is under a duty by virtue of subsection (1) or (2) is not required to take any steps in pursuance of that duty which it is not reasonably practicable for that person to take.
4
For the purposes of subsection (3), where obligations have been imposed on a telecommunications operator (“P”) under section 253 (maintenance of technical capability), the steps which it is reasonably practicable for P to take include every step which it would have been reasonably practicable for P to take if P had complied with all of those obligations.
5
The duty imposed by subsection (1) or (2) is enforceable by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.
S. 62 cross-heading inserted (5.2.2019) by The Data Retention and Acquisition Regulations 2018 (S.I. 2018/1123), reg. 1(4)(d)(5), Sch. 1 para. 2 (see S.I. 2019/174, reg. 2(c))