Investigatory Powers Act 2016

[F1 Issue of authorisations U.K.

Textual Amendments

F1 Pt. 7A inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 2, 32(2); S.I. 2024/1021, reg. 2(b)

226B Individual authorisation U.K.

(1) In this Part “an individual authorisation” is an authorisation that authorises an intelligence service to retain, or to retain and examine, any bulk personal dataset described in the authorisation.

(2) See section 200 (requirement for authorisation) for provision about when an individual authorisation under this Part is required.

(3) The head of an intelligence service, or a person acting on their behalf, may grant an individual authorisation where the conditions in subsections (4) and (5) are met.

This is subject to subsection (6).

(4) The condition in this subsection is that the person granting the authorisation considers that—

(a) section 226A applies to the bulk personal dataset described in the authorisation,

(b) the authorisation is necessary for the purpose of the exercise of any function of the intelligence service,

(c) the conduct being authorised is proportionate to what is sought to be achieved by the conduct, and

(d) there are for the time being in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section 226A applies and for protecting them from unauthorised disclosure.

(5) The condition in this subsection is that the decision to grant the authorisation has been approved by a Judicial Commissioner.

(6) The condition in subsection (5) does not apply where—

(a) the bulk personal dataset described in the individual authorisation falls within a category of bulk personal datasets authorised for the purposes of this Part by a category authorisation (see section 226BA), or

(b) the person granting the individual authorisation considers that there is an urgent need to grant the authorisation.

(7) But subsection (6)(a) does not prevent a person granting an individual authorisation from seeking the approval of a Judicial Commissioner in a case where subsection (6)(a) applies if the person considers that it would be appropriate to seek such approval.

(8) An individual authorisation relating to a bulk personal dataset (“dataset A”) may also authorise the retention or examination of other bulk personal datasets (“replacement datasets”) that do not exist at the time of the grant of the authorisation but may reasonably be regarded as replacements for dataset A.

226BA Category authorisation U.K.

(1) In this Part “a category authorisation” is an authorisation that authorises a category of bulk personal datasets described in the authorisation for the purposes of this Part.

(2) The head of an intelligence service, or a person acting on their behalf, may grant a category authorisation where—

(a) they consider that section 226A applies to any dataset that falls within the category of datasets described in the authorisation, and

(b) the decision to grant the authorisation has been approved by a Judicial Commissioner.

(3) A category authorisation may describe a category of bulk personal datasets by reference to (among other things) the use to which the datasets will be put.

226BB Approval of authorisations by Judicial Commissioners U.K.

(1) In deciding whether to approve a decision to grant an individual authorisation or a category authorisation, a Judicial Commissioner must review the conclusions of the person who granted the authorisation as to the following matters—

(a) in relation to an individual authorisation, whether section 226A applies to the bulk personal dataset described in the authorisation, and

(b) in relation to a category authorisation, whether section 226A applies to any dataset that falls within the category of datasets described in the authorisation.

(2) In doing so, the Judicial Commissioner must—

(a) apply the same principles as would be applied by a court on an application for judicial review, and

(b) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

(3) Where a Judicial Commissioner refuses to approve a decision to grant an individual authorisation or a category authorisation, the Judicial Commissioner must give the person who decided to grant the authorisation written reasons for the refusal.

(4) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to grant an individual authorisation or a category authorisation, the head of the intelligence service, or a person acting on their behalf, may ask the Investigatory Powers Commissioner to decide whether to approve the decision to grant the authorisation.

226BC Approval of individual authorisations granted in urgent cases U.K.

(1) This section applies where—

(a) an individual authorisation is granted without the approval of a Judicial Commissioner, and

(b) the person who granted the authorisation considered that there was an urgent need to grant it.

(2) The person who granted the authorisation must inform a Judicial Commissioner that it has been granted.

(3) The Judicial Commissioner must, before the end of the relevant period—

(a) decide whether to approve the decision to grant the authorisation, and

(b) notify the person who granted the authorisation of the Judicial Commissioner’s decision.

The “relevant period” means the period ending with the third working day after the day on which the authorisation was granted.

(4) Subsections (5) to (7) apply if a Judicial Commissioner refuses to approve the decision to grant an individual authorisation.

(5) The authorisation—

(a) ceases to have effect (unless already cancelled), and

(b) may not be renewed,

and section 226BB(4) does not apply in relation to the refusal to approve the decision.

(6) The head of the intelligence service must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the authorisation stops as soon as possible.

(7) Section 220 (Part 7 initial examinations: time limits) applies in relation to the bulk personal dataset described in the authorisation as if the intelligence service had obtained that dataset at the time when the person who granted the authorisation is notified that the Judicial Commissioner has refused to approve the decision to grant the authorisation.

(8) Nothing in subsection (5) or (6) affects the lawfulness of—

(a) anything done in reliance on the authorisation before it ceases to have effect;

(b) if anything is in the process of being done in reliance on the authorisation when it ceases to have effect—

(i) anything done before that thing could be stopped, or

(ii) anything done that it is not reasonably practicable to stop.]