Investigatory Powers Act 2016

CHAPTER 1 U.K. Miscellaneous

Combined warrants and authorisations U.K.

248 Combination of warrants and authorisations U.K.

Schedule 8 (which makes provision for the combination of certain warrants and authorisations in a single instrument) has effect.

Commencement Information

I1 S. 248 in force at 31.5.2018 for specified purposes by S.I. 2018/652, reg. 6(a)

I2 S. 248 in force at 27.6.2018 for specified purposes by S.I. 2018/652, reg. 12(d)

I3 S. 248 in force at 30.8.2018 for specified purposes by S.I. 2018/940, reg. 2(1)(d) (with reg. 2(2))

I4 S. 248 in force at 26.9.2018 for specified purposes by S.I. 2018/940, reg. 3(f)

I5 S. 248 in force at 28.11.2018 for specified purposes by S.I. 2018/1246, reg. 2(g)

I6 S. 248 in force at 5.12.2018 in so far as not already in force by S.I. 2018/1246, reg. 3(i)

Compliance with Act U.K.

249 Payments towards certain compliance costs U.K.

(1) The Secretary of State must ensure that arrangements are in force for securing that telecommunications operators and postal operators receive an appropriate contribution in respect of such of their relevant costs as the Secretary of State considers appropriate.

(2) In subsection (1) “relevant costs” means costs incurred, or likely to be incurred, by telecommunications operators and postal operators in complying with this Act.

(3) The arrangements may provide for payment of a contribution to be subject to terms and conditions determined by the Secretary of State.

(4) Such terms and conditions may, in particular, include a condition on the operator concerned to comply with any audit that may reasonably be required to monitor the claim for costs.

(5) The arrangements may provide for the Secretary of State to determine—

(a) the scope and extent of the arrangements, and

(b) the appropriate level of contribution which should be made in each case.

(6) Different levels of contribution may apply for different cases or descriptions of case but the appropriate contribution must never be nil.

(7) A retention notice under Part 4 given to a telecommunications operator or a postal operator, or a national security notice under section 252 given to a telecommunications operator, must specify the level or levels of contribution which the Secretary of State has determined should be made in respect of the costs incurred, or likely to be incurred, by the operator as a result of the notice in complying with that Part or (as the case may be) with the national security notice.

(8) For the purpose of complying with this section the Secretary of State may make, or arrange for the making of, payments out of money provided by Parliament.

Commencement Information

I7 S. 249 in force at 30.12.2016 for specified purposes by S.I. 2016/1233, reg. 2(o)

I8 S. 249 in force at 12.3.2018 for specified purposes by S.I. 2018/341, reg. 2(e)

I9 S. 249 in force at 27.6.2018 in so far as not already in force by S.I. 2018/652, reg. 12(a)

250 Power to develop compliance systems etc. U.K.

(1) The Secretary of State may—

(a) develop, provide, maintain or improve, or

(b) enter into financial or other arrangements with any person for the development, provision, maintenance or improvement of,

such apparatus, systems or other facilities or services as the Secretary of State considers appropriate for enabling or otherwise facilitating compliance by the Secretary of State, another public authority or any other person with this Act.

(2) Arrangements falling within subsection (1)(b) may, in particular, include arrangements consisting of the giving of financial assistance by the Secretary of State.

(3) Such financial assistance—

(a) may, in particular, be given by way of—

(i) grant,

(ii) loan,

(iii) guarantee or indemnity,

(iv) investment, or

(v) incurring expenditure for the benefit of the person assisted, and

(b) may be given subject to terms and conditions determined by the Secretary of State.

(4) Terms and conditions imposed by virtue of subsection (3)(b) may include terms and conditions as to repayment with or without interest.

Commencement Information

I10 S. 250 in force at 13.2.2017 by S.I. 2017/137, reg. 2(q)

Additional powers U.K.

251 Amendments of the Intelligence Services Act 1994 U.K.

(1) The Intelligence Services Act 1994 is amended as follows.

(2) In section 3 (the Government Communications Headquarters)—

(a) in subsection (1)(a), after “monitor” insert “ , make use of ”, and

(b) in the words following subsection (1)(b)(ii), for the words from “or to any other organisation” to the end substitute “ or, in such cases as it considers appropriate, to other organisations or persons, or to the general public, in the United Kingdom or elsewhere. ”

(3) In section 5 (warrants: general)—

(a) in subsection (2), omit “, subject to subsection (3) below,”,

(b) omit subsection (3), and

(c) in subsection (3A), after “1989” insert “ , or on the application of the Intelligence Service or GCHQ for the purposes of the exercise of their functions by virtue of section 1(2)(c) or 3(2)(c), ”.

Commencement Information

I11 S. 251 in force at 13.2.2017 by S.I. 2017/137, reg. 2(r)

252 National security notices U.K.

(1) The Secretary of State may give any telecommunications operator in the United Kingdom a national security notice under this section if—

(a) the Secretary of State considers that the notice is necessary in the interests of national security,

(b) the Secretary of State considers that the conduct required by the notice is proportionate to what is sought to be achieved by that conduct, and

(c) the decision to give the notice has been approved by a Judicial Commissioner.

(2) A “national security notice” is a notice requiring the operator to take such specified steps as the Secretary of State considers necessary in the interests of national security.

(3) A national security notice may, in particular, require the operator to whom it is given—

(a) to carry out any conduct, including the provision of services or facilities, for the purpose of—

(i) facilitating anything done by an intelligence service under any enactment other than this Act, or

(ii) dealing with an emergency (within the meaning of Part 1 of the Civil Contingencies Act 2004);

(b) to provide services or facilities for the purpose of assisting an intelligence service to carry out its functions more securely or more effectively.

(4) In a case where—

(a) a national security notice would require the taking of any steps, and

(b) in the absence of such a notice requiring the taking of those steps, the taking of those steps would be lawful only if a warrant or authorisation under a relevant enactment had been obtained,

the notice may require the taking of those steps only if such a warrant or authorisation has been obtained.

(5) But the Secretary of State may not give any telecommunications operator a national security notice the main purpose of which is to require the operator to do something for which a warrant or authorisation under a relevant enactment is required.

(6) In this section “relevant enactment” means—

(a) this Act;

(b) the Intelligence Services Act 1994;

(c) the Regulation of Investigatory Powers Act 2000;

(d) the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp 11).

(7) A national security notice must specify such period as appears to the Secretary of State to be reasonable as the period within which the steps specified in the notice are to be taken.

(8) Conduct required by a national security notice is to be treated as lawful for all purposes (to the extent that it would not otherwise be so treated).

(9) Sections 254 to 258 contain further provision about national security notices.

Commencement Information

I12 S. 252 in force at 12.3.2018 by S.I. 2018/341, reg. 2(f)

253 Technical capability notices U.K.

(1) The Secretary of State may give a relevant operator a technical capability notice under this section if—

(a) the Secretary of State considers that the notice is necessary for securing that the operator [F1 or another relevant operator] has the capability to provide any assistance which [F2 such operator] may be required to provide in relation to any relevant authorisation,

(b) the Secretary of State considers that the conduct required by the notice is proportionate to what is sought to be achieved by that conduct, and

(c) the decision to give the notice has been approved by a Judicial Commissioner.

(2) A “technical capability notice” is a notice—

(a) imposing on the relevant operator [F3 (to whom the notice is given)] any applicable obligations specified in the notice, and

(b) requiring the person to take all the steps specified in the notice for the purpose of complying with those obligations.

(3) In this section—

• “applicable obligation”, in relation to a relevant operator of a particular description, means an obligation specified by the Secretary of State in regulations as an obligation that may be imposed on relevant operators, or on relevant operators of that description;

• “relevant authorisation” means—

  (a)

  any warrant issued under Part 2, 5 or 6, or

  (b)

  any authorisation or notice given under Part 3;

• “relevant operator” means—

  (a)

  a postal operator,

  (b)

  a telecommunications operator, or

  (c)

  a person who is proposing to become a postal operator or a telecommunications operator.

(4) Regulations under this section may specify an obligation that may be imposed on any relevant operators only if the Secretary of State considers it is reasonable to do so for the purpose of securing—

(a) that it is (and remains) practicable to impose requirements on those relevant operators to provide assistance in relation to relevant authorisations, and

(b) that it is (and remains) practicable for those relevant operators to comply with those requirements.

(5) The obligations that may be specified in regulations under this section include, among other things—

(a) obligations to provide facilities or services of a specified description;

(b) obligations relating to apparatus owned or operated by a relevant operator;

(c) obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data;

(d) obligations relating to the security of any postal or telecommunications services provided by a relevant operator;

(e) obligations relating to the handling or disclosure of any information.

(6) Before making any regulations under this section, the Secretary of State must consult the following persons—

(a) the Technical Advisory Board,

(b) persons appearing to the Secretary of State to be likely to be subject to any obligations specified in the regulations,

(c) persons representing persons falling within paragraph (b), and

(d) persons with statutory functions in relation to persons falling within that paragraph.

(7) A technical capability notice—

(a) must specify such period as appears to the Secretary of State to be reasonable as the period within which the steps specified in the notice are to be taken, and

(b) may specify different periods in relation to different steps.

(8) A technical capability notice may be given to persons outside the United Kingdom (and may require things to be done, or not to be done, outside the United Kingdom).

(9) Sections 254 to 258 contain further provision about technical capability notices.

Textual Amendments

F1 Words in s. 253(1)(a) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 19(3)(a)(i), 32(2); S.I. 2024/1021, reg. 2(r)

F2 Words in s. 253(1)(a) substituted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 19(3)(a)(ii), 32(2); S.I. 2024/1021, reg. 2(r)

F3 Words in s. 253(2)(a) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 19(3)(b), 32(2); S.I. 2024/1021, reg. 2(r)

Modifications etc. (not altering text)

C1 S. 253(3) modified (8.3.2018) by The Investigatory Powers Act 2016 (Commencement No. 4 and Transitional and Saving Provisions) Regulations 2018 (S.I. 2018/341), reg. 6(1)(a)(2) (as amended (29.5.2018) by The Investigatory Powers Act 2016 (Commencement No. 5 and Transitional and Saving Provisions) Regulations 2018 (S.I. 2018/652), reg. 27)

Commencement Information

I13 S. 253(1)(2)(7)-(9) in force at 12.3.2018 by S.I. 2018/341, reg. 2(g)

I14 S. 253(3)-(6) in force at 13.2.2017 by S.I. 2017/137, reg. 2(s) (with reg. 3)

254 Approval of notices by Judicial Commissioners U.K.

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) In deciding whether to approve a decision to give a relevant notice, a Judicial Commissioner must review the Secretary of State's conclusions as to the following matters—

(a) whether the notice is necessary as mentioned in section 252(1)(a) or (as the case may be) section 253(1)(a), and

(b) whether the conduct that would be required by the notice is proportionate to what is sought to be achieved by that conduct.

(3) In doing so, the Judicial Commissioner must—

(a) apply the same principles as would be applied by a court on an application for judicial review, and

(b) consider the matters referred to in subsection (2) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

(4) Where a Judicial Commissioner refuses to approve a decision to give a relevant notice, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.

(5) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to give a relevant notice, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to give the notice.

Commencement Information

I15 S. 254 in force at 12.3.2018 by S.I. 2018/341, reg. 2(h)

255 Further provision about notices under section 252 or 253 U.K.

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) Before giving a relevant notice to a person, the Secretary of State must consult that person.

(3) Before giving a relevant notice, the Secretary of State must, among other matters, take into account—

(a) the likely benefits of the notice,

(b) the likely number of users (if known) of any postal or telecommunications service to which the notice relates,

(c) the technical feasibility of complying with the notice,

(d) the likely cost of complying with the notice, and

(e) any other effect of the notice on the person (or description of person) to whom it relates.

(4) In the case of a technical capability notice that would impose any obligations relating to the removal by a person of electronic protection applied by or on behalf of that person to any communications or data, in complying with subsection (3) the Secretary of State must in particular take into account the technical feasibility, and likely cost, of complying with those obligations.

(5) A relevant notice must be in writing.

[F4 (5A) A relevant notice ceases to have effect at the end of the relevant period unless before the end of that period—

(a) it is varied in accordance with section 256(4)(c) or (5)(c) so as to impose further requirements on the person to whom the notice was given,

(b) it is renewed (see section 256A), or

(c) it is revoked or otherwise ceases to have effect (see section 256).

(5B) In subsection (5A) the “relevant period” means the period of two years beginning with—

(a) in the case of a relevant notice that has not been varied as mentioned in subsection (5A)(a) or renewed, the day on which the notice was given, or

(b) in the case of a relevant notice that has been so varied or renewed, the day after the day at the end of which the relevant notice would have ceased to have effect if it had not been so varied or renewed.]

(6) A technical capability notice may be given to a person outside the United Kingdom in any of the following ways (as well as by electronic or other means of giving a notice)—

(a) by delivering it to the person's principal office within the United Kingdom or, if the person has no such office in the United Kingdom, to any place in the United Kingdom where the person carries on business or conducts activities;

(b) if the person has specified an address in the United Kingdom as one at which the person, or someone on the person's behalf, will accept documents of the same description as a notice, by delivering it to that address.

(7) The Secretary of State may by regulations make further provision about the giving of relevant notices.

(8) A person to whom a relevant notice is given, or any person employed or engaged for the purposes of that person's business, must not disclose the existence or contents of the notice to any other person without the permission of the Secretary of State.

(9) A person to whom a relevant notice is given must comply with the notice.

(10) The duty imposed by subsection (9) is enforceable—

(a) in relation to a person in the United Kingdom, and

(b) so far as relating to a technical capability notice within subsection (11), in relation to a person outside the United Kingdom,

by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.

(11) A technical capability notice is within this subsection if it relates to any of the following—

(a) a targeted interception warrant or mutual assistance warrant under Chapter 1 of Part 2;

(b) a bulk interception warrant;

(c) an authorisation or notice given under Part 3.

(12) Subsection (9) applies to a person to whom a national security notice is given despite any other duty imposed on the person by or under Part 1, or Chapter 1 of Part 2, of the Communications Act 2003.

Textual Amendments

F4 S. 255(5A)(5B) inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 20(6), 32(2); S.I. 2024/1021, reg. 2(s) (with regs. 3, 4)

Commencement Information

I16 S. 255 in force at 12.3.2018 by S.I. 2018/341, reg. 2(i) (with reg. 6(1)(b))

256 Variation and revocation of notices U.K.

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) The Secretary of State must keep each relevant notice under review.

(3) The Secretary of State may—

(a) vary a relevant notice;

(b) revoke a relevant notice (whether wholly or in part).

(4) The Secretary of State may vary a national security notice given to a person only if—

(a) the Secretary of State considers that the variation is necessary in the interests of national security,

(b) the Secretary of State considers that the conduct required by the notice as varied is proportionate to what is sought to be achieved by that conduct, and

(c) if the variation would impose further requirements on the person, the decision to vary the notice has been approved by a Judicial Commissioner (but see subsection (6)).

(5) The Secretary of State may vary a technical capability notice given to a person only if—

(a) the Secretary of State considers that the variation is necessary for securing that the person has the capability to provide any assistance which the person may be required to provide in relation to any relevant authorisation (within the meaning of section 253),

(b) the Secretary of State considers that the conduct required by the notice as varied is proportionate to what is sought to be achieved by that conduct, and

(c) if the variation would impose further requirements on the person, the decision to vary the notice has been approved by a Judicial Commissioner (but see subsection (6)).

(6) The condition in subsection (4)(c) or (as the case may be) subsection (5)(c) does not apply in the case of a variation to which section 257(10) applies.

(7) If the Secretary of State varies or revokes a relevant notice given to any person, the Secretary of State must give that person notice of the variation or revocation.

(8) Section 254 (approval of notices by Judicial Commissioners) applies in relation to a decision to vary a relevant notice (other than a decision to which section 257(10) applies) as it applies in relation to a decision to give a relevant notice, but as if—

(a) the reference in section 254(2)(a) to the notice were to the variation, and

(b) the reference in section 254(2)(b) to the notice were to the notice as varied.

(9) Subsections (2) to (4) and (7) of section 255 apply in relation to varying or revoking a relevant notice as they apply in relation to giving a relevant notice (and in the application of section 255(3) and (4) in relation to varying a relevant notice, references to the notice are to be read as references to the notice as varied).

(10) Subsections (5) and (6) of section 255 apply to any notice of the variation or revocation of a relevant notice as they apply to a relevant notice.

(11) The fact that a relevant notice has been revoked in relation to a particular person (or description of persons) does not prevent the giving of another relevant notice of the same kind in relation to the same person (or description of persons).

(12) Any reference in this section or section 255(8) to (12) to a notice given under section 252 or 253 includes a reference to such a notice as varied under this section.

Commencement Information

I17 S. 256 in force at 12.3.2018 by S.I. 2018/341, reg. 2(j)

[F5 256A Renewal of notices U.K.

(1) If the renewal conditions are met, a relevant notice may be renewed, at any time during the renewal period, by a notice given by the Secretary of State.

(2) The renewal conditions for a national security notice given under section 252 are that—

(a) the Secretary of State considers that the notice is still necessary in the interests of national security,

(b) the Secretary of State considers that the conduct required by the notice is still proportionate to what is sought to be achieved by that conduct, and

(c) the decision to renew the notice has been approved by a Judicial Commissioner.

(3) The renewal conditions for a technical capability notice given under section 253 are that—

(a) the Secretary of State considers that the notice is still necessary for securing that the relevant operator has the capability to provide any assistance which the operator may be required to provide in relation to any relevant authorisation,

(b) the Secretary of State considers that the conduct required by the notice is still proportionate to what is sought to be achieved by that conduct, and

(c) the decision to renew the notice has been approved by a Judicial Commissioner.

(4) The renewal period means the period of 30 days ending with the day at the end of which the relevant notice would otherwise cease to have effect.

(5) If the Secretary of State renews a relevant notice given to any person, the Secretary of State must give that person notice in writing of the renewal.

(6) Sections 254, 255(2) to (4) and (7) and 257 apply in relation to the renewal of a relevant notice as they apply in relation to the giving of a relevant notice.

(7) Section 255(6) applies to any notice of the renewal of a technical capability notice as it applies to a technical capability notice.

(8) In this section—

• “relevant authorisation” has the meaning given by section 253;

• “relevant notice” means—

  (a)

  a national security notice under section 252, or

  (b)

  a technical capability notice under section 253;

• “relevant operator” has the meaning given by section 253.]

Textual Amendments

F5 S. 256A inserted (14.10.2024) by Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 20(7), 32(2); S.I. 2024/1021, reg. 2(s) (with regs. 3, 4)

257 Review of notices by the Secretary of State U.K.

(1) A person who is given a notice under section 252 or 253 may, within such period or circumstances as may be provided for by regulations made by the Secretary of State, refer the notice back to the Secretary of State.

(2) Such a reference may be in relation to the whole of a notice or any aspect of it.

(3) There is no requirement for a person who has referred a notice under subsection (1) to comply with the notice, so far as referred, until the Secretary of State has reviewed the notice in accordance with subsection (4).

(4) The Secretary of State must review any notice so far as referred to the Secretary of State under subsection (1).

(5) Before deciding the review, the Secretary of State must consult—

(a) the Technical Advisory Board, and

(b) a Judicial Commissioner.

(6) The Board must consider the technical requirements and the financial consequences, for the person who has made the reference, of the notice so far as referred.

(7) The Commissioner must consider whether the notice so far as referred is proportionate.

(8) The Board and the Commissioner must—

(a) give the person concerned and the Secretary of State the opportunity to provide evidence, or make representations, to them before reaching their conclusions, and

(b) report their conclusions to—

(i) the person, and

(ii) the Secretary of State.

(9) The Secretary of State may, after considering the conclusions of the Board and the Commissioner—

(a) vary or revoke the notice under section 256, or

(b) give a notice under this section to the person confirming its effect.

(10) But the Secretary of State may vary the notice, or give a notice under subsection (9)(b) confirming its effect, only if the Secretary of State's decision to do so has been approved by the Investigatory Powers Commissioner.

(11) Subsections (5) to (8) of section 255 apply in relation to a notice under subsection (9)(b) above as they apply in relation to a notice under section 252 or 253.

(12) Any reference in this section or section 258 to a notice under section 252 or 253 includes such a notice as varied under section 256, but only so far as the variation is concerned.

But it does not include a notice varied as mentioned in subsection (9)(a) above.

Commencement Information

I18 S. 257 in force at 12.3.2018 by S.I. 2018/341, reg. 2(k)

258 Approval of notices following review under section 257 U.K.

(1) In this section “relevant notice” means—

(a) a national security notice under section 252, or

(b) a technical capability notice under section 253.

(2) In deciding whether to approve a decision to vary a relevant notice as mentioned in section 257(9)(a), or to give a notice under section 257(9)(b) confirming the effect of a relevant notice, the Investigatory Powers Commissioner must review the Secretary of State's conclusions as to the following matters—

(a) whether the relevant notice as varied or confirmed is necessary as mentioned in section 252(1)(a) or (as the case may be) section 253(1)(a), and

(b) whether the conduct required by the relevant notice, as varied or confirmed, is proportionate to what is sought to be achieved by that conduct.

(3) In doing so, the Investigatory Powers Commissioner must—

(a) apply the same principles as would be applied by a court on an application for judicial review, and

(b) consider the matters referred to in subsection (2) with a sufficient degree of care as to ensure that the Investigatory Powers Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

(4) Where the Investigatory Powers Commissioner refuses to approve a decision to vary a relevant notice as mentioned in section 257(9)(a), or to give a notice under section 257(9)(b) confirming the effect of a relevant notice, the Investigatory Powers Commissioner must give the Secretary of State written reasons for the refusal.

Commencement Information

I19 S. 258 in force at 12.3.2018 by S.I. 2018/341, reg. 2(l)

Wireless telegraphy U.K.

259 Amendments of the Wireless Telegraphy Act 2006 U.K.

(1) The Wireless Telegraphy Act 2006 is amended as follows.

(2) Section 48 (interception and disclosure of messages) is amended as follows.

(3) In subsection (1), for “otherwise than under the authority of a designated person” substitute “ without lawful authority ”.

(4) After subsection (3) insert—

“(3A) A person does not commit an offence under this section consisting in any conduct if the conduct—

(a) constitutes an offence under section 3(1) of the Investigatory Powers Act 2016 (offence of unlawful interception), or

(b) would do so in the absence of any lawful authority (within the meaning of section 6 of that Act).”

(5) Omit subsection (5).

(6) Omit section 49 (interception authorities).

(7) In consequence of the repeal made by subsection (6)—

(a) in sections 50(5) and 119(2)(a), for “49” substitute “ 48 ”;

(b) in section 121(2), omit paragraph (b).

Commencement Information

I20 S. 259 in force at 27.6.2018 by S.I. 2018/652, reg. 12(b) (with reg. 20)