Police, Crime, Sentencing and Courts Act 2022

CHAPTER 3 Extraction of information from electronic devices

37 Extraction of information from electronic devices: investigations of crime etc

(1) An authorised person may extract information stored on an electronic device from that device if—

(a) a user of the device has voluntarily provided the device to an authorised person, and

(b) that user has agreed to the extraction of information from the device by an authorised person.

(2) The power in subsection (1) may be exercised only for the purposes of—

(a) preventing, detecting, investigating or prosecuting crime,

(b) helping to locate a missing person, or

(c) protecting a child or an at-risk adult from neglect or physical, mental or emotional harm.

(3) The reference in subsection (2) to crime is a reference to—

(a) conduct which constitutes one or more criminal offences in any part of the United Kingdom, or

(b) conduct which, if it took place in any part of the United Kingdom, would constitute one or more criminal offences.

(4) For the purposes of subsection (2) an adult is an at-risk adult if the authorised person reasonably believes that the adult—

(a) is experiencing, or at risk of, neglect or physical, mental or emotional harm, and

(b) is unable to protect themselves against the neglect or harm or the risk of it.

(5) An authorised person may exercise the power in subsection (1) only if—

(a) in a case where the authorised person proposes to exercise the power for a purpose within subsection (2)(a), the authorised person reasonably believes that information stored on the electronic device is relevant to a reasonable line of enquiry which is being, or is to be, pursued by an authorised person,

(b) in a case where the authorised person proposes to exercise the power for a purpose within subsection (2)(b) or (c), the authorised person reasonably believes that information stored on the electronic device is relevant to that purpose, and

(c) in any case, the authorised person is satisfied that exercise of the power is necessary and proportionate to achieve the purpose within subsection (2) for which the person proposes to exercise the power.

(6) Subsection (7) applies if the authorised person thinks that, in exercising the power, there is a risk of obtaining information other than—

(a) information necessary for a purpose within subsection (2) for which the authorised person may exercise the power, or

(b) information necessary for a purpose within subsection (2) of section 41 (investigations of death) for which the authorised person may exercise the power in subsection (1) of that section.

(7) The authorised person must, to be satisfied that the exercise of the power in subsection (1) is proportionate, be satisfied that—

(a) there are no other means of obtaining the information sought by the authorised person which avoid that risk, or

(b) there are such other means, but it is not reasonably practicable to use them.

(8) Subsection (9) applies if the authorised person thinks that, in exercising the power in subsection (1), there is a risk of obtaining confidential information.

(9) The authorised person must, to be satisfied that the exercise of the power is proportionate—

(a) have regard to the matters in subsection (10), and

(b) be satisfied that—

(i) there are no other means of obtaining the information sought by the authorised person which avoid that risk, or

(ii) there are such other means, but it is not reasonably practicable to use them.

(10) The matters referred to in subsection (9)(a) are—

(a) the amount of confidential information likely to be stored on the device, and

(b) the potential relevance of the confidential information to—

(i) a purpose within subsection (2) for which the authorised person may exercise the power, or

(ii) a purpose within subsection (2) of section 41 for which the authorised person may exercise the power in subsection (1) of that section.

(11) An authorised person must have regard to the code of practice for the time being in force under section 42 in exercising, or deciding whether to exercise, the power in subsection (1).

(12) This section does not affect any power relating to the extraction or production of information, or any power to seize any item or obtain any information, conferred by an enactment or rule of law.

(13) In this Chapter—

• “adult” means a person aged 18 or over;

• “authorised person” has the meaning given by subsection (1) of section 44 (subject to subsections (2) and (3) of that section);

• “child” means a person aged under 18;

• “confidential information” has the meaning given by section 43;

• “criminal offence” includes—

  (a)

  a service offence within the meaning of the Armed Forces Act 2006, and

  (b)

  an SDA offence within the meaning of the Armed Forces Act 2006 (Transitional Provisions etc) Order 2009 (S.I. 2009/1059);

• “electronic device” means any device on which information is capable of being stored electronically and includes any component of such a device;

• “enactment” includes—

  (a)

  an enactment contained in subordinate legislation within the meaning of the Interpretation Act 1978,

  (b)

  an enactment contained in, or in an instrument made under, an Act of the Scottish Parliament,

  (c)

  an enactment contained in, or in an instrument made under, an Act or Measure of Senedd Cymru, and

  (d)

  an enactment contained in, or in an instrument made under, Northern Ireland legislation;

• “information” includes moving or still images and sounds;

• “user”, in relation to an electronic device, means a person who ordinarily uses the device.

(14) References in this Chapter to the extraction of information include its reproduction in any form.

(15) This section is subject to sections 38 (children, and adults without capacity), 39 (requirements for voluntary provision and agreement) and 40 (persons who have died etc).

38 Application of section 37 to children and adults without capacity

(1) A child is not to be treated for the purposes of section 37(1) as being capable of—

(a) voluntarily providing an electronic device to an authorised person for those purposes, or

(b) agreeing for those purposes to the extraction of information from the device by an authorised person.

(2) If a child is a user of an electronic device, a person who is not a user of the device but is listed in subsection (3) may—

(a) voluntarily provide the device to an authorised person for the purposes of section 37(1), and

(b) agree for those purposes to the extraction of information from the device by an authorised person.

(3) The persons mentioned in subsection (2) are—

(a) a parent or guardian of the child or, if the child is in the care of a relevant authority or voluntary organisation, a person representing that authority or organisation, or

(b) if no person within paragraph (a) is available, any responsible person who is aged 18 or over other than a relevant authorised person.

(4) Before exercising the power under section 37(1) by virtue of subsection (2), an authorised person must, so far as it is reasonably practicable to do so—

(a) ascertain the views of the child, and

(b) have regard to any views so ascertained, taking account of the child’s age and maturity.

(5) If an authorised person (“A”) exercises the power under section 37(1) as a result of action taken under subsection (2) by a person within subsection (3)(b), A must, unless A considers that it is not appropriate to do so, inform a person within subsection (3)(a) that A has exercised the power.

(6) An adult without capacity is not to be treated for the purposes of section 37(1) as being capable of—

(a) voluntarily providing an electronic device to an authorised person for those purposes, or

(b) agreeing for those purposes to the extraction of information from the device by an authorised person.

(7) If a user of an electronic device is an adult without capacity, a person who is not a user of the device but is listed in subsection (8) may—

(a) voluntarily provide the device to an authorised person for the purposes of section 37(1), and

(b) agree for those purposes to the extraction of information from the device by an authorised person.

(8) The persons mentioned in subsection (7) are—

(a) a parent or guardian of the adult without capacity or, if the adult without capacity is in the care of a relevant authority or voluntary organisation, a person representing that authority or organisation,

(b) a registered social worker,

(c) a person who, under a power of attorney, may make decisions for the purposes of subsection (7)(a) and (b) on behalf of the adult without capacity,

(d) a deputy appointed under section 16 of the Mental Capacity Act 2005 or section 113 of the Mental Capacity Act (Northern Ireland) 2016 who may make decisions for the purposes of subsection (7)(a) and (b) on behalf of the adult without capacity by virtue of that appointment,

(e) a person authorised under an intervention order under section 53 of the Adults with Incapacity (Scotland) Act 2000 (asp 4) who may make decisions for the purposes of subsection (7)(a) and (b) on behalf of the adult without capacity by virtue of that authorisation, or

(f) if no person within any of paragraphs (a) to (e) is available, any responsible person who is aged 18 or over other than a relevant authorised person.

(9) Nothing in this section prevents any other user of an electronic device who is not a child or an adult without capacity from—

(a) voluntarily providing the device to an authorised person for the purposes of section 37(1), or

(b) agreeing for those purposes to the extraction of information from the device by an authorised person.

(10) For the purposes of this Chapter a person is an adult without capacity if—

(a) in relation to England and Wales, the person is an adult who, within the meaning of the Mental Capacity Act 2005, lacks capacity to do the things mentioned in section 37(1)(a) and (b);

(b) in relation to Scotland, the person is an adult (within the meaning of this Chapter) who is incapable within the meaning of the Adults with Incapacity (Scotland) Act 2000 in relation to the matters mentioned in section 37(1)(a) and (b);

(c) in relation to Northern Ireland, the person is an adult who, within the meaning of the Mental Capacity Act (Northern Ireland) 2016, lacks capacity to do the things mentioned in section 37(1)(a) and (b).

(11) In this Chapter—

• “local authority”—

  (a)

  in relation to England, means a county council, a district council for an area for which there is no county council, a London borough council or the Common Council of the City of London in its capacity as a local authority;

  (b)

  in relation to Wales, means a county council or a county borough council;

  (c)

  in relation to Scotland, means a council constituted under section 2 of the Local Government etc (Scotland) Act 1994;

• “registered social worker” means a person registered as a social worker in a register maintained by—

  (a)

  Social Work England,

  (b)

  the Care Council for Wales,

  (c)

  the Scottish Social Services Council, or

  (d)

  the Northern Ireland Social Care Council;

• “relevant authorised person”, in relation to the extraction of information from an electronic device for a particular purpose, means an authorised person who may extract the information from the device for that purpose;

• “relevant authority”—

  (a)

  in relation to England and Wales and Scotland, means a local authority;

  (b)

  in relation to Northern Ireland, means an authority within the meaning of the Children (Northern Ireland) Order 1995 (S.I. 1995/755 (N.I. 2));

• “voluntary organisation”—

  (a)

  in relation to England and Wales, has the same meaning as in the Children Act 1989;

  (b)

  in relation to Scotland, has the same meaning as in Part 2 of the Children (Scotland) Act 1995;

  (c)

  in relation to Northern Ireland, has the same meaning as in the Children (Northern Ireland) Order 1995.

(12) This section is subject to section 39 (requirements for voluntary provision and agreement).

39 Requirements for voluntary provision and agreement

(1) A person (“P”) is to be treated for the purposes of section 37 or 38 as having—

(a) voluntarily provided an electronic device to an authorised person, and

(b) agreed to the extraction of information from the device by an authorised person,

only if the requirements of this section have been met.

(2) An authorised person must not have placed undue pressure on P to provide the device or agree to the extraction of information from it.

(3) An authorised person must have given P notice in writing—

(a) specifying or describing the information that is sought,

(b) specifying the reason why the information is sought,

(c) specifying how the information will be dealt with once it has been extracted,

(d) stating that P may refuse to provide the device or agree to the extraction of information from it, and

(e) stating that the investigation or enquiry for the purposes of which the information is sought will not be brought to an end merely because P refuses to provide the device or agree to the extraction of information from it.

(4) Subject to subsection (5), P must have confirmed in writing that P has—

(a) voluntarily provided the device to an authorised person, and

(b) agreed to the extraction of information from the device by an authorised person.

(5) If P was unable to provide that confirmation in writing as a result of P’s physical impairment or lack of literacy skills—

(a) P must have given that confirmation orally, and

(b) an authorised person must have recorded P’s confirmation in writing.

(6) If P’s confirmation was given in writing and in hard copy form, the authorised person must have given P a copy of that confirmation (in hard copy or electronic form).

(7) If P’s confirmation was given orally, the authorised person must have given P a copy of the record of that confirmation (in hard copy or electronic form).

40 Application of section 37 where user has died etc

(1) If any of conditions A to C is met, an authorised person may exercise the power in section 37(1) to extract information stored on an electronic device from that device even though—

(a) the device has not been voluntarily provided to an authorised person by a user of the device, or

(b) no user of the device has agreed to the extraction of information from the device by an authorised person.

(2) Condition A is that—

(a) a person who was a user of the electronic device has died, and

(b) the person was a user of the device immediately before their death.

(3) Condition B is that—

(a) a user of the electronic device is a child or an adult without capacity, and

(b) an authorised person reasonably believes that the user’s life is at risk or there is a risk of serious harm to the user.

(4) Condition C is that—

(a) a person who was a user of the electronic device is missing,

(b) the person was a user of the device immediately before they went missing, and

(c) an authorised person reasonably believes that the person’s life is at risk or there is a risk of serious harm to the person.

(5) The exercise of the power in subsection (1) of section 37 by virtue of this section is subject to that section.

41 Extraction of information from electronic devices: investigations of death

(1) An authorised person may extract information stored on an electronic device from that device if—

(a) a person who was a user of the electronic device has died, and

(b) the person was a user of the device immediately before their death.

(2) The power in subsection (1) may be exercised only for the purposes of—

(a) an investigation into the person’s death under Chapter 1 of Part 1 of the Coroners and Justice Act 2009,

(b) an inquest into the person’s death under the Coroners Act (Northern Ireland) 1959, or

(c) an investigation into the person’s death by the Lord Advocate.

(3) References in subsection (2) to the exercise of the power in subsection (1) for the purposes of an investigation or inquest include references to the exercise of that power for the purposes of determining whether an investigation should be conducted or an inquest should be held.

(4) An authorised person may exercise the power in subsection (1) only if—

(a) the authorised person reasonably believes that information stored on the electronic device is relevant to a purpose within subsection (2), and

(b) the authorised person is satisfied that exercise of the power is necessary and proportionate to achieve that purpose.

(5) Subsection (6) applies if the authorised person thinks that, in exercising the power, there is a risk of obtaining information other than—

(a) information necessary for a purpose within subsection (2), or

(b) information necessary for a purpose within section 37(2).

(6) The authorised person must, to be satisfied that the exercise of the power is proportionate, be satisfied that—

(a) there are no other means of obtaining the information sought by the authorised person which avoid that risk, or

(b) there are such other means, but it is not reasonably practicable to use them.

(7) Subsection (8) applies if the authorised person thinks that, in exercising the power in subsection (1), there is a risk of obtaining confidential information.

(8) The authorised person must, to be satisfied that the exercise of the power is proportionate—

(a) have regard to the matters in subsection (9), and

(b) be satisfied that—

(i) there are no other means of obtaining the information sought by the authorised person which avoid that risk, or

(ii) there are such other means, but it is not reasonably practicable to use them.

(9) The matters referred to in subsection (8)(a) are—

(a) the amount of confidential information likely to be stored on the device, and

(b) the potential relevance of the confidential information to a purpose within subsection (2) or section 37(2).

(10) An authorised person must have regard to the code of practice for the time being in force under section 42 in exercising, or deciding whether to exercise, the power in subsection (1).

(11) This section does not affect any power relating to the extraction or production of information, or any power to seize any item or obtain any information, conferred by an enactment or rule of law.

42 Code of practice about the extraction of information

(1) The Secretary of State must prepare a code of practice containing guidance about the exercise of the powers in sections 37(1) and 41(1).

(2) The code may make different provision for different purposes or areas.

(3) In preparing the code, the Secretary of State must consult—

(a) the Information Commissioner,

(b) the Scottish Ministers,

(c) the Department of Justice in Northern Ireland,

(d) the Commissioner for Victims and Witnesses,

(e) the Domestic Abuse Commissioner,

(f) the Commission for Victims and Survivors for Northern Ireland, and

(g) such other persons as the Secretary of State considers appropriate.

(4) Subsection (3)(f) does not apply on or after the day appointed under Article 4(4) of the Victims and Survivors (Northern Ireland) Order 2006 (S.I. 2006/2953 (N.I. 17)) (power to revoke Article 4).

(5) After preparing the code, the Secretary of State must lay it before Parliament and publish it.

(6) The code is to be brought into force by regulations made by statutory instrument.

(7) A statutory instrument containing regulations under subsection (6) is subject to annulment in pursuance of a resolution of either House of Parliament.

(8) After the code has come into force the Secretary of State may from time to time revise it.

(9) A failure on the part of an authorised person to act in accordance with the code does not of itself render the person liable to any criminal or civil proceedings.

(10) But the code is admissible in evidence in criminal or civil proceedings and a court may take into account a failure to act in accordance with it in determining a question in the proceedings.

(11) References in subsections (2) to (10) to the code include a revised code, subject to subsection (12).

(12) The duty to consult in subsection (3) does not apply in relation to the preparation of a revised code if the Secretary of State considers that the proposed revisions are insubstantial.

43 Confidential information

(1) In this Chapter “confidential information” means information which constitutes or may constitute—

(a) confidential journalistic material within the meaning of the Investigatory Powers Act 2016 (see section 264(6) and (7) of that Act), or

(b) protected material.

(2) In subsection (1)(b) “protected material”—

(a) in relation to England and Wales means—

(i) items subject to legal privilege, within the meaning of the Police and Criminal Evidence Act 1984 (see section 10 of that Act),

(ii) material falling within section 11(1)(a) of that Act (certain personal records held in confidence), or

(iii) material to which section 14(2) of that Act applies (other material acquired in the course of a trade etc that is held in confidence);

(b) in relation to Scotland means—

(i) items in respect of which a claim to confidentiality of communications could be maintained in legal proceedings, or

(ii) other material of a kind mentioned in paragraph (a)(ii) or (iii) of this subsection;

(c) in relation to Northern Ireland, means—

(i) items subject to legal privilege, within the meaning of the Police and Criminal Evidence (Northern Ireland) Order 1989 (S.I. 1989/1341 (N.I. 12)) (see Article 12 of that Order),

(ii) material falling with Article 13(1)(a) of that Order (certain personal records held in confidence), or

(iii) material to which Article 16(2) of that Order applies (other material acquired in the course of a trade etc that is held in confidence).

44 Authorised persons

(1) Subject to subsections (2) and (3), in this Chapter “authorised person” means a person listed in Schedule 3.

(2) The power in subsection (1) of section 37 may be exercised for a purpose mentioned in subsection (2)(b) or (c) of that section only by a person listed in Part 1 or 2 of Schedule 3.

(3) The power in section 41(1) may be exercised only by a person listed in Part 1 of Schedule 3.

(4) The Secretary of State may by regulations made by statutory instrument amend Schedule 3—

(a) so as to add a reference to a person;

(b) so as to remove a reference to a person;

(c) so as to modify a description of a person mentioned in that Schedule.

(5) Regulations under subsection (4) may contain transitional, transitory or saving provision.

(6) The Secretary of State must consult the Scottish Ministers before making regulations under subsection (4) if and so far as the regulations make provision that would be within the legislative competence of the Scottish Parliament if it were contained in an Act of that Parliament.

(7) The Secretary of State must consult the Department of Justice in Northern Ireland before making regulations under subsection (4) if and so far as the regulations make provision that, if it were contained in an Act of the Northern Ireland Assembly—

(a) would be within the legislative competence of that Assembly, and

(b) would not require the consent of the Secretary of State.

(8) Subject to subsection (9), a statutory instrument containing regulations under subsection (4)(a) (whether alone or with other provision) may not be made unless a draft of the instrument has been laid before and approved by a resolution of each House of Parliament.

(9) Subsection (8) does not apply to a statutory instrument containing regulations which—

(a) remove a reference to a person from Part 1 of Schedule 3 and add a reference to that person to Part 2 or 3 of that Schedule, or

(b) remove a reference to a person from Part 2 of that Schedule and add a reference to that person to Part 3 of that Schedule.

(10) A statutory instrument containing—

(a) regulations under subsection (4)(a) to which subsection (9) applies, or

(b) regulations under subsection (4)(b) or (c),

and which is not a statutory instrument to which subsection (8) applies is subject to annulment in pursuance of a resolution of either House of Parliament.