Investigatory Powers (Amendment) Act 2024

Part 4 U.K. Notices

Retention notices U.K.

16 Powers to require retention of certain data U.K.

(1) Section 87 of the Investigatory Powers Act 2016 (powers to require retention of certain data) is amended as follows.

(2) In subsection (4)—

(a) in the words before paragraph (a), after “data” insert “, other than data which is, or can only be obtained by processing, an internet connection record,”;

(b) in paragraph (a), after “provided” insert “(solely or jointly with another person)”;

(c) after paragraph (a) insert—

“(aa) does not relate to a relevant roaming service,”.

(3) After subsection (4) insert—

“(4A) In subsection (4) “relevant roaming service” means a telecommunications service provided by the system operator under an agreement with a telecommunications operator outside the United Kingdom (the “non-UK operator”) which facilitates the use by persons in the United Kingdom of the system operator’s telecommunication system to access one or more telecommunications services of the non-UK operator.”

(4) In subsection (11), in the words after paragraph (e)—

(a) for “and” substitute “(and”;

(b) for “records” substitute “records)”.

Commencement Information

I1 S. 16 not in force at Royal Assent, see s. 32(2)

I2 S. 16 in force at 14.10.2024 by S.I. 2024/1021, reg. 2(p)

17 Extra-territorial enforcement of retention notices etc U.K.

(1) Part 4 of the Investigatory Powers Act 2016 is amended as follows.

(2) In section 95 (enforcement of notices and certain other requirements and restrictions), in subsection (5), after “enforceable” insert “(whether or not the person is in the United Kingdom)”.

(3) In section 97 (extra-territorial application of Part 4), omit subsection (2).

Commencement Information

I3 S. 17 not in force at Royal Assent, see s. 32(2)

I4 S. 17 in force at 14.10.2024 by S.I. 2024/1021, reg. 2(q)

Retention, national security and technical capability notices U.K.

Prospective

18 Review of notices by the Secretary of State U.K.

(1) The Investigatory Powers Act 2016 is amended as follows.

(2) In section 90 (retention notices: review by the Secretary of State)—

(a) for subsection (4) substitute—

“(4) Where a telecommunications operator refers a retention notice under subsection (1)—

(a) there is no requirement for the operator to comply with the notice, so far as referred, and

(b) subsection (4A) applies to the operator,

until the Secretary of State has reviewed the notice in accordance with subsection (5).

(4A) Where this subsection applies to a telecommunications operator, the operator must not make any relevant changes to telecommunications services or telecommunication systems to which obligations imposed by the retention notice relate.

(4B) In subsection (4A) “relevant change” means a change that, if implemented, would have a negative effect on the capability of the operator to provide any assistance which the operator may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act.”;

(b) in subsection (5)—

(i) after “must” insert “, before the end of the review period,”;

(ii) after “(1)” insert “(and accordingly decide what action to take under subsection (10))”;

(c) after subsection (5) insert—

“(5A) In subsection (5) “the review period” means—

(a) such period as may be provided for by regulations made by the Secretary of State, or

(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (14)), such extended period.”;

(d) after subsection (9) insert—

“(9A) The Commissioner may give a direction to the operator concerned or the Secretary of State specifying the period within which the operator or the Secretary of State (as the case may be) may provide evidence, or make representations, in accordance with subsection (9)(a).

(9B) If the Commissioner gives such a direction to the operator or the Secretary of State, the Board and the Commissioner are not required to take into account any evidence provided, or representations made, by the operator or the Secretary of State (as the case may be) after the end of that period.”;

(e) in subsection (10)—

(i) for “may” substitute “must”;

(ii) after “Commissioner” insert “but before the end of the relevant period, decide whether to”;

(f) after subsection (11) insert—

“(11A) In subsection (10) “the relevant period” means—

(a) such period as may be provided for by regulations made by the Secretary of State, or

(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (15)), such extended period.”;

(g) after subsection (13) insert—

“(14) Regulations under subsection (5A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State where the extension is agreed by the Secretary of State, the telecommunications operator concerned and a Judicial Commissioner.

(15) Regulations under subsection (11A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State—

(a) where the Secretary of State considers that there are exceptional circumstances that justify the extension, or

(b) in any other circumstances specified in the regulations.

(16) Where regulations under subsection (11A)(a) include provision mentioned in subsection (15), the regulations must also include provision requiring the Secretary of State to notify a Judicial Commissioner and the telecommunications operator concerned of the duration of any extended period.”

(3) In section 95(5) (enforcement of retention notices etc), after “or (2)” insert “, or under section 90(4A),”.

(4) In section 255(10) (enforcement of national security notices and technical capability notices), in the opening words, for “subsection (9)” substitute “subsection (8) or (9), or by section 257(3A),”.

(5) In section 257 (national security notices and technical capability notices: review by the Secretary of State)—

(a) for subsection (3) substitute—

“(3) Where a person who is given a notice under section 252 or 253 refers the notice under subsection (1)—

(a) there is no requirement for the person to comply with the notice, so far as referred, and

(b) subsection (3A) applies to the person,

until the Secretary of State has reviewed the notice in accordance with subsection (4).

(3A) Where this subsection applies to a person, the person must not make any relevant changes to telecommunications or postal services, or telecommunication systems, to which obligations imposed by the notice given under section 252 or 253 relate.

(3B) In subsection (3A) “relevant change” means a change that, if implemented, would have a negative effect on the capability of the person to provide any assistance which the person may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act.”;

(b) in subsection (4)—

(i) after “must” insert “, before the end of the review period,”;

(ii) after “(1)” insert “(and accordingly decide what action to take under subsection (9))”;

(c) after subsection (4) insert—

“(4A) In subsection (4) “the review period” means—

(a) such period as may be provided for by regulations made by the Secretary of State, or

(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (13)), such extended period.”;

(d) after subsection (8) insert—

“(8A) The Commissioner may give a direction to the person concerned or the Secretary of State specifying the period within which the person or the Secretary of State (as the case may be) may provide evidence, or make representations, in accordance with subsection (8)(a).

(8B) If the Commissioner gives such a direction to the person or the Secretary of State, the Board and the Commissioner are not required to take into account any evidence provided, or representations made, by the person or the Secretary of State (as the case may be) after the end of that period.”;

(e) in subsection (9)—

(i) for “may” substitute “must”;

(ii) after “Commissioner” insert “but before the end of the relevant period, decide whether to”;

(f) after subsection (10) insert—

“(10A) In subsection (9) “the relevant period” means—

(a) such period as may be provided for by regulations made by the Secretary of State, or

(b) if that period is extended by the Secretary of State in accordance with the regulations (see subsection (14)), such extended period.”;

(g) after subsection (12) insert—

“(13) Regulations under subsection (4A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State where the extension is agreed by the Secretary of State, the person concerned and a Judicial Commissioner.

(14) Regulations under subsection (10A)(a) may include provision enabling any period provided for by the regulations to be extended by the Secretary of State—

(a) where the Secretary of State considers that there are exceptional circumstances that justify the extension, or

(b) in any other circumstances specified in the regulations.

(15) Where regulations under subsection (10A)(a) include provision mentioned in subsection (14), the regulations must also include provision requiring the Secretary of State to notify a Judicial Commissioner and the person concerned of the duration of any extended period.”

(6) In section 267(3) (regulations: affirmative procedure)—

(a) in paragraph (e), after “90(1)” insert “, (5A)(a) or (11A)(a)”;

(b) in paragraph (j), after “257(1)” insert “, (4A)(a) or (10A)(a)”.

Commencement Information

I5 S. 18 not in force at Royal Assent, see s. 32(2)

19 Meaning of “telecommunications operator” etc U.K.

(1) The Investigatory Powers Act 2016 is amended as follows.

(2) In section 261(10) (meaning of “telecommunications operator”)—

(a) omit the “or” after paragraph (a);

(b) after paragraph (b) insert “, or

(c) controls or provides a telecommunication system which—

(i) is not (wholly or partly) in, or controlled from, the United Kingdom, and

(ii) is used by another person to offer or provide a telecommunications service to persons in the United Kingdom.”

(3) In section 253 (technical capability notices)—

(a) in subsection (1)(a)—

(i) after “the operator”, in the first place it occurs, insert “or another relevant operator”;

(ii) for “the operator”, in the second place it occurs, substitute “such operator”;

(b) in subsection (2)(a), after “operator” insert “(to whom the notice is given)”.

Commencement Information

I6 S. 19 not in force at Royal Assent, see s. 32(2)

I7 S. 19 in force at 14.10.2024 by S.I. 2024/1021, reg. 2(r)

20 Renewal of notices U.K.

(1) The Investigatory Powers Act 2016 is amended as follows.

(2) In section 87 (powers to require retention of certain data), after subsection (6) insert—

“(6A) A retention notice ceases to have effect at the end of the relevant period unless before the end of that period—

(a) it is varied in accordance with section 94(4) so as to require the retention of additional relevant communications data,

(b) it is renewed (see section 94A), or

(c) it is revoked or otherwise ceases to have effect (see sections 90(10) and 94).

(6B) In subsection (6A) the “relevant period” means the period of two years beginning with—

(a) in the case of a retention notice that has not been varied as mentioned in subsection (6A)(a) or renewed, the day on which the notice comes into force, or

(b) in the case of a retention notice that has been so varied or renewed, the day after the day at the end of which the retention notice would have ceased to have effect if it had not been so varied or renewed.”

(3) In the italic heading before section 94, for “or revocation” substitute “, revocation or renewal”.

(4) After section 94 (but before the italic heading before section 95) insert—

“94A Renewal of notices

(1) If the renewal conditions are met, a retention notice may be renewed, at any time during the renewal period, by a notice given by the Secretary of State.

(2) The renewal conditions are—

(a) that the Secretary of State considers that the requirement in the retention notice for a telecommunications operator to retain relevant communications data is still necessary and proportionate for one or more of the purposes falling within sub-paragraphs (i) to (vi) of section 87(1)(a), and

(b) that the decision to renew the notice has been approved by a Judicial Commissioner.

(3) The renewal period means the period of 30 days ending with the day at the end of which the retention notice would otherwise cease to have effect.

(4) The Secretary of State must give, or publish, notice of the renewal in such manner as the Secretary of State considers appropriate for bringing the renewal to the attention of the telecommunications operator (or description of operators) to whom it relates.

(5) Sections 87(10), 88, 89 and 90 apply in relation to the renewal of a retention notice as they apply in relation to the giving of a retention notice.”

(5) In section 229 (main oversight functions), in subsection (8)(e)(i), for “or varying” substitute “, varying or renewal”.

(6) In section 255 (further provision about national security notices and technical capability notices), after subsection (5) insert—

“(5A) A relevant notice ceases to have effect at the end of the relevant period unless before the end of that period—

(a) it is varied in accordance with section 256(4)(c) or (5)(c) so as to impose further requirements on the person to whom the notice was given,

(b) it is renewed (see section 256A), or

(c) it is revoked or otherwise ceases to have effect (see section 256).

(5B) In subsection (5A) the “relevant period” means the period of two years beginning with—

(a) in the case of a relevant notice that has not been varied as mentioned in subsection (5A)(a) or renewed, the day on which the notice was given, or

(b) in the case of a relevant notice that has been so varied or renewed, the day after the day at the end of which the relevant notice would have ceased to have effect if it had not been so varied or renewed.”

(7) After section 256 insert—

“256A Renewal of notices

(1) If the renewal conditions are met, a relevant notice may be renewed, at any time during the renewal period, by a notice given by the Secretary of State.

(2) The renewal conditions for a national security notice given under section 252 are that—

(a) the Secretary of State considers that the notice is still necessary in the interests of national security,

(b) the Secretary of State considers that the conduct required by the notice is still proportionate to what is sought to be achieved by that conduct, and

(c) the decision to renew the notice has been approved by a Judicial Commissioner.

(3) The renewal conditions for a technical capability notice given under section 253 are that—

(a) the Secretary of State considers that the notice is still necessary for securing that the relevant operator has the capability to provide any assistance which the operator may be required to provide in relation to any relevant authorisation,

(b) the Secretary of State considers that the conduct required by the notice is still proportionate to what is sought to be achieved by that conduct, and

(c) the decision to renew the notice has been approved by a Judicial Commissioner.

(4) The renewal period means the period of 30 days ending with the day at the end of which the relevant notice would otherwise cease to have effect.

(5) If the Secretary of State renews a relevant notice given to any person, the Secretary of State must give that person notice in writing of the renewal.

(6) Sections 254, 255(2) to (4) and (7) and 257 apply in relation to the renewal of a relevant notice as they apply in relation to the giving of a relevant notice.

(7) Section 255(6) applies to any notice of the renewal of a technical capability notice as it applies to a technical capability notice.

(8) In this section—

• “relevant authorisation” has the meaning given by section 253;

• “relevant notice” means—

  (a)

  a national security notice under section 252, or

  (b)

  a technical capability notice under section 253;

• “relevant operator” has the meaning given by section 253.”

Commencement Information

I8 S. 20 not in force at Royal Assent, see s. 32(2)

I9 S. 20 in force at 14.10.2024 by S.I. 2024/1021, reg. 2(s) (with regs. 3, 4)

Prospective

Notification of proposed changes to telecommunications services etc U.K.

21 Notification of proposed changes to telecommunications services etc U.K.

(1) The Investigatory Powers Act 2016 is amended in accordance with subsections (2) and (3).

(2) After section 258 (but before the italic heading before section 259) insert—

“258A Notification of proposed changes to telecommunications services etc

(1) The Secretary of State may give a relevant operator a notice in writing under this section requiring the operator to notify the Secretary of State of any proposals of the operator to make any relevant changes specified in the notice.

(2) In this section “relevant change” means a change—

(a) to a service or system within subsection (3), and

(b) that is specified in regulations made by the Secretary of State as a change that may be included in a notice given under this section.

(3) The following are within this subsection—

(a) telecommunications services offered or provided by the operator;

(b) telecommunication systems controlled or provided by the operator;

(c) postal services provided by the operator.

(4) Regulations under subsection (2) may in particular specify changes by reference to the impact of the changes on the capability of a relevant operator to provide any assistance which the operator may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act.

(5) The Secretary of State may give a relevant operator a notice under this section only if the Secretary of State considers that—

(a) the notice is necessary for maintaining the capability of the relevant operator to provide any assistance which the operator may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act, and

(b) the conduct required by the notice is proportionate to what is sought to be achieved by that conduct.

(6) Before giving a notice under this section, the Secretary of State must among other matters take into account—

(a) the likely benefits of the notice,

(b) the likely number of users (if known) of any postal or telecommunications service to which the notice relates,

(c) the likely cost of complying with the notice, and

(d) any other effect of the notice on the operator to whom it relates.

(7) Before giving a notice under this section to a relevant operator, the Secretary of State must consult that operator.

(8) A relevant operator to whom a notice is given under this section, or any person employed or engaged for the purposes of that relevant operator’s business, must not disclose the existence or contents of the notice to any other person without the permission of the Secretary of State.

(9) A relevant operator to whom a notice is given under this section must comply with the notice a reasonable time before making any relevant changes to which the notice relates.

(10) The duty imposed by subsection (8) or (9) is enforceable by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.

(11) In this section “relevant operator” means—

(a) a postal operator,

(b) a telecommunications operator, or

(c) a person who is proposing to become a postal operator or a telecommunications operator,

who meets the condition in subsection (12).

(12) The condition in this subsection is that the operator or person provides (or has provided) assistance in relation to any warrant, authorisation or notice issued or given under this Act.

258B Variation and revocation of notices given under section 258A

(1) In this section—

• “relevant notice” means a notice given under section 258A;

• “relevant operator” has the same meaning as in that section.

(2) The Secretary of State may—

(a) vary a relevant notice;

(b) revoke a relevant notice (whether wholly or in part).

(3) The Secretary of State may vary a relevant notice only if the Secretary of State considers that—

(a) the variation is necessary for maintaining the capability of the relevant operator to provide any assistance which the operator may be required to provide in relation to any warrant, authorisation or notice issued or given under this Act, and

(b) the conduct required by the notice, as varied, is proportionate to what is sought to be achieved by that conduct.

(4) If the Secretary of State varies or revokes a relevant notice given to any relevant operator, the Secretary of State must give that relevant operator notice in writing of the variation or revocation.

(5) The fact that a relevant notice has been revoked in relation to a particular relevant operator does not prevent the giving of another relevant notice of the same kind in relation to the same relevant operator.

(6) Subsections (6) and (7) of section 258A apply in relation to varying or revoking a relevant notice as they apply in relation to giving a relevant notice.

(7) Any reference in this section or section 258A(8) or (9) to a notice given under section 258A includes a reference to such a notice as varied under this section.”

(3) In section 267(3) (regulations)—

(a) omit the “or” after paragraph (j);

(b) after that paragraph insert—

“(ja) section 258A(2), or”.

(4) The Regulation of Investigatory Powers Act 2000 is amended as follows.

(5) In section 65 (the Tribunal)—

(a) in subsection (5)(czi)—

(i) for “or 253” substitute “, 253 or 258A”;

(ii) for “or technical capability” substitute “, technical capability or proposed changes to telecommunications services etc”;

(b) in subsection (5)(czl)(iii), for “or 253” substitute “, 253 or 258A”;

(c) in subsection (8)(bc), for “or 253” substitute “, 253 or 258A”.

(6) In section 67 (exercise of the Tribunal’s jurisdiction), in subsection (7)(azc), for “or 253” substitute “, 253 or 258A”.

(7) In section 68 (Tribunal procedure)—

(a) in subsection (5)(b), for “or 253” substitute “, 253 or 258A”;

(b) in subsection (7)(f), for “or 253” substitute “, 253 or 258A”;

(c) in subsection (7)(ha), for “or 253” substitute “, 253 or 258A”.

Commencement Information

I10 S. 21 not in force at Royal Assent, see s. 32(2)