S. 2 not in force at Royal Assent, see s. 32(2)

S. 2 in force at 14.10.2024 by S.I. 2024/1021, reg. 2(b)

http://www.legislation.gov.uk/ukpga/2024/9/section/2Investigatory Powers (Amendment) Act 2024Statute Law Database2024-10-16Expert Participation2024-10-14Part 1Bulk personal datasetsLow or no reasonable expectation of privacy
2Low or no reasonable expectation of privacy

After Part 7 of the Investigatory Powers Act 2016 insert—

Part 7ABulk personal dataset authorisationsLow or no reasonable expectation of privacy

226ABulk personal datasets: low or no reasonable expectation of privacy1

This section applies to a bulk personal dataset if the nature of the bulk personal dataset is such that the individuals to whom the personal data relates could have no, or only a low, reasonable expectation of privacy in relation to the data.

2

In considering whether this section applies to a bulk personal dataset, regard must be had to all the circumstances, including in particular the factors in subsection (3).

3

Those factors are—

a

the nature of the data;

b

the extent to which—

i

the data has been made public by the individuals, or

ii

the individuals have consented to the data being made public;

c

if the data has been published, the extent to which it was published subject to editorial control or by a person acting in accordance with professional standards;

d

if the data has been published or is otherwise in the public domain, the extent to which the data is widely known about;

e

the extent to which the data has already been used in the public domain.

Issue of authorisations
226BIndividual authorisation1

In this Part “an individual authorisation” is an authorisation that authorises an intelligence service to retain, or to retain and examine, any bulk personal dataset described in the authorisation.

2

See section 200 (requirement for authorisation) for provision about when an individual authorisation under this Part is required.

3

The head of an intelligence service, or a person acting on their behalf, may grant an individual authorisation where the conditions in subsections (4) and (5) are met.

This is subject to subsection (6).

4

The condition in this subsection is that the person granting the authorisation considers that—

a

section 226A applies to the bulk personal dataset described in the authorisation,

b

the authorisation is necessary for the purpose of the exercise of any function of the intelligence service,

c

the conduct being authorised is proportionate to what is sought to be achieved by the conduct, and

d

there are for the time being in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section 226A applies and for protecting them from unauthorised disclosure.

5

The condition in this subsection is that the decision to grant the authorisation has been approved by a Judicial Commissioner.

6

The condition in subsection (5) does not apply where—

a

the bulk personal dataset described in the individual authorisation falls within a category of bulk personal datasets authorised for the purposes of this Part by a category authorisation (see section 226BA), or

b

the person granting the individual authorisation considers that there is an urgent need to grant the authorisation.

7

But subsection (6)(a) does not prevent a person granting an individual authorisation from seeking the approval of a Judicial Commissioner in a case where subsection (6)(a) applies if the person considers that it would be appropriate to seek such approval.

8

An individual authorisation relating to a bulk personal dataset (“dataset A”) may also authorise the retention or examination of other bulk personal datasets (“replacement datasets”) that do not exist at the time of the grant of the authorisation but may reasonably be regarded as replacements for dataset A.

226BACategory authorisation1

In this Part “a category authorisation” is an authorisation that authorises a category of bulk personal datasets described in the authorisation for the purposes of this Part.

2

The head of an intelligence service, or a person acting on their behalf, may grant a category authorisation where—

a

they consider that section 226A applies to any dataset that falls within the category of datasets described in the authorisation, and

b

the decision to grant the authorisation has been approved by a Judicial Commissioner.

3

A category authorisation may describe a category of bulk personal datasets by reference to (among other things) the use to which the datasets will be put.

226BBApproval of authorisations by Judicial Commissioners1

In deciding whether to approve a decision to grant an individual authorisation or a category authorisation, a Judicial Commissioner must review the conclusions of the person who granted the authorisation as to the following matters—

a

in relation to an individual authorisation, whether section 226A applies to the bulk personal dataset described in the authorisation, and

b

in relation to a category authorisation, whether section 226A applies to any dataset that falls within the category of datasets described in the authorisation.

2

In doing so, the Judicial Commissioner must—

a

apply the same principles as would be applied by a court on an application for judicial review, and

b

consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

3

Where a Judicial Commissioner refuses to approve a decision to grant an individual authorisation or a category authorisation, the Judicial Commissioner must give the person who decided to grant the authorisation written reasons for the refusal.

4

Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to grant an individual authorisation or a category authorisation, the head of the intelligence service, or a person acting on their behalf, may ask the Investigatory Powers Commissioner to decide whether to approve the decision to grant the authorisation.

226BCApproval of individual authorisations granted in urgent cases1

This section applies where—

a

an individual authorisation is granted without the approval of a Judicial Commissioner, and

b

the person who granted the authorisation considered that there was an urgent need to grant it.

2

The person who granted the authorisation must inform a Judicial Commissioner that it has been granted.

3

The Judicial Commissioner must, before the end of the relevant period—

a

decide whether to approve the decision to grant the authorisation, and

b

notify the person who granted the authorisation of the Judicial Commissioner’s decision.

The “relevant period” means the period ending with the third working day after the day on which the authorisation was granted.

4

Subsections (5) to (7) apply if a Judicial Commissioner refuses to approve the decision to grant an individual authorisation.

5

The authorisation—

a

ceases to have effect (unless already cancelled), and

b

may not be renewed,

and section 226BB(4) does not apply in relation to the refusal to approve the decision.

6

The head of the intelligence service must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the authorisation stops as soon as possible.

7

Section 220 (Part 7 initial examinations: time limits) applies in relation to the bulk personal dataset described in the authorisation as if the intelligence service had obtained that dataset at the time when the person who granted the authorisation is notified that the Judicial Commissioner has refused to approve the decision to grant the authorisation.

8

Nothing in subsection (5) or (6) affects the lawfulness of—

a

anything done in reliance on the authorisation before it ceases to have effect;

b

if anything is in the process of being done in reliance on the authorisation when it ceases to have effect—

i

anything done before that thing could be stopped, or

ii

anything done that it is not reasonably practicable to stop.

Duration, renewal and cancellation
226CDuration of authorisation1

An individual authorisation or a category authorisation ceases to have effect at the end of the relevant period unless—

a

it is renewed before the end of that period (see section 226CA), or

b

it is cancelled or otherwise ceases to have effect before the end of that period (see sections 226BC, 226CB, and 226CD).

2

In this section the “relevant period”—

a

in the case of an urgent individual authorisation, means the period ending with the fifth working day after the day on which the authorisation was granted;

b

in any other case, means the period of 12 months beginning with—

i

the day on which the authorisation was granted, or

ii

in the case of an authorisation that has been renewed, the day after the day at the end of which the authorisation would have ceased to have effect if it had not been renewed.

3

For the purposes of subsection (2)(a), an individual authorisation is an “urgent individual authorisation” if—

a

the authorisation was granted without the approval of a Judicial Commissioner, and

b

the person who granted the authorisation considered that there was an urgent need to grant it.

226CARenewal of authorisation1

If the renewal conditions are met for an individual authorisation or a category authorisation, the head of an intelligence service, or a person acting on their behalf, may, at any time during the renewal period, renew the authorisation.

2

The renewal conditions for an individual authorisation are that—

a

the person renewing the authorisation considers that—

i

section 226A continues to apply to the bulk personal dataset described in the authorisation,

ii

the authorisation continues to be necessary for the purpose of the exercise of any function of the intelligence service,

iii

the conduct being authorised continues to be proportionate to what is sought to be achieved by the conduct, and

iv

there are for the time being in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section 226A applies and for protecting them from unauthorised disclosure, and

b

the decision to renew the authorisation has been approved by a Judicial Commissioner.

3

But the condition in subsection (2)(b) does not apply where the bulk personal dataset described in the individual authorisation falls within a category of bulk personal datasets authorised for the purposes of this Part by a category authorisation.

4

The renewal conditions for a category authorisation are that—

a

the person renewing the authorisation considers that section 226A continues to apply to any dataset that falls within the category of datasets described in the authorisation, and

b

the decision to renew the authorisation has been approved by a Judicial Commissioner.

5

In this section the “renewal period” means—

a

in the case of an urgent individual authorisation which has not been renewed, the relevant period;

b

in the case of an individual authorisation to which section 226CD (non-renewal or cancellation of category authorisation) applies, the period of three months ending with the day at the end of which the authorisation would otherwise cease to have effect;

c

in any other case, the period of 30 days ending with the day at the end of which the authorisation would otherwise cease to have effect.

6

Section 226BB (approval of authorisations by Judicial Commissioner) applies in relation to a decision to renew an authorisation under this section as it applies in relation to a decision to grant an authorisation under this Part.

7

In this section—

the relevant period” has the same meaning as in section 226C;

urgent individual authorisation” is to be read in accordance with subsection (3) of that section.

226CBCancellation of authorisation1

The head of an intelligence service, or a person acting on their behalf, may, at any time, cancel an individual authorisation or a category authorisation.

2

If the head of an intelligence service, or a person acting on their behalf, considers that any of the cancellation conditions are met in relation to an individual authorisation, or that the cancellation condition is met in relation to a category authorisation, they must cancel the authorisation.

3

The cancellation conditions for an individual authorisation are—

a

that section 226A no longer applies to the dataset described in the authorisation;

b

that the authorisation is no longer necessary for the purpose of the exercise of any function of the intelligence service;

c

that the conduct authorised by the authorisation is no longer proportionate to what is sought to be achieved by the conduct;

d

that there are no longer in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section 226A applies and for protecting them from unauthorised disclosure.

4

The cancellation condition for a category authorisation is that section 226A no longer applies to any dataset that falls within the category of datasets described in the authorisation.

226CCNon-renewal or cancellation of individual authorisation1

This section applies where an individual authorisation ceases to have effect because it expires without having been renewed or because it is cancelled.

2

The head of the intelligence service, or a person acting on their behalf, may, before the end of the period of 5 working days beginning with the day on which the authorisation ceases to have effect, decide to grant a new individual authorisation (see section 226B) to retain, or to retain and examine, any material retained by the intelligence service in reliance on the authorisation which has ceased to have effect.

3

Where an individual authorisation ceases to have effect because it expires without having been renewed or because it is cancelled, an intelligence service is not to be regarded as in breach of section 200(1) or (2) by virtue of its retention or examination of any material to which the authorisation related during the following periods—

a

the period of 5 working days beginning with the day on which the authorisation ceases to have effect;

b

if the head of the intelligence service, or a person acting on their behalf, decides to grant a new individual authorisation as mentioned in subsection (2), any period when a Judicial Commissioner is deciding whether to approve the decision.

226CDNon-renewal or cancellation of category authorisation1

This section applies where—

a

a category authorisation ceases to have effect because it expires without having been renewed or because it is cancelled, and

b

an individual authorisation describing a bulk personal dataset that falls within the category of datasets described in the category authorisation has been granted without the approval of a Judicial Commissioner in accordance with section 226B(6)(a).

2

The individual authorisation ceases to have effect at the end of the relevant period unless—

a

it is renewed before the end of that period, or

b

it is cancelled or otherwise ceases to have effect before the end of that period.

3

In this section the “relevant period” means the period of three months beginning with the day after the day at the end of which the category authorisation ceased to have effect.

Further and supplementary provision
226DSection 226A ceasing to apply to part of bulk personal dataset1

Subsections (2) to (4) apply where—

a

an individual authorisation is granted under this Part in relation to any bulk personal dataset, and

b

in the course of examining the dataset in accordance with the authorisation, the head of the intelligence service, or a person acting on their behalf, believes that section 226A does not apply, or no longer applies, to part of the dataset.

2

The head of the intelligence service must, so far as is reasonably practicable, secure that anything in the process of being done in relation to that part of the bulk personal dataset in reliance on the authorisation stops as soon as possible.

3

Section 220 (Part 7 initial examinations: time limits) applies in relation to that part of the bulk personal dataset as if the intelligence service had obtained that part of the dataset at the time when the head of the intelligence service, or the person acting on their behalf, first formed the beliefs mentioned in subsection (1)(b).

4

The individual authorisation in relation to that part of the bulk personal dataset is to be treated as if it had been cancelled under section 226CB at that time.

5

Nothing in this section affects the lawfulness of—

a

anything done in reliance on the authorisation before it ceases to have effect;

b

if anything is in the process of being done in reliance on the authorisation when it ceases to have effect—

i

anything done before that thing could be stopped, or

ii

anything done that it is not reasonably practicable to stop.

226DAAnnual report1

The head of each intelligence service must provide an annual report to the Secretary of State about the bulk personal datasets that were authorised under this Part to be retained, or retained and examined, by the intelligence service during the period to which the report relates.

2

The first report must relate to a period of at least one year and no more than two years, beginning with the day on which this Part comes fully into force.

3

Subsequent reports must relate to a period of no more than one year, beginning with the end of the period to which the previous report related.

4

Each report must be provided to the Secretary of State as soon as reasonably practicable after the end of the period to which the report relates.

226DBReport to Intelligence and Security Committee1

The Secretary of State must for each relevant period provide to the Intelligence and Security Committee of Parliament a report setting out information about category authorisations and renewals of category authorisations granted in that period.

2

In subsection (1) “relevant period” means—

a

a period of at least one year and no more than two years beginning with the date on which this Part comes fully into force, and

b

subsequent periods of no more than one year, beginning with the end of the period to which the previous report related.

3

Each report must be provided to the Committee as soon as reasonably practicable after the end of the period to which the report relates.

226DCPart 7A: interpretation1

In this Part—

category authorisation” has the meaning given by section 226BA(1);

individual authorisation” has the meaning given by section 226B(1).

2

See also—

section 199 (bulk personal datasets: interpretation),

section 263 (general definitions),

section 265 (index of defined expressions).

3

For the purposes of this Part, only a person holding office under the Crown may act on behalf of the head of an intelligence service.

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<akomaNtoso xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xsi:schemaLocation="http://docs.oasis-open.org/legaldocml/ns/akn/3.0 http://docs.oasis-open.org/legaldocml/akn-core/v1.0/cos01/part2-specs/schemas/akomantoso30.xsd">
<portion includedIn="http://www.legislation.gov.uk/id/ukpga/2024/9">
<meta>
<identification source="#source">
<FRBRWork>
<FRBRthis value="http://www.legislation.gov.uk/id/ukpga/2024/9"/>
<FRBRuri value="http://www.legislation.gov.uk/id/ukpga/2024/9"/>
<FRBRdate date="2024-04-25" name="enacted"/>
<FRBRauthor href="http://www.legislation.gov.uk/id/legislature/UnitedKingdomParliament"/>
<FRBRcountry value="GB-UKM"/>
<FRBRnumber value="9"/>
<FRBRname value="2024 c. 9"/>
<FRBRprescriptive value="true"/>
</FRBRWork>
<FRBRExpression>
<FRBRthis value="http://www.legislation.gov.uk/ukpga/2024/9/section/2"/>
<FRBRuri value="http://www.legislation.gov.uk/ukpga/2024/9"/>
<FRBRdate date="2024-10-14" name="validFrom"/>
<FRBRauthor href="#source"/>
<FRBRlanguage language="eng"/>
</FRBRExpression>
<FRBRManifestation>
<FRBRthis value="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.akn"/>
<FRBRuri value="http://www.legislation.gov.uk/ukpga/2024/9/data.akn"/>
<FRBRdate date="2024-11-07Z" name="transform"/>
<FRBRauthor href="http://www.legislation.gov.uk"/>
<FRBRformat value="application/akn+xml"/>
</FRBRManifestation>
</identification>
<lifecycle source="#source">
<eventRef date="2024-04-25" type="generation" eId="enacted-date" source="#source"/>
<eventRef date="2024-10-14" type="amendment" source="#source"/>
<eventRef date="2024-10-14" eId="effective-date-1" source="#source"/>
</lifecycle>
<analysis source="#source">
<restrictions source="#source">
<restriction refersTo="#e+w+s+ni" type="jurisdiction"/>
<restriction href="#body" refersTo="#e+w+s+ni" type="jurisdiction"/>
<restriction href="#section-2" refersTo="#e+w+s+ni" type="jurisdiction"/>
<restriction href="#part-1" refersTo="#e+w+s+ni" type="jurisdiction"/>
<restriction href="#part-1-crossheading-low-or-no-reasonable-expectation-of-privacy" refersTo="#e+w+s+ni" type="jurisdiction"/>
</restrictions>
</analysis>
<temporalData source="#source">
<temporalGroup eId="period1">
<timeInterval start="#effective-date-1" refersTo="#period-concept1"/>
</temporalGroup>
</temporalData>
<references source="#source">
<TLCOrganization eId="source" href="http://www.legislation.gov.uk/id/publisher/StatuteLawDatabase" showAs="Statute Law Database"/>
<TLCLocation eId="e+w+s+ni" href="/ontology/jurisdictions/uk.EnglandWalesScotlandNorthernIreland" showAs="England, Wales, Scotland, Northern Ireland"/>
<TLCTerm eId="term-relevant-period" href="/ontology/term/uk.relevant-period" showAs="relevant period"/>
<TLCTerm eId="term-renewal-period" href="/ontology/term/uk.renewal-period" showAs="renewal period"/>
<TLCTerm eId="term-the-relevant-period" href="/ontology/term/uk.the-relevant-period" showAs="the relevant period"/>
<TLCTerm eId="term-urgent-individual-authorisation" href="/ontology/term/uk.urgent-individual-authorisation" showAs="urgent individual authorisation"/>
<TLCTerm eId="term-category-authorisation" href="/ontology/term/uk.category-authorisation" showAs="category authorisation"/>
<TLCTerm eId="term-individual-authorisation" href="/ontology/term/uk.individual-authorisation" showAs="individual authorisation"/>
<TLCConcept eId="period-concept1" href="/ontology/time/2024.10.14" showAs="since 2024-10-14"/>
</references>
<notes source="#source">
<note class="commentary I" eId="key-4791ed68c10fdf48b7fb8339c8a9dae9">
<p>
S. 2 not in force at Royal Assent, see
<ref href="http://www.legislation.gov.uk/id/ukpga/2024/9/section/32/2">s. 32(2)</ref>
</p>
</note>
<note class="commentary I" eId="key-da6aba9c0901cc95e3a45677e6ee0e3e">
<p>
<ref href="http://www.legislation.gov.uk/id/ukpga/2024/9/section/2">S. 2</ref>
in force at 14.10.2024 by
<ref href="http://www.legislation.gov.uk/id/uksi/2024/1021">S.I. 2024/1021</ref>
,
<ref href="http://www.legislation.gov.uk/id/uksi/2024/1021/regulation/2/b">reg. 2(b)</ref>
</p>
</note>
</notes>
<proprietary xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:ukm="http://www.legislation.gov.uk/namespaces/metadata" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dct="http://purl.org/dc/terms/" xmlns:atom="http://www.w3.org/2005/Atom" source="#source">
<ukl:RestrictStartDate value="2024-10-14"/>
<dc:identifier>http://www.legislation.gov.uk/ukpga/2024/9/section/2</dc:identifier>
<dc:title>Investigatory Powers (Amendment) Act 2024</dc:title>
<dc:publisher>Statute Law Database</dc:publisher>
<dc:modified>2024-10-16</dc:modified>
<dc:contributor>Expert Participation</dc:contributor>
<dct:valid>2024-10-14</dct:valid>
<atom:link rel="self" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.xml" type="application/xml"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/resources" href="http://www.legislation.gov.uk/ukpga/2024/9/resources" title="More Resources"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/notes" href="http://www.legislation.gov.uk/ukpga/2024/9/notes" title="Explanatory Notes"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/notes/toc" href="http://www.legislation.gov.uk/ukpga/2024/9/notes/contents" title="Explanatory Notes Table of Contents"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/act" href="http://www.legislation.gov.uk/ukpga/2024/9" title="whole act"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/introduction" href="http://www.legislation.gov.uk/ukpga/2024/9/introduction" title="introduction"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/body" href="http://www.legislation.gov.uk/ukpga/2024/9/body" title="body"/>
<atom:link rel="http://www.legislation.gov.uk/def/navigation/schedules" href="http://www.legislation.gov.uk/ukpga/2024/9/schedules" title="schedules"/>
<atom:link rel="alternate" type="application/rdf+xml" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.rdf" title="RDF/XML"/>
<atom:link rel="alternate" type="application/akn+xml" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.akn" title="AKN"/>
<atom:link rel="alternate" type="application/xhtml+xml" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.xht" title="HTML snippet"/>
<atom:link rel="alternate" type="text/html" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.htm" title="Website (XHTML) Default View"/>
<atom:link rel="alternate" type="text/csv" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.csv" title="CSV"/>
<atom:link rel="alternate" type="application/pdf" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.pdf" title="PDF"/>
<atom:link rel="alternate" type="application/akn+xhtml" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/data.html" title="HTML5 snippet"/>
<atom:link rel="http://purl.org/dc/terms/tableOfContents" hreflang="en" href="http://www.legislation.gov.uk/ukpga/2024/9/contents" title="Table of Contents"/>
<atom:link rel="http://purl.org/dc/terms/hasVersion" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/enacted" title="enacted"/>
<atom:link rel="http://purl.org/dc/terms/hasVersion" href="http://www.legislation.gov.uk/ukpga/2024/9/section/2/2024-10-14" title="2024-10-14"/>
<atom:link rel="up" href="http://www.legislation.gov.uk/ukpga/2024/9" title="Entire legislation"/>
<atom:link rel="prev" href="http://www.legislation.gov.uk/ukpga/2024/9/section/1" title="Provision; Section 1"/>
<atom:link rel="prevInForce" href="http://www.legislation.gov.uk/ukpga/2024/9/section/1" title="Provision; Section 1"/>
<atom:link rel="next" href="http://www.legislation.gov.uk/ukpga/2024/9/section/3" title="Provision; Section 3"/>
<atom:link rel="nextInForce" href="http://www.legislation.gov.uk/ukpga/2024/9/section/3" title="Provision; Section 3"/>
<ukm:PrimaryMetadata>
<ukm:DocumentClassification>
<ukm:DocumentCategory Value="primary"/>
<ukm:DocumentMainType Value="UnitedKingdomPublicGeneralAct"/>
<ukm:DocumentStatus Value="revised"/>
</ukm:DocumentClassification>
<ukm:Year Value="2024"/>
<ukm:Number Value="9"/>
<ukm:EnactmentDate Date="2024-04-25"/>
<ukm:ISBN Value="9780105702528"/>
</ukm:PrimaryMetadata>
<ukm:Notes>
<ukm:Note IdURI="http://www.legislation.gov.uk/id/ukpga/2024/9/notes"/>
<ukm:Alternatives>
<ukm:Alternative URI="http://www.legislation.gov.uk/ukpga/2024/9/pdfs/ukpgaen_20240009_en.pdf" Date="2024-05-31" Title="Explanatory Note" Size="1195522"/>
</ukm:Alternatives>
</ukm:Notes>
<ukm:Alternatives>
<ukm:Alternative URI="http://www.legislation.gov.uk/ukpga/2024/9/pdfs/ukpga_20240009_en.pdf" Date="2024-04-30" Size="863610" Print="true"/>
</ukm:Alternatives>
<ukm:Statistics>
<ukm:TotalParagraphs Value="84"/>
<ukm:BodyParagraphs Value="78"/>
<ukm:ScheduleParagraphs Value="6"/>
<ukm:AttachmentParagraphs Value="0"/>
<ukm:TotalImages Value="0"/>
</ukm:Statistics>
</proprietary>
</meta>
<portionBody eId="body" period="#period1">
<part eId="part-1" period="#period1">
<num>Part 1</num>
<heading>Bulk personal datasets</heading>
<hcontainer name="crossheading" eId="part-1-crossheading-low-or-no-reasonable-expectation-of-privacy" period="#period1">
<heading>Low or no reasonable expectation of privacy</heading>
<section eId="section-2" period="#period1">
<num>
<noteRef href="#key-4791ed68c10fdf48b7fb8339c8a9dae9" marker="I1" class="commentary I"/>
<noteRef href="#key-da6aba9c0901cc95e3a45677e6ee0e3e" marker="I2" class="commentary I"/>
2
</num>
<heading>Low or no reasonable expectation of privacy</heading>
<content>
<p>After Part 7 of the Investigatory Powers Act 2016 insert—</p>
<p class="BlockAmendment">
<mod>
<quotedStructure class="primary unknown main double" startQuote="" endQuote="">
<part eId="p00456">
<num>Part 7A</num>
<heading>Bulk personal dataset authorisations</heading>
<hcontainer name="crossheading" eId="d4e88">
<heading>Low or no reasonable expectation of privacy</heading>
<section eId="p00459">
<num>226A</num>
<heading>Bulk personal datasets: low or no reasonable expectation of privacy</heading>
<subsection eId="d4e98">
<num>1</num>
<content>
<p>This section applies to a bulk personal dataset if the nature of the bulk personal dataset is such that the individuals to whom the personal data relates could have no, or only a low, reasonable expectation of privacy in relation to the data.</p>
</content>
</subsection>
<subsection eId="d4e104">
<num>2</num>
<content>
<p>
In considering whether this section applies to a bulk personal dataset, regard must be had to all the circumstances, including in particular the factors in subsection 
<a href="#p00470">(3)</a>
.
</p>
</content>
</subsection>
<subsection eId="p00470">
<num>3</num>
<intro>
<p>Those factors are—</p>
</intro>
<paragraph eId="d4e119">
<num>a</num>
<content>
<p>the nature of the data;</p>
</content>
</paragraph>
<paragraph eId="d4e125">
<num>b</num>
<intro>
<p>the extent to which—</p>
</intro>
<subparagraph eId="d4e131">
<num>i</num>
<content>
<p>the data has been made public by the individuals, or</p>
</content>
</subparagraph>
<subparagraph eId="d4e137">
<num>ii</num>
<content>
<p>the individuals have consented to the data being made public;</p>
</content>
</subparagraph>
</paragraph>
<paragraph eId="d4e143">
<num>c</num>
<content>
<p>if the data has been published, the extent to which it was published subject to editorial control or by a person acting in accordance with professional standards;</p>
</content>
</paragraph>
<paragraph eId="d4e149">
<num>d</num>
<content>
<p>if the data has been published or is otherwise in the public domain, the extent to which the data is widely known about;</p>
</content>
</paragraph>
<paragraph eId="d4e155">
<num>e</num>
<content>
<p>the extent to which the data has already been used in the public domain.</p>
</content>
</paragraph>
</subsection>
</section>
</hcontainer>
<hcontainer name="crossheading" eId="d4e161">
<heading>Issue of authorisations</heading>
<section eId="p00505">
<num>226B</num>
<heading>Individual authorisation</heading>
<subsection eId="p00507">
<num>1</num>
<content>
<p>In this Part “an individual authorisation” is an authorisation that authorises an intelligence service to retain, or to retain and examine, any bulk personal dataset described in the authorisation.</p>
</content>
</subsection>
<subsection eId="d4e177">
<num>2</num>
<content>
<p>See section 200 (requirement for authorisation) for provision about when an individual authorisation under this Part is required.</p>
</content>
</subsection>
<subsection eId="d4e183">
<num>3</num>
<content>
<p>
The head of an intelligence service, or a person acting on their behalf, may grant an individual authorisation where the conditions in subsections
<a href="#p00523">(4)</a>
and
<a href="#p00545">(5)</a>
are met.
</p>
<p>
This is subject to subsection
<a href="#p00549">(6)</a>
.
</p>
</content>
</subsection>
<subsection eId="p00523">
<num>4</num>
<intro>
<p>The condition in this subsection is that the person granting the authorisation considers that—</p>
</intro>
<paragraph eId="d4e207">
<num>a</num>
<content>
<p>
section
<a href="#p00459">226A</a>
applies to the bulk personal dataset described in the authorisation,
</p>
</content>
</paragraph>
<paragraph eId="d4e216">
<num>b</num>
<content>
<p>the authorisation is necessary for the purpose of the exercise of any function of the intelligence service,</p>
</content>
</paragraph>
<paragraph eId="d4e222">
<num>c</num>
<content>
<p>the conduct being authorised is proportionate to what is sought to be achieved by the conduct, and</p>
</content>
</paragraph>
<paragraph eId="d4e228">
<num>d</num>
<content>
<p>
there are for the time being in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section
<a href="#p00459">226A</a>
applies and for protecting them from unauthorised disclosure.
</p>
</content>
</paragraph>
</subsection>
<subsection eId="p00545">
<num>5</num>
<content>
<p>The condition in this subsection is that the decision to grant the authorisation has been approved by a Judicial Commissioner.</p>
</content>
</subsection>
<subsection eId="p00549">
<num>6</num>
<intro>
<p>
The condition in subsection
<a href="#p00545">(5)</a>
does not apply where—
</p>
</intro>
<paragraph eId="p00553">
<num>a</num>
<content>
<p>
the bulk personal dataset described in the individual authorisation falls within a category of bulk personal datasets authorised for the purposes of this Part by a category authorisation (see section
<a href="#p00576">226BA</a>
), or
</p>
</content>
</paragraph>
<paragraph eId="d4e261">
<num>b</num>
<content>
<p>the person granting the individual authorisation considers that there is an urgent need to grant the authorisation.</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e267">
<num>7</num>
<content>
<p>
But subsection
<a href="#p00549">(6)</a>
<a href="#p00553">(a)</a>
does not prevent a person granting an individual authorisation from seeking the approval of a Judicial Commissioner in a case where subsection
<a href="#p00549">(6)</a>
<a href="#p00553">(a)</a>
applies if the person considers that it would be appropriate to seek such approval.
</p>
</content>
</subsection>
<subsection eId="d4e283">
<num>8</num>
<content>
<p>An individual authorisation relating to a bulk personal dataset (“dataset A”) may also authorise the retention or examination of other bulk personal datasets (“replacement datasets”) that do not exist at the time of the grant of the authorisation but may reasonably be regarded as replacements for dataset A.</p>
</content>
</subsection>
</section>
<section eId="p00576">
<num>226BA</num>
<heading>Category authorisation</heading>
<subsection eId="p00578">
<num>1</num>
<content>
<p>In this Part “a category authorisation” is an authorisation that authorises a category of bulk personal datasets described in the authorisation for the purposes of this Part.</p>
</content>
</subsection>
<subsection eId="d4e302">
<num>2</num>
<intro>
<p>The head of an intelligence service, or a person acting on their behalf, may grant a category authorisation where—</p>
</intro>
<paragraph eId="d4e308">
<num>a</num>
<content>
<p>
they consider that section
<a href="#p00459">226A</a>
applies to any dataset that falls within the category of datasets described in the authorisation, and
</p>
</content>
</paragraph>
<paragraph eId="d4e317">
<num>b</num>
<content>
<p>the decision to grant the authorisation has been approved by a Judicial Commissioner.</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e323">
<num>3</num>
<content>
<p>A category authorisation may describe a category of bulk personal datasets by reference to (among other things) the use to which the datasets will be put.</p>
</content>
</subsection>
</section>
<section eId="p00600">
<num>226BB</num>
<heading>Approval of authorisations by Judicial Commissioners</heading>
<subsection eId="p00602">
<num>1</num>
<intro>
<p>In deciding whether to approve a decision to grant an individual authorisation or a category authorisation, a Judicial Commissioner must review the conclusions of the person who granted the authorisation as to the following matters—</p>
</intro>
<paragraph eId="d4e342">
<num>a</num>
<content>
<p>
in relation to an individual authorisation, whether section
<a href="#p00459">226A</a>
applies to the bulk personal dataset described in the authorisation, and
</p>
</content>
</paragraph>
<paragraph eId="d4e351">
<num>b</num>
<content>
<p>
in relation to a category authorisation, whether section
<a href="#p00459">226A</a>
applies to any dataset that falls within the category of datasets described in the authorisation.
</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e360">
<num>2</num>
<intro>
<p>In doing so, the Judicial Commissioner must—</p>
</intro>
<paragraph eId="d4e366">
<num>a</num>
<content>
<p>apply the same principles as would be applied by a court on an application for judicial review, and</p>
</content>
</paragraph>
<paragraph eId="d4e372">
<num>b</num>
<content>
<p>
consider the matters referred to in subsection
<a href="#p00602">(1)</a>
with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).
</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e381">
<num>3</num>
<content>
<p>Where a Judicial Commissioner refuses to approve a decision to grant an individual authorisation or a category authorisation, the Judicial Commissioner must give the person who decided to grant the authorisation written reasons for the refusal.</p>
</content>
</subsection>
<subsection eId="p00633">
<num>4</num>
<content>
<p>Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to grant an individual authorisation or a category authorisation, the head of the intelligence service, or a person acting on their behalf, may ask the Investigatory Powers Commissioner to decide whether to approve the decision to grant the authorisation.</p>
</content>
</subsection>
</section>
<section eId="p00638">
<num>226BC</num>
<heading>Approval of individual authorisations granted in urgent cases</heading>
<subsection eId="d4e400">
<num>1</num>
<intro>
<p>This section applies where—</p>
</intro>
<paragraph eId="d4e406">
<num>a</num>
<content>
<p>an individual authorisation is granted without the approval of a Judicial Commissioner, and</p>
</content>
</paragraph>
<paragraph eId="d4e412">
<num>b</num>
<content>
<p>the person who granted the authorisation considered that there was an urgent need to grant it.</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e418">
<num>2</num>
<content>
<p>The person who granted the authorisation must inform a Judicial Commissioner that it has been granted.</p>
</content>
</subsection>
<subsection eId="d4e424">
<num>3</num>
<intro>
<p>The Judicial Commissioner must, before the end of the relevant period—</p>
</intro>
<paragraph eId="d4e430">
<num>a</num>
<content>
<p>decide whether to approve the decision to grant the authorisation, and</p>
</content>
</paragraph>
<paragraph eId="d4e436">
<num>b</num>
<content>
<p>notify the person who granted the authorisation of the Judicial Commissioner’s decision.</p>
</content>
</paragraph>
<wrapUp>
<p>
The “
<term refersTo="#term-relevant-period">relevant period</term>
” means the period ending with the third working day after the day on which the authorisation was granted.
</p>
</wrapUp>
</subsection>
<subsection eId="d4e448">
<num>4</num>
<content>
<p>
Subsections
<a href="#p00676">(5)</a>
to
<a href="#p00696">(7)</a>
apply if a Judicial Commissioner refuses to approve the decision to grant an individual authorisation.
</p>
</content>
</subsection>
<subsection eId="p00676">
<num>5</num>
<intro>
<p>The authorisation—</p>
</intro>
<paragraph eId="d4e466">
<num>a</num>
<content>
<p>ceases to have effect (unless already cancelled), and</p>
</content>
</paragraph>
<paragraph eId="d4e472">
<num>b</num>
<content>
<p>may not be renewed,</p>
</content>
</paragraph>
<wrapUp>
<p>
and section
<a href="#p00600">226BB</a>
<a href="#p00633">(4)</a>
does not apply in relation to the refusal to approve the decision.
</p>
</wrapUp>
</subsection>
<subsection eId="p00692">
<num>6</num>
<content>
<p>The head of the intelligence service must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the authorisation stops as soon as possible.</p>
</content>
</subsection>
<subsection eId="p00696">
<num>7</num>
<content>
<p>Section 220 (Part 7 initial examinations: time limits) applies in relation to the bulk personal dataset described in the authorisation as if the intelligence service had obtained that dataset at the time when the person who granted the authorisation is notified that the Judicial Commissioner has refused to approve the decision to grant the authorisation.</p>
</content>
</subsection>
<subsection eId="d4e497">
<num>8</num>
<intro>
<p>
Nothing in subsection
<a href="#p00676">(5)</a>
or
<a href="#p00692">(6)</a>
affects the lawfulness of—
</p>
</intro>
<paragraph eId="d4e509">
<num>a</num>
<content>
<p>anything done in reliance on the authorisation before it ceases to have effect;</p>
</content>
</paragraph>
<paragraph eId="d4e515">
<num>b</num>
<intro>
<p>if anything is in the process of being done in reliance on the authorisation when it ceases to have effect—</p>
</intro>
<subparagraph eId="d4e521">
<num>i</num>
<content>
<p>anything done before that thing could be stopped, or</p>
</content>
</subparagraph>
<subparagraph eId="d4e527">
<num>ii</num>
<content>
<p>anything done that it is not reasonably practicable to stop.</p>
</content>
</subparagraph>
</paragraph>
</subsection>
</section>
</hcontainer>
<hcontainer name="crossheading" eId="d4e533">
<heading>Duration, renewal and cancellation</heading>
<section eId="p00725">
<num>226C</num>
<heading>Duration of authorisation</heading>
<subsection eId="d4e543">
<num>1</num>
<intro>
<p>An individual authorisation or a category authorisation ceases to have effect at the end of the relevant period unless—</p>
</intro>
<paragraph eId="d4e549">
<num>a</num>
<content>
<p>
it is renewed before the end of that period (see section
<a href="#p00778">226CA</a>
), or
</p>
</content>
</paragraph>
<paragraph eId="d4e558">
<num>b</num>
<content>
<p>
it is cancelled or otherwise ceases to have effect before the end of that period (see sections
<a href="#p00638">226BC</a>
,
<a href="#p00870">226CB</a>
, and
<a href="#p00933">226CD</a>
).
</p>
</content>
</paragraph>
</subsection>
<subsection eId="p00743">
<num>2</num>
<intro>
<p>In this section the “relevant period”—</p>
</intro>
<paragraph eId="p00746">
<num>a</num>
<content>
<p>in the case of an urgent individual authorisation, means the period ending with the fifth working day after the day on which the authorisation was granted;</p>
</content>
</paragraph>
<paragraph eId="d4e585">
<num>b</num>
<intro>
<p>in any other case, means the period of 12 months beginning with—</p>
</intro>
<subparagraph eId="d4e591">
<num>i</num>
<content>
<p>the day on which the authorisation was granted, or</p>
</content>
</subparagraph>
<subparagraph eId="d4e597">
<num>ii</num>
<content>
<p>in the case of an authorisation that has been renewed, the day after the day at the end of which the authorisation would have ceased to have effect if it had not been renewed.</p>
</content>
</subparagraph>
</paragraph>
</subsection>
<subsection eId="p00763">
<num>3</num>
<intro>
<p>
For the purposes of subsection
<a href="#p00743">(2)</a>
<a href="#p00746">(a)</a>
, an individual authorisation is an “urgent individual authorisation” if—
</p>
</intro>
<paragraph eId="d4e614">
<num>a</num>
<content>
<p>the authorisation was granted without the approval of a Judicial Commissioner, and</p>
</content>
</paragraph>
<paragraph eId="d4e620">
<num>b</num>
<content>
<p>the person who granted the authorisation considered that there was an urgent need to grant it.</p>
</content>
</paragraph>
</subsection>
</section>
<section eId="p00778">
<num>226CA</num>
<heading>Renewal of authorisation</heading>
<subsection eId="d4e633">
<num>1</num>
<content>
<p>If the renewal conditions are met for an individual authorisation or a category authorisation, the head of an intelligence service, or a person acting on their behalf, may, at any time during the renewal period, renew the authorisation.</p>
</content>
</subsection>
<subsection eId="p00784">
<num>2</num>
<intro>
<p>The renewal conditions for an individual authorisation are that—</p>
</intro>
<paragraph eId="d4e645">
<num>a</num>
<intro>
<p>the person renewing the authorisation considers that—</p>
</intro>
<subparagraph eId="d4e651">
<num>i</num>
<content>
<p>
section
<a href="#p00459">226A</a>
continues to apply to the bulk personal dataset described in the authorisation,
</p>
</content>
</subparagraph>
<subparagraph eId="d4e660">
<num>ii</num>
<content>
<p>the authorisation continues to be necessary for the purpose of the exercise of any function of the intelligence service,</p>
</content>
</subparagraph>
<subparagraph eId="d4e666">
<num>iii</num>
<content>
<p>the conduct being authorised continues to be proportionate to what is sought to be achieved by the conduct, and</p>
</content>
</subparagraph>
<subparagraph eId="d4e672">
<num>iv</num>
<content>
<p>
there are for the time being in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section
<a href="#p00459">226A</a>
applies and for protecting them from unauthorised disclosure, and
</p>
</content>
</subparagraph>
</paragraph>
<paragraph eId="p00809">
<num>b</num>
<content>
<p>the decision to renew the authorisation has been approved by a Judicial Commissioner.</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e687">
<num>3</num>
<content>
<p>
But the condition in subsection
<a href="#p00784">(2)</a>
<a href="#p00809">(b)</a>
does not apply where the bulk personal dataset described in the individual authorisation falls within a category of bulk personal datasets authorised for the purposes of this Part by a category authorisation.
</p>
</content>
</subsection>
<subsection eId="d4e698">
<num>4</num>
<intro>
<p>The renewal conditions for a category authorisation are that—</p>
</intro>
<paragraph eId="d4e704">
<num>a</num>
<content>
<p>
the person renewing the authorisation considers that section
<a href="#p00459">226A</a>
continues to apply to any dataset that falls within the category of datasets described in the authorisation, and
</p>
</content>
</paragraph>
<paragraph eId="d4e713">
<num>b</num>
<content>
<p>the decision to renew the authorisation has been approved by a Judicial Commissioner.</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e719">
<num>5</num>
<intro>
<p>
In this section the “
<term refersTo="#term-renewal-period">renewal period</term>
” means—
</p>
</intro>
<paragraph eId="d4e728">
<num>a</num>
<content>
<p>in the case of an urgent individual authorisation which has not been renewed, the relevant period;</p>
</content>
</paragraph>
<paragraph eId="d4e734">
<num>b</num>
<content>
<p>
in the case of an individual authorisation to which section
<a href="#p00933">226CD</a>
(non-renewal or cancellation of category authorisation) applies, the period of three months ending with the day at the end of which the authorisation would otherwise cease to have effect;
</p>
</content>
</paragraph>
<paragraph eId="d4e743">
<num>c</num>
<content>
<p>in any other case, the period of 30 days ending with the day at the end of which the authorisation would otherwise cease to have effect.</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e749">
<num>6</num>
<content>
<p>
Section
<a href="#p00600">226BB</a>
(approval of authorisations by Judicial Commissioner) applies in relation to a decision to renew an authorisation under this section as it applies in relation to a decision to grant an authorisation under this Part.
</p>
</content>
</subsection>
<subsection eId="d4e758">
<num>7</num>
<content>
<p>In this section—</p>
<blockList class="unordered">
<item>
<p>
<term refersTo="#term-the-relevant-period">the relevant period</term>
” has the same meaning as in section
<a href="#p00725">226C</a>
;
</p>
</item>
<item>
<p>
<term refersTo="#term-urgent-individual-authorisation">urgent individual authorisation</term>
” is to be read in accordance with subsection
<a href="#p00763">(3)</a>
of that section.
</p>
</item>
</blockList>
</content>
</subsection>
</section>
<section eId="p00870">
<num>226CB</num>
<heading>Cancellation of authorisation</heading>
<subsection eId="d4e792">
<num>1</num>
<content>
<p>The head of an intelligence service, or a person acting on their behalf, may, at any time, cancel an individual authorisation or a category authorisation.</p>
</content>
</subsection>
<subsection eId="d4e798">
<num>2</num>
<content>
<p>If the head of an intelligence service, or a person acting on their behalf, considers that any of the cancellation conditions are met in relation to an individual authorisation, or that the cancellation condition is met in relation to a category authorisation, they must cancel the authorisation.</p>
</content>
</subsection>
<subsection eId="d4e804">
<num>3</num>
<intro>
<p>The cancellation conditions for an individual authorisation are—</p>
</intro>
<paragraph eId="d4e810">
<num>a</num>
<content>
<p>
that section
<a href="#p00459">226A</a>
no longer applies to the dataset described in the authorisation;
</p>
</content>
</paragraph>
<paragraph eId="d4e819">
<num>b</num>
<content>
<p>that the authorisation is no longer necessary for the purpose of the exercise of any function of the intelligence service;</p>
</content>
</paragraph>
<paragraph eId="d4e825">
<num>c</num>
<content>
<p>that the conduct authorised by the authorisation is no longer proportionate to what is sought to be achieved by the conduct;</p>
</content>
</paragraph>
<paragraph eId="d4e831">
<num>d</num>
<content>
<p>
that there are no longer in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section
<a href="#p00459">226A</a>
applies and for protecting them from unauthorised disclosure.
</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e840">
<num>4</num>
<content>
<p>
The cancellation condition for a category authorisation is that section
<a href="#p00459">226A</a>
no longer applies to any dataset that falls within the category of datasets described in the authorisation.
</p>
</content>
</subsection>
</section>
<section eId="p00908">
<num>226CC</num>
<heading>Non-renewal or cancellation of individual authorisation</heading>
<subsection eId="d4e856">
<num>1</num>
<content>
<p>This section applies where an individual authorisation ceases to have effect because it expires without having been renewed or because it is cancelled.</p>
</content>
</subsection>
<subsection eId="p00914">
<num>2</num>
<content>
<p>
The head of the intelligence service, or a person acting on their behalf, may, before the end of the period of 5 working days beginning with the day on which the authorisation ceases to have effect, decide to grant a new individual authorisation (see section
<a href="#p00505">226B</a>
) to retain, or to retain and examine, any material retained by the intelligence service in reliance on the authorisation which has ceased to have effect.
</p>
</content>
</subsection>
<subsection eId="p00919">
<num>3</num>
<intro>
<p>Where an individual authorisation ceases to have effect because it expires without having been renewed or because it is cancelled, an intelligence service is not to be regarded as in breach of section 200(1) or (2) by virtue of its retention or examination of any material to which the authorisation related during the following periods—</p>
</intro>
<paragraph eId="d4e877">
<num>a</num>
<content>
<p>the period of 5 working days beginning with the day on which the authorisation ceases to have effect;</p>
</content>
</paragraph>
<paragraph eId="d4e883">
<num>b</num>
<content>
<p>
if the head of the intelligence service, or a person acting on their behalf, decides to grant a new individual authorisation as mentioned in subsection
<a href="#p00914">(2)</a>
, any period when a Judicial Commissioner is deciding whether to approve the decision.
</p>
</content>
</paragraph>
</subsection>
</section>
<section eId="p00933">
<num>226CD</num>
<heading>Non-renewal or cancellation of category authorisation</heading>
<subsection eId="d4e899">
<num>1</num>
<intro>
<p>This section applies where—</p>
</intro>
<paragraph eId="d4e905">
<num>a</num>
<content>
<p>a category authorisation ceases to have effect because it expires without having been renewed or because it is cancelled, and</p>
</content>
</paragraph>
<paragraph eId="d4e911">
<num>b</num>
<content>
<p>
an individual authorisation describing a bulk personal dataset that falls within the category of datasets described in the category authorisation has been granted without the approval of a Judicial Commissioner in accordance with section
<a href="#p00505">226B</a>
<a href="#p00549">(6)</a>
<a href="#p00553">(a)</a>
.
</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e924">
<num>2</num>
<intro>
<p>The individual authorisation ceases to have effect at the end of the relevant period unless—</p>
</intro>
<paragraph eId="d4e930">
<num>a</num>
<content>
<p>it is renewed before the end of that period, or</p>
</content>
</paragraph>
<paragraph eId="d4e936">
<num>b</num>
<content>
<p>it is cancelled or otherwise ceases to have effect before the end of that period.</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e942">
<num>3</num>
<content>
<p>
In this section the “
<term refersTo="#term-relevant-period">relevant period</term>
” means the period of three months beginning with the day after the day at the end of which the category authorisation ceased to have effect.
</p>
</content>
</subsection>
</section>
</hcontainer>
<hcontainer name="crossheading" eId="d4e951">
<heading>Further and supplementary provision</heading>
<section eId="d4e960">
<num>226D</num>
<heading>
Section
<a href="#p00459">226A</a>
ceasing to apply to part of bulk personal dataset
</heading>
<subsection eId="p00972">
<num>1</num>
<intro>
<p>
Subsections
<a href="#p00987">(2)</a>
to
<a href="#p00997">(4)</a>
apply where—
</p>
</intro>
<paragraph eId="d4e976">
<num>a</num>
<content>
<p>an individual authorisation is granted under this Part in relation to any bulk personal dataset, and</p>
</content>
</paragraph>
<paragraph eId="p00981">
<num>b</num>
<content>
<p>
in the course of examining the dataset in accordance with the authorisation, the head of the intelligence service, or a person acting on their behalf, believes that section
<a href="#p00459">226A</a>
does not apply, or no longer applies, to part of the dataset.
</p>
</content>
</paragraph>
</subsection>
<subsection eId="p00987">
<num>2</num>
<content>
<p>The head of the intelligence service must, so far as is reasonably practicable, secure that anything in the process of being done in relation to that part of the bulk personal dataset in reliance on the authorisation stops as soon as possible.</p>
</content>
</subsection>
<subsection eId="d4e997">
<num>3</num>
<content>
<p>
Section 220 (Part 7 initial examinations: time limits) applies in relation to that part of the bulk personal dataset as if the intelligence service had obtained that part of the dataset at the time when the head of the intelligence service, or the person acting on their behalf, first formed the beliefs mentioned in subsection
<a href="#p00972">(1)</a>
<a href="#p00981">(b)</a>
.
</p>
</content>
</subsection>
<subsection eId="p00997">
<num>4</num>
<content>
<p>
The individual authorisation in relation to that part of the bulk personal dataset is to be treated as if it had been cancelled under section
<a href="#p00870">226CB</a>
at that time.
</p>
</content>
</subsection>
<subsection eId="d4e1017">
<num>5</num>
<intro>
<p>Nothing in this section affects the lawfulness of—</p>
</intro>
<paragraph eId="d4e1023">
<num>a</num>
<content>
<p>anything done in reliance on the authorisation before it ceases to have effect;</p>
</content>
</paragraph>
<paragraph eId="d4e1029">
<num>b</num>
<intro>
<p>if anything is in the process of being done in reliance on the authorisation when it ceases to have effect—</p>
</intro>
<subparagraph eId="d4e1035">
<num>i</num>
<content>
<p>anything done before that thing could be stopped, or</p>
</content>
</subparagraph>
<subparagraph eId="d4e1041">
<num>ii</num>
<content>
<p>anything done that it is not reasonably practicable to stop.</p>
</content>
</subparagraph>
</paragraph>
</subsection>
</section>
<section eId="d4e1050">
<num>226DA</num>
<heading>Annual report</heading>
<subsection eId="d4e1054">
<num>1</num>
<content>
<p>The head of each intelligence service must provide an annual report to the Secretary of State about the bulk personal datasets that were authorised under this Part to be retained, or retained and examined, by the intelligence service during the period to which the report relates.</p>
</content>
</subsection>
<subsection eId="d4e1060">
<num>2</num>
<content>
<p>The first report must relate to a period of at least one year and no more than two years, beginning with the day on which this Part comes fully into force.</p>
</content>
</subsection>
<subsection eId="d4e1066">
<num>3</num>
<content>
<p>Subsequent reports must relate to a period of no more than one year, beginning with the end of the period to which the previous report related.</p>
</content>
</subsection>
<subsection eId="d4e1072">
<num>4</num>
<content>
<p>Each report must be provided to the Secretary of State as soon as reasonably practicable after the end of the period to which the report relates.</p>
</content>
</subsection>
</section>
<section eId="d4e1081">
<num>226DB</num>
<heading>Report to Intelligence and Security Committee</heading>
<subsection eId="p01044">
<num>1</num>
<content>
<p>The Secretary of State must for each relevant period provide to the Intelligence and Security Committee of Parliament a report setting out information about category authorisations and renewals of category authorisations granted in that period.</p>
</content>
</subsection>
<subsection eId="d4e1091">
<num>2</num>
<intro>
<p>
In
<a href="#p01044">subsection (1)</a>
 “
<term refersTo="#term-relevant-period">relevant period</term>
” means—
</p>
</intro>
<paragraph eId="d4e1103">
<num>a</num>
<content>
<p>a period of at least one year and no more than two years beginning with the date on which this Part comes fully into force, and</p>
</content>
</paragraph>
<paragraph eId="d4e1109">
<num>b</num>
<content>
<p>subsequent periods of no more than one year, beginning with the end of the period to which the previous report related.</p>
</content>
</paragraph>
</subsection>
<subsection eId="d4e1115">
<num>3</num>
<content>
<p>Each report must be provided to the Committee as soon as reasonably practicable after the end of the period to which the report relates.</p>
</content>
</subsection>
</section>
<section eId="d4e1127">
<num>226DC</num>
<heading>
Part
<a href="#p00456">7A</a>
: interpretation
</heading>
<subsection eId="d4e1131">
<num>1</num>
<content>
<p>In this Part—</p>
<blockList class="unordered">
<item>
<p>
<term refersTo="#term-category-authorisation">category authorisation</term>
” has the meaning given by section
<a href="#p00576">226BA</a>
<a href="#p00578">(1)</a>
;
</p>
</item>
<item>
<p>
<term refersTo="#term-individual-authorisation">individual authorisation</term>
” has the meaning given by section
<a href="#p00505">226B</a>
<a href="#p00507">(1)</a>
.
</p>
</item>
</blockList>
</content>
</subsection>
<subsection eId="d4e1162">
<num>2</num>
<content>
<p>See also—</p>
<blockList class="unordered">
<item>
<p>section 199 (bulk personal datasets: interpretation),</p>
</item>
<item>
<p>section 263 (general definitions),</p>
</item>
<item>
<p>section 265 (index of defined expressions).</p>
</item>
</blockList>
</content>
</subsection>
<subsection eId="d4e1181">
<num>3</num>
<content>
<p>For the purposes of this Part, only a person holding office under the Crown may act on behalf of the head of an intelligence service.</p>
</content>
</subsection>
</section>
</hcontainer>
</part>
</quotedStructure>
</mod>
</p>
</content>
</section>
</hcontainer>
</part>
</portionBody>
</portion>
</akomaNtoso>