(1) The head of an intelligence service, or a person acting on their behalf, may, at any time, cancel an individual authorisation or a category authorisation.
(2) If the head of an intelligence service, or a person acting on their behalf, considers that any of the cancellation conditions are met in relation to an individual authorisation, or that the cancellation condition is met in relation to a category authorisation, they must cancel the authorisation.
(3) The cancellation conditions for an individual authorisation are—
(a) that section 226A no longer applies to the dataset described in the authorisation;
(b) that the authorisation is no longer necessary for the purpose of the exercise of any function of the intelligence service;
(c) that the conduct authorised by the authorisation is no longer proportionate to what is sought to be achieved by the conduct;
(d) that there are no longer in force arrangements made by the intelligence service, and approved by the Secretary of State, for storing bulk personal datasets to which section 226A applies and for protecting them from unauthorised disclosure.
(4) The cancellation condition for a category authorisation is that section 226A no longer applies to any dataset that falls within the category of datasets described in the authorisation.
226CC Non-renewal or cancellation of individual authorisation
(1) This section applies where an individual authorisation ceases to have effect because it expires without having been renewed or because it is cancelled.
(2) The head of the intelligence service, or a person acting on their behalf, may, before the end of the period of 5 working days beginning with the day on which the authorisation ceases to have effect, decide to grant a new individual authorisation (see section 226B) to retain, or to retain and examine, any material retained by the intelligence service in reliance on the authorisation which has ceased to have effect.
(3) Where an individual authorisation ceases to have effect because it expires without having been renewed or because it is cancelled, an intelligence service is not to be regarded as in breach of section 200(1) or (2) by virtue of its retention or examination of any material to which the authorisation related during the following periods—
(a) the period of 5 working days beginning with the day on which the authorisation ceases to have effect;
(b) if the head of the intelligence service, or a person acting on their behalf, decides to grant a new individual authorisation as mentioned in subsection (2), any period when a Judicial Commissioner is deciding whether to approve the decision.
226CD Non-renewal or cancellation of category authorisation
(1) This section applies where—
(a) a category authorisation ceases to have effect because it expires without having been renewed or because it is cancelled, and
(b) an individual authorisation describing a bulk personal dataset that falls within the category of datasets described in the category authorisation has been granted without the approval of a Judicial Commissioner in accordance with section 226B(6)(a).
(2) The individual authorisation ceases to have effect at the end of the relevant period unless—
(a) it is renewed before the end of that period, or
(b) it is cancelled or otherwise ceases to have effect before the end of that period.
(3) In this section the “relevant period” means the period of three months beginning with the day after the day at the end of which the category authorisation ceased to have effect.
226D Section 226A ceasing to apply to part of bulk personal dataset
(1) Subsections (2) to (4) apply where—
(a) an individual authorisation is granted under this Part in relation to any bulk personal dataset, and
(b) in the course of examining the dataset in accordance with the authorisation, the head of the intelligence service, or a person acting on their behalf, believes that section 226A does not apply, or no longer applies, to part of the dataset.
(2) The head of the intelligence service must, so far as is reasonably practicable, secure that anything in the process of being done in relation to that part of the bulk personal dataset in reliance on the authorisation stops as soon as possible.
(3) Section 220 (Part 7 initial examinations: time limits) applies in relation to that part of the bulk personal dataset as if the intelligence service had obtained that part of the dataset at the time when the head of the intelligence service, or the person acting on their behalf, first formed the beliefs mentioned in subsection (1)(b).
(4) The individual authorisation in relation to that part of the bulk personal dataset is to be treated as if it had been cancelled under section 226CB at that time.
(5) Nothing in this section affects the lawfulness of—
(a) anything done in reliance on the authorisation before it ceases to have effect;
(b) if anything is in the process of being done in reliance on the authorisation when it ceases to have effect—
(i) anything done before that thing could be stopped, or
(ii) anything done that it is not reasonably practicable to stop.
(1) The head of each intelligence service must provide an annual report to the Secretary of State about the bulk personal datasets that were authorised under this Part to be retained, or retained and examined, by the intelligence service during the period to which the report relates.
(2) The first report must relate to a period of at least one year and no more than two years, beginning with the day on which this Part comes fully into force.
(3) Subsequent reports must relate to a period of no more than one year, beginning with the end of the period to which the previous report related.
(4) Each report must be provided to the Secretary of State as soon as reasonably practicable after the end of the period to which the report relates.
226DB Report to Intelligence and Security Committee
(1) The Secretary of State must for each relevant period provide to the Intelligence and Security Committee of Parliament a report setting out information about category authorisations and renewals of category authorisations granted in that period.
(2) In subsection (1) “relevant period” means—
(a) a period of at least one year and no more than two years beginning with the date on which this Part comes fully into force, and
(b) subsequent periods of no more than one year, beginning with the end of the period to which the previous report related.
(3) Each report must be provided to the Committee as soon as reasonably practicable after the end of the period to which the report relates.
(1) In this Part—
“category authorisation” has the meaning given by section 226BA(1);
“individual authorisation” has the meaning given by section 226B(1).
(2) See also—
section 199 (bulk personal datasets: interpretation),
section 263 (general definitions),
section 265 (index of defined expressions).
(3) For the purposes of this Part, only a person holding office under the Crown may act on behalf of the head of an intelligence service.
226E Third party bulk personal datasets: interpretation
(1) For the purposes of this Part, an intelligence service examines a third party bulk personal dataset if—
(a) the intelligence service has relevant access, whether on payment or otherwise, to a set of information that is held electronically by a person other than an intelligence service,
(b) the set includes personal data relating to a number of individuals,
(c) the nature of the set is such that the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions, and
(d) after any initial inspection of the contents (see section 226I), the intelligence service examines the set electronically (but does not obtain the set) for the purpose of the exercise of its functions.
(2) For the purposes of subsection (1)(a), an intelligence service has “relevant access” to a set of information that is held electronically by another person where—
(a) the access is made available to the intelligence service as a result of arrangements made directly between the intelligence service and that other person,
(b) the type and extent of the access available to the intelligence service is not generally available (whether on a commercial basis or otherwise), and
(c) the access is electronic.
(1) An intelligence service may not exercise a power to examine a third party bulk personal dataset unless the examination of the dataset is authorised by a third party BPD warrant.
(2) A “third party BPD warrant” is a warrant issued under this Part authorising an intelligence service to examine any third party bulk personal dataset described in the warrant.
(3) A third party BPD warrant may authorise the examination of a bulk personal dataset—
(a) the content of which may vary from time to time, or
(b) that does not exist at the time of the issue of the warrant.
(1) Section 226F(1) does not apply to the exercise of a power of an intelligence service to examine a third party bulk personal dataset if the intelligence service examines the bulk personal dataset under any other warrant or authorisation issued or given under this Act.
(2) See section 226I(5) (initial inspection) for a further exception to 226F(1).
(1) The head of an intelligence service, or a person acting on their behalf, may apply to the Secretary of State for a third party BPD warrant.
(2) The application must include a general description of the bulk personal dataset (or datasets) to which the application relates.
(3) Where the person making the application knows that subsection (6) applies to any bulk personal dataset to which the application relates, the application must also include a statement to that effect.
(4) The Secretary of State may issue the warrant if—
(a) the Secretary of State considers that the warrant is necessary—
(i) in the interests of national security,
(ii) for the purposes of preventing or detecting serious crime, or
(iii) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,
(b) the Secretary of State considers that the conduct authorised by the warrant is proportionate to what is sought to be achieved by the conduct,
(c) the Secretary of State considers that the arrangements made by the intelligence service for examining the bulk personal dataset (or datasets) to which the application relates are satisfactory, and
(d) except where the Secretary of State considers that there is an urgent need to issue the warrant, the decision to issue the warrant has been approved by a Judicial Commissioner.
(5) The fact that a third party BPD warrant would authorise the examination of bulk personal datasets relating to activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary on grounds falling within subsection (4)(a).
(6) This subsection applies to a bulk personal dataset if—
(a) the dataset consists of, or includes, protected data or health records,
(b) a substantial proportion of the dataset consists of sensitive personal data, or
(c) the nature of the dataset, or the circumstances in which it was created, is or are such that its examination by the intelligence service is likely to raise novel or contentious issues.
(7) In this section—
“health record” means a record, or a copy of a record which—
consists of information relating to the physical or mental health or condition of an individual,
was made by or on behalf of a health professional in connection with the care of that individual, and
was obtained, by the person (mentioned in section 226E(1)(a)) who holds the dataset, from a health professional or a health service body or from a person acting on behalf of a health professional or a health service body in relation to the record or the copy;
“sensitive personal data” has the meaning given by section 202(4).
(8) In subsection (7), “health professional” and “health service body” have the meaning given by section 206(7).
(9) An application for a third party BPD warrant may only be made on behalf of the head of an intelligence service by a person holding office under the Crown.
226GA Approval of warrants by Judicial Commissioners
(1) In deciding whether to approve a decision to issue a third party BPD warrant, a Judicial Commissioner must review the Secretary of State’s conclusions as to the following matters—
(a) whether the warrant is necessary on grounds falling within section 226G(4)(a), and
(b) whether the conduct that would be authorised by the warrant is proportionate to what is sought to be achieved by that conduct.
(2) In doing so, the Judicial Commissioner must—
(a) apply the same principles as would be applied by a court on an application for judicial review, and
(b) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).
(3) Where a Judicial Commissioner refuses to approve a decision to issue a third party BPD warrant, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.
(4) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to issue a third party BPD warrant, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to issue the warrant.
226GB Approval of third party BPD warrants issued in urgent cases
(1) This section applies where—
(a) a third party BPD warrant is issued without the approval of a Judicial Commissioner, and
(b) the Secretary of State considered that there was an urgent need to issue it.
(2) The Secretary of State must inform a Judicial Commissioner that it has been issued.
(3) The Judicial Commissioner must, before the end of the relevant period—
(a) decide whether to approve the decision to issue the warrant, and
(b) notify the Secretary of State of the Judicial Commissioner’s decision.
The “relevant period” means the period ending with the third working day after the day on which the warrant was issued.
(4) Subsections (5) and (6) apply if a Judicial Commissioner refuses to approve the decision to issue a third party BPD warrant.
(5) The warrant—
(a) ceases to have effect (unless already cancelled), and
(b) may not be renewed,
and section 226GA(4) does not apply in relation to the refusal to approve the decision.
(6) The head of the intelligence service to whom the warrant was addressed must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the warrant stops as soon as possible.
(7) Nothing in subsection (5) or (6) affects the lawfulness of—
(a) anything done in reliance on the warrant before it ceases to have effect;
(b) if anything is in the process of being done in reliance on the warrant when it ceases to have effect—
(i) anything done before that thing could be stopped, or
(ii) anything done that it is not reasonably practicable to stop.
226GC Decisions to issue warrants to be taken personally by Secretary of State
(1) The decision to issue a third party BPD warrant must be taken personally by the Secretary of State.
(2) Before a third party BPD warrant is issued, it must be signed by the Secretary of State.
(3) But if it is not reasonably practicable for a third party BPD warrant to be signed by the Secretary of State, it may be signed by a senior official designated by the Secretary of State for that purpose.
(4) In such a case, the warrant must contain a statement that—
(a) it is not reasonably practicable for the warrant to be signed by the Secretary of State, and
(b) the Secretary of State has personally and expressly authorised the issue of the warrant.
A third party BPD warrant must—
(a) be addressed to the head of the intelligence service by whom, or on whose behalf, the application for the warrant was made, and
(b) include a general description of the bulk personal dataset (or datasets) to which the warrant relates.
(1) A third party BPD warrant ceases to have effect at the end of the relevant period unless—
(a) it is renewed before the end of that period (see section 226HA), or
(b) it is cancelled or otherwise ceases to have effect before the end of that period (see sections 226GB and 226HB).
(2) In this section “the relevant period”—
(a) in the case of an urgent third party BPD warrant, means the period ending with the fifth working day after the day on which the warrant was issued, and
(b) in any other case, means the period of 12 months beginning with—
(i) the day on which the warrant was issued, or
(ii) in the case of a warrant that has been renewed, the day after the day at the end of which the warrant would have ceased to have effect if it had not been renewed.
(3) For the purposes of this section, a third party BPD warrant is an “urgent third party BPD warrant” if—
(a) the warrant was issued without the approval of a Judicial Commissioner, and
(b) the Secretary of State considered that there was an urgent need to issue it.
(1) If the renewal conditions are met, a third party BPD warrant may be renewed, at any time during the renewal period, by an instrument issued by the Secretary of State.
(2) The renewal conditions are—
(a) that the Secretary of State considers that the warrant continues to be necessary on grounds falling within section 226G(4)(a),
(b) that the Secretary of State considers that the conduct that would be authorised by the renewed warrant continues to be proportionate to what is sought to be achieved by the conduct, and
(c) that the decision to renew the warrant has been approved by a Judicial Commissioner.
(3) In this section the “renewal period” means—
(a) in the case of an urgent third party BPD warrant which has not been renewed, the relevant period;
(b) in any other case, the period of 30 days ending with the day at the end of which the warrant would otherwise cease to have effect.
(4) The decision to renew a third party BPD warrant must be taken personally by the Secretary of State, and the instrument renewing the warrant must be signed by the Secretary of State.
(5) Section 226GA (approval of warrants by Judicial Commissioner) applies in relation to a decision to renew a warrant as it applies in relation to a decision to issue a warrant.
(6) In this section—
“the relevant period” has the same meaning as in section 226H;
“urgent third party BPD warrant” is to be read in accordance with subsection (3) of that section.
(1) The Secretary of State, or a senior official acting on behalf of the Secretary of State, may cancel a third party BPD warrant at any time.
(2) If the Secretary of State, or a senior official acting on behalf of the Secretary of State, considers that any of the cancellation conditions are met in relation to a third party BPD warrant, the person must cancel the warrant.
(3) The cancellation conditions are—
(a) that the warrant is no longer necessary on any grounds falling within section 226G(4)(a);
(b) that the conduct authorised by the warrant is no longer proportionate to what is sought to be achieved by that conduct.
226HC Non-renewal or cancellation of third party BPD warrant
(1) This section applies where a third party BPD warrant ceases to have effect because it expires without having been renewed or because it is cancelled.
(2) The head of the intelligence service to whom the warrant was addressed must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the warrant stops as soon as possible.
(3) Nothing in this section affects the lawfulness of—
(a) anything done in reliance on the warrant before it ceases to have effect;
(b) if anything is in the process of being done in reliance on the warrant when it ceases to have effect—
(i) anything done before that thing could be stopped, or
(ii) anything done that it is not reasonably practicable to stop.
(1) This section applies where—
(a) an intelligence service has relevant access, whether on payment or otherwise, to a set of information that is held electronically by a person other than an intelligence service,
(b) the intelligence service is considering examining the set of information electronically for the purpose of the exercise of its functions,
(c) the examination would be otherwise than in the exercise of a power conferred by a warrant or other authorisation issued or given under this Act, and
(d) the head of the intelligence service, or a person acting on their behalf, believes that—
(i) the set includes, or may include, personal data relating to a number of individuals, and
(ii) the nature of the set is, or may be, such that the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions.
(2) The head of the intelligence service, or a person acting on their behalf, may carry out an initial inspection of the contents of the set for the purpose of deciding whether, if the intelligence service were to examine it after that initial inspection—
(a) the intelligence service would be examining a third party bulk personal dataset (see section 226E), and
(b) such examination would be necessary and proportionate in all the circumstances.
(3) Subsection (4) applies if, after the initial inspection is carried out, the head of the intelligence service, or a person acting on their behalf, decides that—
(a) the intelligence service would be examining a third party bulk personal dataset (as mentioned in subsection (2)(a)), and
(b) such examination would be necessary and proportionate in all the circumstances.
(4) The head of the intelligence service, or a person acting on their behalf, must—
(a) decide whether to examine the third party bulk personal dataset, and
(b) if they decide to do so, apply for a third party BPD warrant.
(5) If the head of the intelligence service, or a person acting on their behalf, applies for such a third party BPD warrant, the intelligence service is not to be regarded as in breach of section 226F(1) by virtue of examining the bulk personal dataset if the examination is necessary for the purposes of the making of the application for the warrant.
(6) For the purposes of subsection (1)(a), “relevant access” is to be read in accordance with section 226E(2).
(7) For the purposes of this section, only a person holding office under the Crown may act on behalf of the head of an intelligence service.
226IA Safeguards relating to examination of third party bulk personal datasets
(1) The Secretary of State must ensure, in relation to every third party BPD warrant which authorises the examination of a bulk personal dataset, that arrangements are in force for securing that any examination of data contained in the dataset is necessary and proportionate in all the circumstances.
(2) In doing so, the Secretary of State must in particular have regard to the information that is reasonably available to the intelligence services in relation to the examination of such data.
226IB Additional safeguards for items subject to legal privilege: examination
(1) Subsections (2) and (3) apply if, in a case where protected data contained in a third party bulk personal dataset is to be examined in reliance on a third party BPD warrant—
(a) the purpose, or one of the purposes, of using the criteria to be used for the examination of the data (“the relevant criteria”) is to identify any items subject to legal privilege, or
(b) the use of the relevant criteria is likely to identify such items.
(2) If the relevant criteria are referable to an individual known to be in the British Islands at the time of the examination, the data may be examined using the relevant criteria only if the Secretary of State has approved the use of those criteria.
(3) In any other case, the data may be examined using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.
(4) The Secretary of State may give approval for the purposes of subsection (2) only with the approval of a Judicial Commissioner.
(5) Approval may be given under subsection (2) or (3) only if, where subsection (1)(a) applies, the Secretary of State or (as the case may be) the senior official considers that there are exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria.
(6) In deciding whether to give an approval under subsection (2) or (3) in a case where subsection (1)(a) applies, the Secretary of State or (as the case may be) the senior official must have regard to the public interest in the confidentiality of items subject to legal privilege.
(7) For the purposes of subsection (5), there cannot be exceptional and compelling circumstances that make it necessary to authorise the use of the relevant criteria unless—
(a) the public interest in obtaining the information that would be obtained by the examination of the data outweighs the public interest in the confidentiality of items subject to legal privilege,
(b) there are no other means by which the information may reasonably be obtained, and
(c) obtaining the information is necessary in the interests of national security or for the purpose of preventing death or significant injury.
(8) In deciding whether to give approval for the purposes of subsection (4), the Judicial Commissioner must—
(a) apply the same principles as would be applied by a court on an application for judicial review, and
(b) consider the matter with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).
(9) Subsections (10) and (11) apply if, in a case where protected data contained in a third party bulk personal dataset is to be examined in reliance on a third party BPD warrant—
(a) the purpose, or one of the purposes, of using the criteria to be used for the examination of the data (“the relevant criteria”) is to identify data that, if the data or any underlying material were not created or held with the intention of furthering a criminal purpose, would be an item subject to legal privilege, and
(b) the person to whom the warrant is addressed considers that the data (“the targeted data”) or any underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose.
(10) If the relevant criteria are referable to an individual known to be in the British Islands at the time of the examination, the data may be examined using the relevant criteria only if the Secretary of State has approved the use of those criteria.
(11) In any other case, the data may be examined using the relevant criteria only if a senior official acting on behalf of the Secretary of State has approved the use of those criteria.
(12) Approval may be given under subsection (10) or (11) only if the Secretary of State or (as the case may be) the senior official considers that the targeted data or the underlying material is likely to be data or underlying material created or held with the intention of furthering a criminal purpose.
(13) In this section “underlying material”, in relation to data contained in a third party bulk personal dataset that is to be examined in reliance on a third party BPD warrant, means any communications or other items of information from which the data was produced.
226IC Additional safeguards for items subject to legal privilege: retention following examination
(1) Subsection (2) applies where—
(a) an intelligence service examines a third party bulk personal dataset in reliance on a third party BPD warrant,
(b) as part of the examination, the intelligence service examines an item subject to legal privilege,
(c) the intelligence service retains the item, and
(d) the retention of the item may not be authorised by a warrant under Part 7 (bulk personal dataset warrants).
(2) The person to whom the third party BPD warrant (mentioned in subsection (1)(a)) is addressed must inform the Investigatory Powers Commissioner as soon as reasonably practicable after retaining the item.
(3) Unless the Investigatory Powers Commissioner considers that subsection (5) applies to the item, the Commissioner must—
(a) direct that the item is destroyed, or
(b) impose one or more conditions as to the use or retention of that item.
(4) If the Investigatory Powers Commissioner considers that subsection (5) applies to the item, the Commissioner may nevertheless impose such conditions under subsection (3)(b) as the Commissioner considers necessary for the purpose of protecting the public interest in the confidentiality of items subject to legal privilege.
(5) This subsection applies to an item subject to legal privilege if—
(a) the public interest in retaining the item outweighs the public interest in the confidentiality of items subject to legal privilege, and
(b) retaining the item is necessary in the interests of national security or for the purpose of preventing death or significant injury.
(6) The Investigatory Powers Commissioner—
(a) may require an affected party to make representations about how the Commissioner should exercise any function under subsection (3), and
(b) must have regard to any such representations made by an affected party (whether or not as a result of a requirement imposed under paragraph (a)).
(7) Each of the following is an “affected party” for the purposes of subsection (6)—
(a) the Secretary of State;
(b) the person to whom the third party BPD warrant is or was addressed.
226ID Offence of breaching safeguards relating to examination of material
(1) A person commits an offence if—
(a) the person examines, in reliance on a third party BPD warrant, any data contained in a third party bulk personal dataset,
(b) the person knows or believes that the examination of that data is in breach of the requirement specified in subsection (2), and
(c) the person deliberately examines that data in breach of that requirement.
(2) The requirement specified in this subsection is that any examination of the data is necessary and proportionate.
(3) A person guilty of an offence under this section is liable—
(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding the general limit in a magistrates’ court, to a fine or to both;
(b) on summary conviction in Scotland, to imprisonment for a term not exceeding 12 months, to a fine not exceeding the statutory maximum or to both;
(c) on summary conviction in Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding the statutory maximum or to both;
(d) on conviction on indictment, to imprisonment for a term not exceeding 2 years, to a fine or to both.
(4) No proceedings for any offence which is an offence by virtue of this section may be instituted—
(a) in England and Wales, except by or with the consent of the Director of Public Prosecutions;
(b) in Northern Ireland, except by or with the consent of the Director of Public Prosecutions for Northern Ireland.
(1) In this Part—
“personal data” has the same meaning as in Part 7 (see section 199(2));
“protected data” has the same meaning as in Part 7 (see section 203);
“senior official” means a member of the Senior Civil Service or a member of the Senior Management Structure of His Majesty’s Diplomatic Service;
“third party BPD warrant” has the meaning given by section 226F.
(3) See also—
section 263 (general definitions),
section 265 (index of defined expressions).
227 Investigatory Powers Commissioner and other Judicial Commissioners
(1) The Prime Minister must appoint—
(a) the Investigatory Powers Commissioner, and
(b) such number of other Judicial Commissioners as the Prime Minister considers necessary for the carrying out of the functions of the Judicial Commissioners.
(2) A person is not to be appointed as the Investigatory Powers Commissioner or another Judicial Commissioner unless the person holds or has held a high judicial office (within the meaning of Part 3 of the Constitutional Reform Act 2005).
(3) A person is not to be appointed as the Investigatory Powers Commissioner unless recommended jointly by—
(a) the Lord Chancellor,
(b) the Lord Chief Justice of England and Wales,
(c) the Lord President of the Court of Session, and
(d) the Lord Chief Justice of Northern Ireland.
(4) A person is not to be appointed as a Judicial Commissioner under subsection (1)(b) unless recommended jointly by—
(a) the Lord Chancellor,
(b) the Lord Chief Justice of England and Wales,
(c) the Lord President of the Court of Session,
(d) the Lord Chief Justice of Northern Ireland, and
(e) the Investigatory Powers Commissioner.
(5) Before appointing any person under subsection (1), the Prime Minister must consult the Scottish Ministers.
(6) The Prime Minister must have regard to a memorandum of understanding agreed between the Prime Minister and the Scottish Ministers when exercising functions under subsection (1) or (5).
(6A) The Investigatory Powers Commissioner may appoint up to two persons who are Judicial Commissioners to be Deputy Investigatory Powers Commissioners.
(6B) A person appointed as a Deputy Investigatory Powers Commissioner continues to be a Judicial Commissioner.
(7) The Investigatory Powers Commissioner is a Judicial Commissioner and the Investigatory Powers Commissioner and the other Judicial Commissioners are to be known, collectively, as the Judicial Commissioners.
(8) The Investigatory Powers Commissioner may, to such extent as the Investigatory Powers Commissioner may decide, delegate the exercise of functions of the Investigatory Powers Commissioner to—
(a) a Deputy Investigatory Powers Commissioner, or
(b) any other Judicial Commissioner.
(8A) Subsection (8)(a) applies to the function of the Investigatory Powers Commissioner of—
(a) making a recommendation under subsection (4)(e),
(b) deciding under section 90(11) or 257(10) whether to approve a decision of the Secretary of State,
(c) making an appointment under section 228A(2) or 247(1), or
(d) deciding—
(i) an appeal against, or a review of, a decision made by another Judicial Commissioner, and
(ii) any action to take as a result,
only where the Investigatory Powers Commissioner is unable or unavailable to exercise the function for any reason.
(8B) Subsection (8)(b) does not apply to any function of the Investigatory Powers Commissioner mentioned in subsection (8A).
(8C) Subsection (8) does not apply to the function of the Investigatory Powers Commissioner of making an appointment under subsection (6A).
(8D) Where there are two Deputy Investigatory Powers Commissioners, the power in subsection (8)(a) may, in particular, be used to delegate to one Deputy Investigatory Powers Commissioner the exercise of the function of the Investigatory Powers Commissioner of deciding—
(a) an appeal against, or a review of, a decision made by the other Deputy Investigatory Powers Commissioner, and
(b) any action to take as a result.
(9A) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(10) The delegation under subsection (8) to any extent of functions by the Investigatory Powers Commissioner does not prevent the exercise of the functions to that extent by that Commissioner.
(10A) Where—
(a) the exercise of a function of the Investigatory Powers Commissioner mentioned in subsection (8A)(d) is delegated to a Deputy Investigatory Powers Commissioner in accordance with subsection (8)(a), and
(b) the Deputy Investigatory Powers Commissioner decides the appeal or review (and any action to take as a result),
no further appeal, or request for a further review, may be made to the Investigatory Powers Commissioner in relation to the decision of the Deputy Investigatory Powers Commissioner.
(11) Any function exercisable by a Judicial Commissioner or any description of Judicial Commissioners is exercisable by any of the Judicial Commissioners or (as the case may be) any of the Judicial Commissioners of that description.
(12) Subsection (11) does not apply to—
(a) any function conferred on the Investigatory Powers Commissioner by name (except so far as its exercise by any of the Judicial Commissioners or any description of Judicial Commissioners is permitted by a delegation under subsection (8)), or
(b) any function conferred on, or delegated under subsection (8) to, any other particular named Judicial Commissioner.
(13) References in any enactment—
(a) to a Judicial Commissioner are to be read as including the Investigatory Powers Commissioner, and
(b) to the Investigatory Powers Commissioner are to be read—
(i) so far as necessary for the purposes of subsection (8)(a), as references to the Investigatory Powers Commissioner or any Deputy Investigatory Powers Commissioner, and
(ii) so far as necessary for the purposes of subsection (8)(b), as references to the Investigatory Powers Commissioner or any other Judicial Commissioner.
(14) In this section a reference to deciding an appeal against, or a review of, a decision made by a Judicial Commissioner includes a reference to deciding whether to approve a decision that the Judicial Commissioner has refused to approve.
(1) Subject as follows, each Judicial Commissioner holds and vacates office in accordance with the Commissioner's terms and conditions of appointment.
(2) Each Judicial Commissioner is to be appointed for a term of three years.
(3) A person who ceases to be a Judicial Commissioner (otherwise than under subsection (5)) may be re-appointed under section 227(1).
(4) A Judicial Commissioner may not, subject to subsection (5), be removed from office before the end of the term for which the Commissioner is appointed unless a resolution approving the removal has been passed by each House of Parliament.
(5) A Judicial Commissioner may be removed from office by the Prime Minister if, after the appointment of the Commissioner—
(a) a bankruptcy order is made against the Commissioner or the Commissioner's estate is sequestrated or the Commissioner makes a composition or arrangement with, or grants a trust deed for, the Commissioner's creditors,
(b) any of the following orders is made against the Commissioner—
(i) a disqualification order under the Company Directors Disqualification Act 1986 or the Company Directors Disqualification (Northern Ireland) Order 2002,
(ii) an order under section 429(2)(b) of the Insolvency Act 1986 (failure to pay under county court administration order),
(iii) an order under section 429(2) of the Insolvency Act 1986 (disabilities on revocation of county court administration order),
(c) the Commissioner's disqualification undertaking is accepted under section 7 or 8 of the Company Directors Disqualification Act 1986 or under the Company Directors Disqualification (Northern Ireland) Order 2002, or
(d) the Commissioner is convicted in the United Kingdom, the Channel Islands or the Isle of Man of an offence and receives a sentence of imprisonment (whether suspended or not).
(6) A person ceases to be a Deputy Investigatory Powers Commissioner if—
(a) the person ceases to be a Judicial Commissioner,
(b) the Investigatory Powers Commissioner removes the person from being a Deputy Investigatory Powers Commissioner, or
(c) the person resigns as a Deputy Investigatory Powers Commissioner.
(1) The power in subsection (2) is exercisable where the Investigatory Powers Commissioner and the Secretary of State consider that—
(a) as a result of exceptional circumstances, there is a shortage of persons able to carry out Judicial Commissioner functions, and
(b) the power in subsection (2) needs to be exercised in order to deal with that shortage.
(2) The Investigatory Powers Commissioner may appoint one or more persons to carry out Judicial Commissioner functions.
(3) A person appointed under subsection (2) is referred to in this section as a “temporary Judicial Commissioner”.
(4) A temporary Judicial Commissioner may be appointed under subsection (2) for one or more terms not exceeding six months each and not exceeding three years in total.
(5) As soon as practicable after the appointment of any temporary Judicial Commissioner, the Investigatory Powers Commissioner must notify the following persons of the appointment—
(a) the Prime Minister;
(b) the Secretary of State;
(c) the Scottish Ministers;
(d) the Lord Chancellor;
(e) the Lord Chief Justice of England and Wales;
(f) the Lord President of the Court of Session;
(g) the Lord Chief Justice of Northern Ireland.
(6) A reference to a Judicial Commissioner in any enactment (including this Act) is to be read (so far as the context allows) as referring also to a temporary Judicial Commissioner.
(7) But subsections (1) and (4) to (6) of section 227 and section 228(2) (appointment requirements etc) do not apply in relation to temporary Judicial Commissioners.
(8) In this section “Judicial Commissioner functions” means the functions conferred on Judicial Commissioners by any enactment (including this Act).
(1) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation) the exercise by public authorities of statutory functions relating to—
(a) the interception of communications,
(b) the acquisition or retention of communications data,
(c) the acquisition of secondary data or related systems data under Chapter 1 of Part 2 or Chapter 1 of Part 6, or
(d) equipment interference.
(2) Such statutory functions include, in particular, functions relating to the disclosure, retention or other use of—
(a) any content of communications intercepted by an interception authorised or required by a warrant under Chapter 1 of Part 2 or Chapter 1 of Part 6,
(b) acquired or retained communications data,
(c) data acquired as mentioned in subsection (1)(c), or
(d) communications, equipment data or other information acquired by means of equipment interference.
(3) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation)—
(a) the acquisition, retention, use or disclosure of bulk personal datasets by an intelligence service,
(b) the giving and operation of notices under section 252 (national security notices),
(c) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(d) the exercise of functions by virtue of sections 1 to 4 of the Prisons (Interference with Wireless Telegraphy) Act 2012,
(e) the exercise of functions by virtue of Part 2 or 3 of the Regulation of Investigatory Powers Act 2000 (surveillance, covert human intelligence sources and investigation of electronic data protected by encryption etc.),
(f) the adequacy of the arrangements by virtue of which the duties imposed by section 55 of that Act are sought to be discharged,
(g) the exercise of functions by virtue of the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp 11) (surveillance and covert human intelligence sources),
(h) the exercise of functions under Part 3 of the Police Act 1997 (authorisation of action in respect of property),
(i) the exercise by the Secretary of State of functions under sections 5 to 7 of the Intelligence Services Act 1994 (warrants for interference with wireless telegraphy, entry and interference with property etc.), and
(j) the exercise by the Scottish Ministers (by virtue of provision made under section 63 of the Scotland Act 1998) of functions under sections 5 and 6(3) and (4) of the Act of 1994.
(3A) The Investigatory Powers Commissioner must, in accordance with the Agreement between the Government of the United Kingdom and the Government of the United States of America on access to electronic data for the purpose of countering serious crime dated 3rd October 2019, keep under review the compliance by public authorities with the terms of that Agreement.
(3B) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation) the process operated by GCHQ for determining whether information about vulnerabilities in technology should be disclosed.
(3C) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation) compliance by the persons mentioned in subsection (3D) with “The Principles Relating to the Detention and Interviewing of Detainees Overseas and the Passing and Receipt of Intelligence Relating to Detainees”, as published on 18th July 2019.
(3D) Those persons are—
(a) members and civilian staff of the metropolitan police force who are carrying out activities to which a collaboration agreement made under section 22A of the Police Act 1996 relating to counter-terrorism activities applies, and
(b) officers of the National Crime Agency.
(3E) The Investigatory Powers Commissioner must keep under review (including by way of audit, inspection and investigation) compliance by any part of His Majesty’s forces, or by any part of the Ministry of Defence, with policies governing—
(a) the use of surveillance outside the United Kingdom, and
(b) the use and conduct of covert human intelligence sources outside the United Kingdom,
(whether or not authorised under the Regulation of Investigatory Powers Act 2000).
(4) But the Investigatory Powers Commissioner is not to keep under review—
(a) the exercise of any function of a relevant Minister to make subordinate legislation,
(b) the exercise of any function by a judicial authority,
(c) the exercise of any function by virtue of Part 3 of the Regulation of Investigatory Powers Act 2000 which is exercisable with the permission of a judicial authority,
(d) the exercise of any function which—
(i) is for the purpose of obtaining information or taking possession of any document or other property in connection with communications stored in or by a telecommunication system, or
(ii) is carried out in accordance with an order made by a judicial authority for that purpose,
and is not exercisable by virtue of this Act, the Regulation of Investigatory Powers Act 2000, the Regulation of Investigatory Powers (Scotland) Act 2000, the Crime (Overseas Production Orders) Act 2019 or an enactment mentioned in subsection (3)(c), (h), (i) or (j) above,
(e) the exercise of any function where the conduct concerned is—
(i) conduct authorised by section 45, 47 or 50, or
(ii) conduct authorised by section 46 which is not conduct by or on behalf of an intercepting authority (within the meaning given by section 18(1)), or
(f) the exercise of any function which is subject to review by the Information Commission or the Investigatory Powers Commissioner for Northern Ireland.
(4A) In keeping matters under review in accordance with subsection (3)(e), the Investigatory Powers Commissioner must, in particular, keep under review the exercise of the power to grant or renew authorisations under section 29B of the Regulation of Investigatory Powers Act 2000.
(4B) In keeping under review the exercise of the power mentioned in subsection (4A), the Investigatory Powers Commissioner must, in particular, keep under review whether public authorities are complying with any requirements imposed on them by virtue of Part 2 of the Regulation of Investigatory Powers Act 2000 in relation to juvenile criminal conduct authorisations and vulnerable adult criminal conduct authorisations.
(4C) For the purposes of subsection (4B)—
(a) “a juvenile criminal conduct authorisation” is an authorisation under section 29B of the Regulation of Investigatory Powers Act 2000 where the covert human intelligence source to whom the authorisation relates is under the age of 18; and
(b) “a vulnerable adult criminal conduct authorisation” is an authorisation under section 29B of the Regulation of Investigatory Powers Act 2000 where the covert human intelligence source to whom the authorisation relates is a vulnerable adult within the meaning of section 29D(3) of that Act.
(5) In keeping matters under review in accordance with this section, the Investigatory Powers Commissioner must, in particular, keep under review the operation of safeguards to protect privacy.
(6) In exercising functions under this Act, a Judicial Commissioner must not act in a way which the Commissioner considers to be contrary to the public interest or prejudicial to—
(a) national security,
(b) the prevention or detection of serious crime, or
(c) the economic well-being of the United Kingdom.
(7) A Judicial Commissioner must, in particular, ensure that the Commissioner does not—
(a) jeopardise the success of an intelligence or security operation or a law enforcement operation,
(b) compromise the safety or security of those involved, or
(c) unduly impede the operational effectiveness of an intelligence service, a police force, a government department or Her Majesty's forces.
(8) Subsections (6) and (7) do not apply in relation to any of the following functions of a Judicial Commissioner—
(a) deciding—
(i) whether to serve, vary or cancel a monetary penalty notice under section 7 or paragraph 16 of Schedule 1, a notice of intent under paragraph 4 of that Schedule or an information notice under Part 2 of that Schedule, or
(ii) the contents of any such notice,
(b) deciding whether to approve the issue, modification or renewal of a warrant,
(c) deciding whether to direct the destruction of material or how otherwise to deal with the situation where—
(i) a warrant issued, or modification made, for what was considered to be an urgent need is not approved, or
(ii) an item subject to legal privilege is retained, following its examination, for purposes other than the destruction of the item,
(d) deciding whether to—
(i) approve the grant, modification or renewal of an authorisation, or
(ii) quash or cancel an authorisation or renewal,
(e) deciding whether to approve—
(i) the giving , varying or renewal of a retention notice under Part 4 or a notice under section 252 or 253, or
(ii) the giving of a notice under section 90(10)(b) or 257(9)(b),
(f) participating in a review under section 90 or 257,
(fa) deciding whether—
(i) to approve the use of criteria under section 154(2)(a),
(ii) subsection 154(8) applies for the purposes of subsection 154(6) and (7),
(iii) the relevant condition is met for the purposes of subsection 154A(3)(a).
(fb) deciding whether—
(i) to approve the use of criteria under section 195(2)(a),
(ii) subsection 195(8) applies for the purposes of subsection 195(6) and (7),
(iii) the relevant condition is met for the purposes of subsection 195A(3)(a).
(g) deciding whether to approve an authorisation under section 219(3)(b),
(h) deciding whether to give approval under section 222(4),
(i) deciding whether to approve the giving or varying of a direction under section 225(3),
(j) making a decision under section 231(1),
(k) deciding whether to order the destruction of records under section 103 of the Police Act 1997, section 37 of the Regulation of Investigatory Powers Act 2000 or section 15 of the Regulation of Investigatory Powers (Scotland) Act 2000,
(l) deciding whether to make an order under section 103(6) of the Police Act 1997 (order enabling the taking of action to retrieve anything left on property in pursuance of an authorisation),
(m) deciding—
(i) an appeal against, or a review of, a decision by another Judicial Commissioner, and
(ii) any action to take as a result.
(8A) Subsections (6) and (7) also do not apply in relation to the functions of the Investigatory Powers Commissioner under section 60A or 65(3B).
(9) In this section—
“bulk personal dataset” is to be read in accordance with section 199 (and includes a third party bulk personal dataset (see section 226E)),
“equipment data” has the same meaning as in Part 5 (see section 100),
“judicial authority” means a judge, court or tribunal or any person exercising the functions of a judge, court or tribunal (but does not include a Judicial Commissioner),
“police force” has the same meaning as in Part 2 (see section 60(1)),
“related systems data” has the meaning given by section 15(6),
“relevant Minister” means a Minister of the Crown or government department, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department,
“secondary data” has the same meaning as in Part 2 (see section 16).
(1) So far as directed to do so by the Prime Minister and subject to subsection (2), the Investigatory Powers Commissioner must keep under review the carrying out of any aspect of the functions of—
(a) an intelligence service,
(b) a head of an intelligence service, ...
(c) any part of Her Majesty's forces, or of the Ministry of Defence, so far as engaging in intelligence activities , or
(d) any public authority not mentioned in paragraphs (a) to (c), or any part of such an authority, so far as engaging in intelligence activities.
(2) Subsection (1) does not apply in relation to anything which is required to be kept under review by the Investigatory Powers Commissioner under section 229.
(3) The Prime Minister may give a direction under this section at the request of the Investigatory Powers Commissioner or the Intelligence and Security Committee of Parliament or otherwise.
(4) The Prime Minister must publish, in a manner which the Prime Minister considers appropriate, any direction under this section (and any revocation of such a direction) except so far as it appears to the Prime Minister that such publication would be contrary to the public interest or prejudicial to—
(a) national security,
(b) the prevention or detection of serious crime,
(c) the economic well-being of the United Kingdom, or
(d) the continued discharge of the functions of any public authority whose activities include activities that are subject to review by the Investigatory Powers Commissioner.
(1) The Investigatory Powers Commissioner must inform a person of any relevant error relating to that person of which the Commissioner is aware if the Commissioner considers that—
(a) the error is a serious error, and
(b) it is in the public interest for the person to be informed of the error.
(2) In making a decision under subsection (1)(a), the Investigatory Powers Commissioner may not decide that an error is a serious error unless the Commissioner considers that the error has caused significant prejudice or harm to the person concerned.
(3) Accordingly, the fact that there has been a breach of a person's Convention rights (within the meaning of the Human Rights Act 1998) is not sufficient by itself for an error to be a serious error.
(4) In making a decision under subsection (1)(b), the Investigatory Powers Commissioner must, in particular, consider—
(a) the seriousness of the error and its effect on the person concerned, and
(b) the extent to which disclosing the error would be contrary to the public interest or prejudicial to—
(i) national security,
(ii) the prevention or detection of serious crime,
(iii) the economic well-being of the United Kingdom, or
(iv) the continued discharge of the functions of any of the intelligence services.
(5) Before making a decision under subsection (1)(a) or (b), the Investigatory Powers Commissioner must ask the public authority which has made the error to make submissions to the Commissioner about the matters concerned.
(6) When informing a person under subsection (1) of an error, the Investigatory Powers Commissioner must—
(a) inform the person of any rights that the person may have to apply to the Investigatory Powers Tribunal, and
(b) provide such details of the error as the Commissioner considers to be necessary for the exercise of those rights, having regard in particular to the extent to which disclosing the details would be contrary to the public interest or prejudicial to anything falling within subsection (4)(b)(i) to (iv).
(7) The Investigatory Powers Commissioner may not inform the person to whom it relates of a relevant error except as provided by this section.
(8) A report under section 234(1) must include information about—
(a) the number of relevant errors of which the Investigatory Powers Commissioner has become aware during the year to which the report relates,
(b) the number of relevant errors which the Commissioner has decided during that year were serious errors, and
(c) the number of persons informed under subsection (1) during that year.
(9) In this section “relevant error” means an error—
(a) by a public authority in complying with any requirements which are imposed on it by virtue of this Act or any other enactment and which are subject to review by a Judicial Commissioner, and
(b) of a description identified for this purpose in a relevant code of practice,
and the Investigatory Powers Commissioner must keep under review the definition of “relevant error”.
(10) In subsection (9) “relevant code of practice” means a code of practice under—
(a) Schedule 7,
(b) the Police Act 1997,
(c) the Regulation of Investigatory Powers Act 2000, or
(d) the Regulation of Investigatory Powers (Scotland) Act 2000.
(1) A Judicial Commissioner must give the Investigatory Powers Tribunal all such documents, information and other assistance (including the Commissioner's opinion as to any issue falling to be determined by the Tribunal) as the Tribunal may require—
(a) in connection with the investigation of any matter by the Tribunal, or
(b) otherwise for the purposes of the Tribunal's consideration or determination of any matter.
(2) A Judicial Commissioner may provide advice or information to any public authority or other person in relation to matters for which a Judicial Commissioner is responsible.
(3) But a Judicial Commissioner must consult the Secretary of State before providing any advice or information under subsection (2) if it appears to the Commissioner that providing the advice or information might be contrary to the public interest or prejudicial to—
(a) national security,
(b) the prevention or detection of serious crime,
(c) the economic well-being of the United Kingdom, or
(d) the continued discharge of the functions of any public authority whose activities include activities that are subject to review by the Investigatory Powers Commissioner.
(4) In addition to consulting the Secretary of State under subsection (3), the Judicial Commissioner must also consult the Scottish Ministers if it appears to the Commissioner that providing the advice or information might be prejudicial to—
(a) the prevention or detection of serious crime by a Scottish public authority, or
(b) the continued discharge of any devolved functions of a Scottish public authority whose activities include activities that are subject to review by the Investigatory Powers Commissioner.
(5) In subsection (4)—
“devolved function” means a function that does not relate to reserved matters (within the meaning of the Scotland Act 1998), and
“Scottish public authority” has the same meaning as in the Scotland Act 1998.
(6) Subsections (3) and (4) do not apply to any advice or information provided under subsection (2) to the Investigatory Powers Tribunal.
233 Functions under other Parts and other enactments
(1) The Investigatory Powers Commissioner and the other Judicial Commissioners have the functions that are exercisable by them by virtue of any other Part of this Act or by virtue of any other enactment.
(2) In Part 3 of the Police Act 1997 (authorisations of action in respect of property: approval by Commissioners)—
(a) in sections 96(1), 103(7)(b) and (8), 104(3) to (8) and 105(1) and (2) for “Chief Commissioner” substitute “ Investigatory Powers Commissioner ”,
(b) in sections 96(1), 97(1)(a) and 103(1), (2), (4) and (5)(b) for “a Commissioner appointed under section 91(1)(b)” substitute “ a Judicial Commissioner ”,
(c) in sections 96(4), 97(4) and (6) and 103(3) and (6) for “a Commissioner” substitute “ a Judicial Commissioner ”,
(d) in section 103(7) for “a Commissioner” substitute “ a Judicial Commissioner (other than the Investigatory Powers Commissioner) ”,
(e) in section 104(1) for “Chief Commissioner” substitute “ Investigatory Powers Commissioner (except where the original decision was made by that Commissioner) ”,
(f) in section 104(3) and (8)(a) for “the Commissioner” substitute “ the Judicial Commissioner concerned ”,
(g) in section 105(1)(a)(ii) and (b)(ii) for “the Commissioner” substitute “ the Judicial Commissioner ”, and
(h) in sections 97(5) and 103(9) for “A Commissioner” substitute “ A Judicial Commissioner ”.
(3) In Part 2 of the Regulation of Investigatory Powers Act 2000 (surveillance and covert human intelligence sources: approval by Commissioners)—
(a) in sections 35(1) and (4), 36(2)(a) and (5) and 37(2) to (6) and (8) for “an ordinary Surveillance Commissioner”, wherever it appears, substitute “ a Judicial Commissioner ”,
(b) in sections 35(2)(b), 36(6)(g), 37(9)(b), 38(1) and (4) to (6) and 39(1), (2) and (4) and in the heading of section 39 for “Chief Surveillance Commissioner”, wherever it appears, substitute “ Investigatory Powers Commissioner ”,
(c) in sections 35(3)(a) and 36(4)(a) and (b) for “Surveillance Commissioner” substitute “ Judicial Commissioner ”,
(d) in section 37(8)(b) for “Chief Surveillance Commissioner” substitute “ Investigatory Powers Commissioner (if he is not that Commissioner) ”,
(e) in section 38(1)(a) for “an ordinary Surveillance Commissioner” substitute “ a Judicial Commissioner (other than the Investigatory Powers Commissioner) ”,
(f) in sections 38(5)(b) and 39(1)(b) for “ordinary Surveillance Commissioner” substitute “ Judicial Commissioner ”, and
(g) in the heading of section 38 for “Surveillance Commissioners” substitute “ Judicial Commissioners ”.
(4) In Part 3 of the Act of 2000 (investigation of electronic data protected by encryption etc.)—
(a) in section 51(6) (notification to Intelligence Services Commissioner or Chief Surveillance Commissioner of certain directions relating to the disclosure of a key to protected information) for the words from “done so” to the end substitute “ done so to the Investigatory Powers Commissioner ”,
(b) in section 54(9) (tipping-off: protected disclosures to a relevant Commissioner) for “relevant Commissioner” substitute “ Judicial Commissioner ”,
(c) in section 55(7) (court to have regard to opinion of a relevant Commissioner in certain circumstances relating to a disclosed key) for “relevant Commissioner” substitute “ Judicial Commissioner or the Investigatory Powers Commissioner for Northern Ireland ”, and
(d) omit sections 54(11) and 55(8) (definitions of “relevant Commissioner”).
(5) In the Regulation of Investigatory Powers (Scotland) Act 2000 (2000 asp 11) (surveillance and covert human intelligence sources: approval by Commissioners and review by the Chief Commissioner)—
(a) in sections 13(1) and (4), 14(1)(a) and (4) and 15(1) to (5) and (7) for “an ordinary Surveillance Commissioner”, wherever it appears, substitute “ a Judicial Commissioner ”,
(b) in sections 13(2)(b), 15(8)(b), 16(1) and (4) to (6) and 17 and in the heading of section 17 for “Chief Surveillance Commissioner”, wherever it appears, substitute “ Investigatory Powers Commissioner ”,
(c) in sections 13(3)(a) and 14(3)(a) and (b) for “Surveillance Commissioner” substitute “ Judicial Commissioner ”,
(d) in section 15(7)(b) for “Chief Surveillance Commissioner” substitute “ Investigatory Powers Commissioner (if the Commissioner is not that Commissioner) ”,
(e) in section 16(1)(a) for “an ordinary Surveillance Commissioner” substitute “ a Judicial Commissioner (other than the Investigatory Powers Commissioner) ”,
(f) in sections 16(5)(b) and 17(1)(b) for “ordinary Surveillance Commissioner” substitute “ Judicial Commissioner ”, and
(g) in section 16(5) for “ordinary Surveillance Commissioner's” substitute “Judicial Commissioner's”.
(6) In Part 2 of the Regulation of Investigatory Powers (Covert Human Intelligence Sources: Relevant Sources) Order 2013 (S.I. 2013/2788) (notification of certain authorisations to, and approval of certain authorisations by, ordinary Surveillance Commissioner)—
(a) in article 4(1), for “an ordinary Surveillance Commissioner” substitute “ a Judicial Commissioner ”,
(b) in article 5(8) and the heading of Part 2, for “ordinary Surveillance Commissioner” substitute “ Judicial Commissioner ”,
(c) in article 6(1) and (3) for “Chief Surveillance Commissioner” substitute “ Investigatory Powers Commissioner ”,
(d) in article 6(1) for “an ordinary Surveillance Commissioner” substitute “ a Judicial Commissioner (other than the Investigatory Powers Commissioner) ”, and
(e) in the heading of article 6 for “Surveillance Commissioners” substitute “ Judicial Commissioners ”.
(1) The Investigatory Powers Commissioner must, as soon as reasonably practicable after the end of each calendar year, make a report to the Prime Minister about the carrying out of the functions of the Judicial Commissioners.
(2) A report under subsection (1) must, in particular, include—
(a) statistics on the use of the investigatory powers which are subject to review by the Investigatory Powers Commissioner (including the number of warrants or authorisations issued, given, considered or approved during the year),
(b) information about the results of such use (including its impact),
(ba) information about the use of the power to grant or renew authorisations under section 29B of the Regulation of Investigatory Powers Act 2000,
(c) information about the operation of the safeguards conferred by this Act in relation to items subject to legal privilege, confidential journalistic material and sources of journalistic information,
(d) information about the following kinds of warrants issued, considered or approved during the year—
(i) targeted interception warrants or targeted examination warrants of the kind referred to in section 17(2),
(ii) targeted equipment interference warrants relating to matters within paragraph (b), (c), (e), (f), (g) or (h) of section 101(1), and
(iii) targeted examination warrants under Part 5 relating to matters within any of paragraphs (b) to (e) of section 101(2),
(e) information about the operational purposes specified during the year in warrants issued under Part 6 or 7,
(f) the information on errors required by virtue of section 231(8),
(g) information about the work of the Technology Advisory Panel,
(h) information about the funding, staffing and other resources of the Judicial Commissioners, and
(i) details of public engagements undertaken by the Judicial Commissioners or their staff.
(3) The Investigatory Powers Commissioner must, at any time, make any report to the Prime Minister which has been requested by the Prime Minister.
(4) The Investigatory Powers Commissioner may, at any time, make any such report to the Prime Minister, on any matter relating to the functions of the Judicial Commissioners, as the Investigatory Powers Commissioner considers appropriate.
(5) A report under subsection (1) or (4) may, in particular, include such recommendations as the Investigatory Powers Commissioner considers appropriate about any matter relating to the functions of the Judicial Commissioners.
(6) On receiving a report from the Investigatory Powers Commissioner under subsection (1), the Prime Minister must—
(a) publish the report, and
(b) lay a copy of the published report before Parliament together with a statement as to whether any part of the report has been excluded from publication under subsection (7).
(7) The Prime Minister may, after consultation with the Investigatory Powers Commissioner and (so far as the report relates to functions under Part 3 of the Police Act 1997) the Scottish Ministers, exclude from publication any part of a report under subsection (1) if, in the opinion of the Prime Minister, the publication of that part would be contrary to the public interest or prejudicial to—
(a) national security,
(b) the prevention or detection of serious crime,
(c) the economic well-being of the United Kingdom, or
(d) the continued discharge of the functions of any public authority whose activities include activities that are subject to review by the Investigatory Powers Commissioner.
(8) The Prime Minister must send a copy of every report and statement as laid before Parliament under subsection (6)(b) to the Scottish Ministers and the Scottish Ministers must lay the copy report and statement before the Scottish Parliament.
(9) The Investigatory Powers Commissioner may publish any report under subsection (3) or (4), or any part of such a report, if requested to do so by the Prime Minister.
(10) Subsection (11) applies if the Prime Minister receives a report from the Investigatory Powers Commissioner under subsection (1) or (4) which relates to an investigation, inspection or audit carried out by the Commissioner following a decision to do so of which the Intelligence and Security Committee of Parliament was informed under section 236(2).
(11) The Prime Minister must send to the Intelligence and Security Committee of Parliament a copy of the report so far as it relates to—
(a) the investigation, inspection or audit concerned, and
(b) the functions of the Committee falling within section 2 of the Justice and Security Act 2013.
(1) A Judicial Commissioner may carry out such investigations, inspections and audits as the Commissioner considers appropriate for the purposes of the Commissioner's functions.
(2) Every relevant person must disclose or provide to a Judicial Commissioner all such documents and information as the Commissioner may require for the purposes of the Commissioner's functions.
(3) Every relevant person must provide a Judicial Commissioner with such assistance as the Commissioner may require in carrying out any investigation, inspection or audit for the purposes of the Commissioner's functions.
(4) Assistance under subsection (3) may, in particular, include such access to apparatus, systems or other facilities or services as the Judicial Commissioner concerned may require in carrying out any investigation, inspection or audit for the purposes of the Commissioner's functions.
(5) A public authority may report to the Investigatory Powers Commissioner any refusal by a telecommunications operator or postal operator to comply with any requirements imposed by virtue of this Act.
(6) A public authority, telecommunications operator or postal operator must report to the Investigatory Powers Commissioner any relevant error (within the meaning given by section 231(9)) of which it is aware.
(7) In this section “relevant person” means—
(a) any person who holds, or has held, an office, rank or position with a public authority,
(b) any telecommunications operator or postal operator who is, has been or may become subject to a requirement imposed by virtue of this Act,
(c) any person who is, has been or may become subject to a requirement to provide assistance by virtue of section 41, 43, 126, 128, 149, 168, 170 or 190, or
(d) any person to whom a notice is given under section 49 of the Regulation of Investigatory Powers Act 2000.
(1) This section applies where a telecommunications operator would, but for a relevant restriction, be required by regulation 5A(2) of the 2003 Regulations to notify a personal data breach to the Information Commission.
(2) The telecommunications operator must report the personal data breach to the Investigatory Powers Commissioner.
(3) Where a telecommunications operator reports a personal data breach to the Investigatory Powers Commissioner under subsection (2), a Judicial Commissioner must disclose information about the breach to the Information Commission.
(4) Where a Judicial Commissioner discloses information about a personal data breach to the Information Commission under subsection (3), the Information Commission must—
(a) consider whether the breach is serious, and
(b) if the Information Commission considers that the breach is serious, notify the Investigatory Powers Commissioner.
(5) The Investigatory Powers Commissioner must inform an individual of any personal data breach relating to that individual of which the Commissioner is notified under subsection (4)(b) if the Commissioner considers that it is in the public interest for the individual to be informed of the breach.
(6) In making a decision under subsection (5), the Investigatory Powers Commissioner must, in particular, consider—
(a) the seriousness of the breach and its effect on the individual concerned, and
(b) the extent to which disclosing the breach would be contrary to the public interest or prejudicial to—
(i) national security,
(ii) the prevention or detection of serious crime,
(iii) the economic well-being of the United Kingdom, or
(iv) the continued discharge of the functions of any of the intelligence services.
(7) Before making a decision under subsection (5), the Investigatory Powers Commissioner must ask—
(a) the Secretary of State, and
(b) any public authority that the Investigatory Powers Commissioner considers appropriate,
to make submissions to the Commissioner about the matters concerned.
(8) When informing an individual under subsection (5) of a breach, the Investigatory Powers Commissioner must—
(a) inform the individual of any rights that the individual may have to apply to the Investigatory Powers Tribunal in relation to the breach, and
(b) provide such details of the breach as the Commissioner considers to be necessary for the exercise of those rights, having regard in particular to the extent to which disclosing the details would be contrary to the public interest or prejudicial to anything falling within subsection (6)(b)(i) to (iv).
(9) The Investigatory Powers Commissioner may not inform the individual to whom it relates of a personal data breach notified to the Commissioner under subsection (4)(b) except as provided by this section.
(10) For the purposes of this section, a personal data breach is serious if the breach is likely to result in a high risk to the rights and freedoms of individuals.
(11) In this section—
“2003 Regulations” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426);
“personal data breach” has the same meaning as in the 2003 Regulations (see regulation 2(1) of those Regulations);
“relevant restriction” means any of the following—
section 57(1) (duty not to make unauthorised disclosures) (including as applied by section 156);
section 132(1) (duty not to make unauthorised disclosures) (including as applied by section 197);
section 174(1) (offence of making unauthorised disclosure),
(read with regulation 29(1)(a)(i) of the 2003 Regulations).
236 Referrals by the Intelligence and Security Committee of Parliament
(1) Subsection (2) applies if the Intelligence and Security Committee of Parliament refers a matter to the Investigatory Powers Commissioner with a view to the Commissioner carrying out an investigation, inspection or audit into it.
(2) The Investigatory Powers Commissioner must inform the Intelligence and Security Committee of Parliament of the Commissioner's decision as to whether to carry out the investigation, inspection or audit.
(1) A disclosure of information to the Investigatory Powers Commissioner or another Judicial Commissioner for the purposes of any function of the Commissioner does not breach—
(a) an obligation of confidence owed by the person making the disclosure, or
(b) any other restriction on the disclosure of information (whether imposed by virtue of this Act or otherwise).
(2) But subsection (1) does not apply to a disclosure, in contravention of any provisions of the data protection legislation, of personal data which is not exempt from those provisions.
(3) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).
(1) There is to be paid to the Judicial Commissioners out of money provided by Parliament such remuneration and allowances as the Treasury may determine.
(2) The Secretary of State must, after consultation with the Investigatory Powers Commissioner and subject to the approval of the Treasury as to numbers of staff, provide the Judicial Commissioners with—
(a) such staff, and
(b) such accommodation, equipment and other facilities and services,
as the Secretary of State considers necessary for the carrying out of the Commissioners' functions.
(3) The Scottish Ministers may pay to the Judicial Commissioners such allowances as the Scottish Ministers consider appropriate in respect of the exercise by the Commissioners of functions which relate to the exercise by Scottish public authorities of devolved functions.
(4) In subsection (3)—
“devolved function” means a function that does not relate to reserved matters (within the meaning of the Scotland Act 1998), and
“Scottish public authority” has the same meaning as in the Scotland Act 1998.
(5) The Investigatory Powers Commissioner or any other Judicial Commissioner may, to such extent as the Commissioner concerned may decide, delegate the exercise of functions of that Commissioner to any member of staff of the Judicial Commissioners or any other person acting on behalf of the Commissioners.
(6) Subsection (5) does not apply to—
(a) the function of the Investigatory Powers Commissioner of making a recommendation under section 227(4)(e) or making an appointment under section 227(6A), 228A(2) or 247(1),
(b) any function which falls within section 229(8), or
(c) any function under section 58(4) or 133(3) of authorising a disclosure,
but, subject to this and the terms of the delegation, does include functions which have been delegated to a Judicial Commissioner by the Investigatory Powers Commissioner.
(7) The delegation under subsection (5) to any extent of functions by the Investigatory Powers Commissioner or any other Judicial Commissioner does not prevent the exercise of the functions to that extent by the Commissioner concerned.
(1) The Secretary of State may by regulations modify the functions of the Investigatory Powers Commissioner or any other Judicial Commissioner.
(2) But such regulations may not modify any function conferred by virtue of this Act on a Judicial Commissioner to approve, quash or cancel—
(a) an authorisation or warrant, or
(b) the variation or renewal of an authorisation or warrant.
(3) The power to make regulations under this section (including that power as extended by section 267(1)(c)) may, in particular, be exercised by modifying any provision made by or under an enactment (including this Act).