Investigatory Powers Act 2016 (c. 25)

Part 7 U.K. Bulk personal dataset warrants

Issue of warrants U.K.

204 Class BPD warrants U.K.

(1) The head of an intelligence service, or a person acting on his or her behalf, may apply to the Secretary of State for a class BPD warrant.

(2) The application must include—

(a) a description of the class of bulk personal datasets to which the application relates, and

(b) in a case where the intelligence service is seeking authorisation for the examination of bulk personal datasets of that class, the operational purposes which it is proposing should be specified in the warrant (see section 212).

(3) The Secretary of State may issue the warrant if—

(a) the Secretary of State considers that the warrant is necessary—

(i) in the interests of national security,

(ii) for the purposes of preventing or detecting serious crime, or

(iii) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,

(b) the Secretary of State considers that the conduct authorised by the warrant is proportionate to what is sought to be achieved by the conduct,

(c) where the warrant authorises the examination of bulk personal datasets of the class described in the warrant, the Secretary of State considers that—

(i) each of the specified operational purposes (see section 212) is a purpose for which the examination of bulk personal datasets of that class is or may be necessary, and

(ii) the examination of bulk personal datasets of that class for each such purpose is necessary on any of the grounds on which the Secretary of State considers the warrant to be necessary,

(d) the Secretary of State considers that the arrangements made by the intelligence service for storing bulk personal datasets of the class to which the application relates and for protecting them from unauthorised disclosure are satisfactory, and

(e) the decision to issue the warrant has been approved by a Judicial Commissioner.

(4) The fact that a class BPD warrant would authorise the retention, or the retention and examination, of bulk personal datasets relating to activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary on grounds falling within subsection (3)(a).

(5) An application for a class BPD warrant may only be made on behalf of the head of an intelligence service by a person holding office under the Crown.

Commencement Information

I1 S. 204 in force at 25.7.2018 for specified purposes by S.I. 2018/873, reg. 2(m) (with reg. 6(b))

I2 S. 204 in force at 22.8.2018 by S.I. 2018/873, reg. 3(c)

205 Specific BPD warrants U.K.

(1) The head of an intelligence service, or a person acting on his or her behalf, may apply to the Secretary of State for a specific BPD warrant in the following cases.

(2) Case 1 is where—

(a) the intelligence service is seeking authorisation to retain, or to retain and examine, a bulk personal dataset, and

(b) the bulk personal dataset does not fall within a class described in a class BPD warrant.

(3) Case 2 is where—

(a) the intelligence service is seeking authorisation to retain, or to retain and examine, a bulk personal dataset, and

(b) the bulk personal dataset falls within a class described in a class BPD warrant but either—

(i) the intelligence service is prevented by section 202(1), (2) or (3) from retaining, or retaining and examining, the bulk personal dataset in reliance on the class BPD warrant, or

(ii) the intelligence service at any time considers that it would be appropriate to seek a specific BPD warrant.

(4) The application must include—

(a) a description of the bulk personal dataset to which the application relates, and

(b) in a case where the intelligence service is seeking authorisation for the examination of the bulk personal dataset, the operational purposes which it is proposing should be specified in the warrant (see section 212).

(5) Where subsection (3)(b)(i) applies, the application must include an explanation of why the intelligence service is prevented by section 202(1), (2) or (3) from retaining, or retaining and examining, the bulk personal dataset in reliance on a class BPD warrant.

(6) The Secretary of State may issue the warrant if—

(a) the Secretary of State considers that the warrant is necessary—

(i) in the interests of national security,

(ii) for the purposes of preventing or detecting serious crime, or

(iii) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,

(b) the Secretary of State considers that the conduct authorised by the warrant is proportionate to what is sought to be achieved by the conduct,

(c) where the warrant authorises the examination of a bulk personal dataset, the Secretary of State considers that—

(i) each of the specified operational purposes (see section 212) is a purpose for which the examination of the bulk personal dataset is or may be necessary, and

(ii) the examination of the bulk personal dataset for each such purpose is necessary on any of the grounds on which the Secretary of State considers the warrant to be necessary,

(d) the Secretary of State considers that the arrangements made by the intelligence service for storing the bulk personal dataset and for protecting it from unauthorised disclosure are satisfactory, and

(e) except where the Secretary of State considers that there is an urgent need to issue the warrant, the decision to issue it has been approved by a Judicial Commissioner.

(7) The fact that a specific BPD warrant would authorise the retention, or the retention and examination, of bulk personal datasets relating to activities in the British Islands of a trade union is not, of itself, sufficient to establish that the warrant is necessary on grounds falling within subsection (6)(a).

(8) A specific BPD warrant relating to a bulk personal dataset (“dataset A”) may also authorise the retention or examination of other bulk personal datasets (“replacement datasets”) that do not exist at the time of the issue of the warrant but may reasonably be regarded as replacements for dataset A.

(9) An application for a specific BPD warrant may only be made on behalf of the head of an intelligence service by a person holding office under the Crown.

Commencement Information

I3 S. 205 in force at 25.7.2018 for specified purposes by S.I. 2018/873, reg. 2(n) (with reg. 6(c))

I4 S. 205 in force at 22.8.2018 by S.I. 2018/873, reg. 3(c)

206 Additional safeguards for health records U.K.

(1) Subsections (2) and (3) apply if—

(a) an application is made by or on behalf of the head of an intelligence service for the issue of a specific BPD warrant, and

(b) the purpose, or one of the purposes, of the warrant is to authorise the retention, or the retention and examination, of health records.

(2) The application must contain a statement that the purpose, or one of the purposes, of the warrant is to authorise the retention, or the retention and examination, of health records.

(3) The Secretary of State may issue the warrant only if the Secretary of State considers that there are exceptional and compelling circumstances that make it necessary to authorise the retention, or the retention and examination, of health records.

(4) Subsection (5) applies if—

(a) an application is made by or on behalf of the head of an intelligence service for a specific BPD warrant,

(b) the head of the intelligence service considers that the bulk personal dataset includes, or is likely to include, health records, and

(c) subsections (2) and (3) do not apply.

(5) The application must contain either—

(a) a statement that the head of the intelligence service considers that the bulk personal dataset includes health records, or

(b) a statement that the head of the intelligence service considers that it is likely that the bulk personal dataset includes health records and an assessment of how likely this is.

(6) In this section, “health record” means a record, or a copy of a record, which—

(a) consists of information relating to the physical or mental health or condition of an individual,

(b) was made by or on behalf of a health professional in connection with the care of that individual, and

(c) was obtained by the intelligence service from a health professional or a health service body or from a person acting on behalf of a health professional or a health service body in relation to the record or the copy.

[F1 (7) In subsection (6)—

• “health professional” has the same meaning as in the Data Protection Act 2018 (see section 204(1) of that Act);

• “health service body” has meaning given by section 204(4) of that Act.]

Textual Amendments

F1 S. 206(7) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 202 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)

Commencement Information

I5 S. 206 in force at 25.7.2018 by S.I. 2018/873, reg. 2(o)

207 Protected data: power to impose conditions U.K.

Where the Secretary of State decides to issue a specific BPD warrant, the Secretary of State may impose conditions which must be satisfied before protected data retained in reliance on the warrant may be selected for examination on the basis of criteria which are referable to an individual known to be in the British Islands at the time of the selection.

Commencement Information

I6 S. 207 in force at 25.7.2018 by S.I. 2018/873, reg. 2(p)

208 Approval of warrants by Judicial Commissioners U.K.

(1) In deciding whether to approve a decision to issue a class BPD warrant or a specific BPD warrant, a Judicial Commissioner must review the Secretary of State's conclusions as to the following matters—

(a) whether the warrant is necessary on grounds falling within section 204(3)(a) or (as the case may be) section 205(6)(a),

(b) whether the conduct that would be authorised by the warrant is proportionate to what is sought to be achieved by that conduct, and

(c) where the warrant authorises examination of bulk personal datasets of a class described in the warrant or (as the case may be) of a bulk personal dataset described in the warrant, whether—

(i) each of the specified operational purposes (see section 212) is a purpose for which the examination of bulk personal datasets of that class or (as the case may be) the bulk personal dataset is or may be necessary, and

(ii) the examination of bulk personal datasets of that class or (as the case may be) the bulk personal dataset is necessary as mentioned in section 204(3)(c)(ii) or (as the case may be) section 205(6)(c)(ii).

(2) In doing so, the Judicial Commissioner must—

(a) apply the same principles as would be applied by a court on an application for judicial review, and

(b) consider the matters referred to in subsection (1) with a sufficient degree of care as to ensure that the Judicial Commissioner complies with the duties imposed by section 2 (general duties in relation to privacy).

(3) Where a Judicial Commissioner refuses to approve a decision to issue a class BPD warrant or a specific BPD warrant, the Judicial Commissioner must give the Secretary of State written reasons for the refusal.

(4) Where a Judicial Commissioner, other than the Investigatory Powers Commissioner, refuses to approve a decision to issue a class BPD warrant or a specific BPD warrant, the Secretary of State may ask the Investigatory Powers Commissioner to decide whether to approve the decision to issue the warrant.

Commencement Information

I7 S. 208 in force at 25.7.2018 by S.I. 2018/873, reg. 2(q)

209 Approval of specific BPD warrants issued in urgent cases U.K.

(1) This section applies where—

(a) a specific BPD warrant is issued without the approval of a Judicial Commissioner, and

(b) the Secretary of State considered that there was an urgent need to issue it.

(2) The Secretary of State must inform a Judicial Commissioner that it has been issued.

(3) The Judicial Commissioner must, before the end of the relevant period—

(a) decide whether to approve the decision to issue the warrant, and

(b) notify the Secretary of State of the Judicial Commissioner's decision.

“The relevant period” means the period ending with the [F2 third] [F2 ninth] working day after the day on which the warrant was issued.

(4) If a Judicial Commissioner refuses to approve the decision to issue a specific BPD warrant, the warrant—

(a) ceases to have effect (unless already cancelled), and

(b) may not be renewed,

and section 208(4) does not apply in relation to the refusal to approve the decision.

(5) Section 210 contains further provision about what happens if a Judicial Commissioner refuses to approve a decision to issue a warrant.

Textual Amendments

F2 Word in s. 209(3) substituted (temp.) (27.3.2020) by virtue of The Investigatory Powers (Temporary Judicial Commissioners and Modification of Time Limits) Regulations 2020 (S.I. 2020/360), regs. 1(2), 4(a) (with reg. 5)

Commencement Information

I8 S. 209 in force at 22.8.2018 by S.I. 2018/873, reg. 3(c)

210 Failure to approve specific BPD warrant issued in urgent case U.K.

(1) This section applies where under section 209(3) a Judicial Commissioner refuses to approve the decision to issue a warrant.

(2) The head of the intelligence service to whom the warrant was addressed must, so far as is reasonably practicable, secure that anything in the process of being done in reliance on the warrant stops as soon as possible.

(3) The Judicial Commissioner may—

(a) direct that the whole or part of a bulk personal dataset retained in reliance on the warrant is destroyed;

(b) impose conditions as to the use or retention of the whole or part of any such bulk personal dataset.

(4) The Judicial Commissioner—

(a) may require an affected party to make representations about how the Judicial Commissioner should exercise any function under subsection (3), and

(b) must have regard to any such representations made by an affected party (whether or not as a result of a requirement imposed under paragraph (a)).

(5) Each of the following is an “affected party” for the purposes of subsection (4)—

(a) the Secretary of State;

(b) the head of the intelligence service to whom the warrant was addressed.

(6) The Secretary of State may ask the Investigatory Powers Commissioner to review a decision made by any other Judicial Commissioner under subsection (3).

(7) On a review under subsection (6), the Investigatory Powers Commissioner may—

(a) confirm the Judicial Commissioner's decision, or

(b) make a fresh determination.

(8) An intelligence service is not to be regarded as in breach of section 200(1) or (2) where it retains or (as the case may be) examines a bulk personal dataset in accordance with conditions imposed under subsection (3)(b).

(9) Nothing in this section or section 209 affects the lawfulness of—

(a) anything done in reliance on the warrant before it ceases to have effect;

(b) if anything is in the process of being done in reliance on the warrant when it ceases to have effect—

(i) anything done before that thing could be stopped, or

(ii) anything done that it is not reasonably practicable to stop.

Commencement Information

I9 S. 210 in force at 22.8.2018 by S.I. 2018/873, reg. 3(c)

211 Decisions to issue warrants to be taken personally by Secretary of State U.K.

(1) The decision to issue a class BPD warrant or a specific BPD warrant must be taken personally by the Secretary of State.

(2) Before a class BPD warrant is issued, it must be signed by the Secretary of State.

(3) Before a specific BPD warrant is issued, it must be signed by the Secretary of State (subject to subsection (4)).

(4) If it is not reasonably practicable for a specific BPD warrant to be signed by the Secretary of State, it may be signed by a senior official designated by the Secretary of State for that purpose.

(5) In such a case, the warrant must contain a statement that—

(a) it is not reasonably practicable for the warrant to be signed by the Secretary of State, and

(b) the Secretary of State has personally and expressly authorised the issue of the warrant.

Commencement Information

I10 S. 211 in force at 25.7.2018 by S.I. 2018/873, reg. 2(r)

212 Requirements that must be met by warrants U.K.

(1) A class BPD warrant or a specific BPD warrant must contain a provision stating whether it is a class BPD warrant or (as the case may be) a specific BPD warrant.

(2) A class BPD warrant or a specific BPD warrant must be addressed to the head of the intelligence service by whom, or on whose behalf, the application for the warrant was made.

(3) A class BPD warrant must—

(a) include a description of the class of bulk personal datasets to which the warrant relates, and

(b) where the warrant authorises examination of bulk personal datasets of that class, specify the operational purposes for which data contained in bulk personal datasets of that class may be selected for examination.

(4) A specific BPD warrant must—

(a) describe the bulk personal dataset to which the warrant relates,

(b) where the warrant authorises the retention or examination of replacement datasets, include a description that will enable those datasets to be identified,

(c) where the warrant authorises the examination of the bulk personal dataset or replacement datasets, specify the operational purposes for which data contained in the bulk personal dataset and any replacement datasets may be selected for examination, and

(d) where the Secretary of State has imposed conditions under section 207, specify those conditions.

(5) The operational purposes specified in a class BPD warrant or a specific BPD warrant must be ones specified, in a list maintained by the heads of the intelligence services (“the list of operational purposes”), as purposes which they consider are operational purposes for which data contained in bulk personal datasets retained in reliance on class BPD warrants or specific BPD warrants may be selected for examination.

(6) A class BPD warrant or a specific BPD warrant may, in particular, specify all of the operational purposes which, at the time the warrant is issued, are specified in the list of operational purposes.

(7) An operational purpose may be specified in the list of operational purposes only with the approval of the Secretary of State.

(8) The Secretary of State may give such approval only if satisfied that the operational purpose is specified in a greater level of detail than the descriptions contained in section 204(3)(a) or (as the case may be) section 205(6)(a).

(9) At the end of each relevant three-month period, the Secretary of State must give a copy of the list of operational purposes to the Intelligence and Security Committee of Parliament.

(10) In subsection (9), “relevant three-month period” means—

(a) the period of three months beginning with the day on which this section comes into force, and

(b) each successive period of three months.

(11) The Prime Minister must review the list of operational purposes at least once a year.

(12) In this Part, “the specified operational purposes”, in relation to a class BPD warrant or a specific BPD warrant, means the operational purposes specified in the warrant in accordance with this section.

Commencement Information

I11 S. 212 in force at 25.7.2018 by S.I. 2018/873, reg. 2(s)