Emergency UK data retention laws come into force

Posted: 23/07/2014

The UK Government has pushed through emergency surveillance legislation utilising a fast-track procedure, despite opposition from a number of politicians and campaign groups. The Data Retention and Investigatory Powers Act 2014 (DRIP) received Royal Assent on 17 July, after having been published on 10 July and introduced to Parliament on 14 July. 

Background

The Government decided to fast-track the legislation due to concerns that communications service providers (CSPs), such as fixed line and mobile telephone network operators and internet service providers, would start deleting communications data that they are obliged to retain under the Data Retention Regulations 2009 (2009 Regulations). This follows a ruling of the Court of Justice of the European Union (CJEU) in April 2014, in which the CJEU held that the Data Retention Directive 2006 (implemented in the UK by the 2009 Regulations), was unlawful and invalid on the basis that it was a disproportionate interference with the fundamental rights of individuals to a private life and to protection of their personal data.  Although the 2009 Regulations remained on the statute book, their lawfulness was called into question by the CJEU ruling.

Under the 2009 Regulations, CSPs were obliged to retain communications data for a period of 12 months.  Communications data is the 'metadata' of a telephone call, e-mail or internet access session, rather than the content of the communication itself, and includes data such as the identity of the individual initiating a communication, the identity of the recipient (eg number dialled), start and end times of calls and internet sessions and geographic location by reference to cell ID.  Retained data can be accessed for limited purposes by permitted law enforcement bodies under the Regulation of Investigatory Powers Act 2000 (RIPA), which also sets out the regime for the interception of the content of communications by law enforcement agencies.

Since the CJEU ruling, civil liberties and privacy campaigners have been lobbying CSPs to delete retained data and the Government decided to push through replacement legislation on an emergency basis to ensure that data retention obligations were maintained, and law enforcement and intelligence capabilities protected.

Content of the Act

DRIP is split into two key parts.  The first part, when read alongside the accompanying Data Retention Regulations 2014 (Regulations), repeals the 2009 Regulations and replaces the data retention obligations that were included in them.  The second part of the Act clarifies elements of RIPA in relation to obtaining communications data and warrants for the interception of communications. 

Data retention 

The Government takes the view that many of the concerns raised by the CJEU in relation to the Data Retention Directive were already met by existing safeguards within the UK’s data retention and access regime.  However, additional safeguards have been included in DRIP and the Regulations.  For example, the retention period may be shorter than 12 months, rather than the fixed period of 12 months under the 2009 Regulations.  In addition, retention notices may only be served on CSPs where the Secretary of State considers that the requirement is 'necessary and proportionate' for one of the specified purposes in RIPA for which communications data may be obtained.  DRIP provides for the production of a code of practice relating to the exercise of the data retention regime. The Regulations also contain a number of additional safeguards, such as factors to be considered by the Secretary of State before issuing retention notices and consultation requirements with CSPs. 

The scope of communications data to be retained by CSPs remains unchanged from the 2009 Regulations. Retention notices issued under the 2009 Regulations continue to apply until 1 January 2015, when they will presumably be reissued, subject to the additional considerations imposed on the Secretary of State under the  Regulations and to the 'sunset clause' (see below).

Investigatory powers

The second part of DRIP clarifies that RIPA, which governs access to the retained communications data and to the content of communications, has extra-territorial effect.  RIPA did not explicitly state that CSPs which are based outside the UK, but are providing communication services to consumers in the UK, were subject to RIPA, and a number of overseas CSPs have argued that notices or warrants issued under RIPA do not apply to them.  The relevant provisions of DRIP put this beyond doubt, although the Government argues that RIPA has always had implicit extra-territorial effect. 

DRIP also clarifies that, for the purposes of RIPA, 'telecommunications service' includes internet-based services such as webmail, to avoid doubts regarding the scope of communications technologies covered.  It also confirms that interception warrants issued in the interests of the 'economic wellbeing' of the UK, must also be able to demonstrate relevance to national security, clarifying on the face of the legislation a requirement that was already included in a RIPA code of practice.

Opposition to the Act 

The fast-tracking of DRIP proved controversial and led to accusations that the Government was failing to respect democracy or Parliamentary process.  Particular criticisms included that the Government had known about the issue since the CJEU ruling in April and therefore there was no need to force the legislation through in the week before the summer recess.  The process was also challenged on the basis that DRIP not only replaces the data retention provisions made unlawful by the CJEU ruling, but also includes additional provisions extending the territorial effect of RIPA and the scope of communications services covered by RIPA.

In response to challenges raised during the fast-track procedure, new sections 6 and 7 were introduced into DRIP, which will oblige the Interception of Communications Commissioner to produce six monthly, rather than annual, reports on his oversight of the regime, and also require that the independent reviewer appointed under the Terrorism Act 2006 conduct an overall review of the operation and regulation of investigatory powers by 1 May 2015, and that his report be placed before Parliament.

The Act also includes a 'sunset clause' providing that DRIP will be repealed on 31 December 2016.  This will give Parliament an opportunity to debate and consider replacement legislation in the short term.  The Government has acknowledged that DRIP is merely a stopgap, and that there remains a pressing need to update existing legislation to ensure that its scope keeps pace with new types of telephony and internet communication.

Unfortunately for the Government, the media coverage may not fall away now that DRIP has become law. At least two separate legal actions for judicial review have been announced by campaign groups Liberty and the Open Rights Group.

Return to news headlines