Communications Data (CD)
Section 11 of the IPA 2016 created an offence of obtaining CD without lawful authority. There was no definition, in the original Act, of "lawful authority" in respect of CD acquisition. The objective of amending section 11 has been to make clear that certain types of authority or methods of acquiring CD will amount to "lawful authority". This includes applications to request CD in line with Part 3 IPA 2016, or through a judicial authorisation or Court Order as well as those included ina non-exhaustive list detailing circumstances which will amount to lawful authority for the purposes of section 11.
	The Act provides examples of authorisations that will amount to "lawful authority" and includes an IPA 2016 authorisation, a Court order or other statutory power to require or provide CD, as well as CD relating to Public Emergency call services (codes of practice paragraph 6.1) and publicly available data with the intention of providing the legal certainty for those bodies who acquire CD and wish to avoid committing the section 11 offence.
	The purpose of section 11 was also to discourage public authorities from abusing Part 3 powers to acquire CD from private companies. The explanatory note to section 11 says: ‘The offence is intended to act as a deterrent and provide reassurance that abuse of powers to acquire communications data will be punished’.
	The "powers" in question are the power to issue a notice to a TO to compel disclosure of CD. The obligation to comply with a notice does not bind the Crown so this power logically cannot have been aimed at public sector sharing of CD. Section 11 was not intended to catch public sector sharing of data and the Data Protection Act provides sufficient safeguards to protect the sharing of CD between public sector organisations where it is necessary and proportionate to do so. The offence will continue to apply to the acquisition of CD from private sector TOs. The IPC will continue to oversee the acquisition of CD by relevant public authorities from TOs in both the public and private sectors.
	The purpose of section 12 IPA 2016 was to provide transparency around public authority access to CD, in effect ensuring that the Act was the only route available in relation to the ‘statutory purposes’ at section 61(7).
	Section 12 and Schedule 2 IPA 2016 amended general information gathering powers, so far as they enabled public authorities to secure the disclosure, by a TO, of CD without the consent of the operator; where the disclosure did not involve a court order or other judicial authorisation or warrant, was not a regulatory power, and where it was not possible for the public authority to use a power under the IPA 2016 or the RIPA 2000.
	Regulatory powers were in turn limited, in section 12(6), to those solely exercisable in connection with the regulation of telecommunications operators, services or systems and postal operators and services.
	The statutory purposes at section 60A(7) state that it must be necessary to obtain the data-
"(a) in the interests of national security,
(b) for the applicable crime purpose,
(c) in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security,
(d) in the interests of public safety,
(e) for the purpose of preventing death or injury or any damage to a person’s physical or mental health, or of mitigating any injury or damage to a person’s physical or mental health,
(f) to assist investigations into alleged miscarriages of justice, or
(g) where a person ("P") has died or is unable to identify themselves because of a physical or mental condition-
to assist in identifying P, or
to obtain information about P’s next of kin or other persons connected with P or about the reasons for P’s death or condition."
	The statutory purposes had originally included "for the purpose of assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department" and, secondly, "for the purpose of exercising functions relating to the regulation of financial services and markets or financial stability". These lawful purposes were however subsequently excluded by the Data Retention and Acquisition Regulations 2018 enacted in response to the Court of Justice of the European Union’s (CJEU) Tele2/Watson Judgment. 5
	These specific provisions were not routinely used because bodies with regulatory or supervisory functions, such as those who regulate the Financial Markets or ensure compliance with Money Laundering and Terrorist Financing Regulations, were previously able to acquire the data they needed in pursuance of their functions by using their own information gathering powers already available to them rather than the IPA 2016 provisioned powers.
	However, as businesses are increasingly moving their service offerings online, more of the data those business collect about their customers now falls within the definition of Communications Data as it relates to the provision of a Telecommunications Service as defined in the IPA 2016. This data was data which regulatory and supervisory bodies would have previously been able to access using their own information gathering powers, but in respect of which those businesses are now seeking IPA 2016 Part 3 authorisations, from public authorities, before agreeing to disclosure.
	The Section 12 provisions had the effect of preventing those regulatory or supervisory organisations from gathering the data they require where their enquiries failed to meet the serious crime threshold, which was the main remaining statutory purpose available to them to access some types of required data.
	The purpose of the Section 12 reforms in this Act are to allow bodies with recognised regulatory and supervisory functions, and who utilise civil proceedings as a means of enforcement, to continue to perform the roles required of them by Parliament in permitting them to acquire CD using their own information gathering powers as previously was the case.
	These reforms do not diminish nor expand upon the existing statutory requirements for the disclosure of CD. The position remains that an IPA 2016 authorisation is required to obtain the disclosure of CD in the course of any criminal investigation where there is a view to initiating a criminal prosecution.
	Provisions in the associated Codes of Practice will require any organisation changing their approach from a civil investigation to a criminal investigation (with a view to a criminal prosecution) to satisfy both themselves and the IPCO, that their application of the legislation is right and proper at all times. This is an area that is already subject to oversight and scrutiny and these measures aim to ensure that this reform cannot be used to circumvent the safeguards in place within the IPA 2016.
	Section 261 IPA 2016 includes the definition of CD. When the IPA 2016 was enacted, section 21 of RIPA 2000 was replaced, and the definition of CD changed. Under section 261(3) "subscriber" or "account data" were brought within a new category of CD referred to as "Entity" data. Section 261(6) of the IPA 2016 created a new definition of what the "content" of a communication is to ensure a clear distinction between "content" and CD on the basis of Parliamentary concern in relation to privacy, by providing that anything that was "content" could not be CD. However, the section 261(6) "content" carve-out created uncertainty as to whether ‘subscriber data’ or ‘account data’ is CD or whether it might be the "content" of a communication created by the subscriber or account information, when they complete an online application form, for example. A practical example is provided below:
Your name may be included in an electronic form when you open an online account and when clicking ‘submit’, it is sent to that company’s servers. The "content" of that communication could be argued to be the information entered in the form which includes ‘subscriber’ communications data information.
	The amendment provides additional clarity that subscriber data and account data fall within the scope of CD, rather than potentially being within the meaning of "content" under section 261(6) of the IPA. The change aims to achieve clarity because public authorities, the independent oversight body (IPCO) and the TOs carry a risk of having to record or report the acquisition of subscriber or account data as an error (because some TOs might consider it as content and so not disclosable under a part 3 CD authorisation). These provisions, providing clarification of subscriber or account data as CD, aim to reduce the risk of errors and provide greater legal certainty.