Part 1: Bulk Personal Datasets Third party bulk personal datasets New section 226IB of the IPA 2016: Additional safeguards for items subject to legal privilege: examination
This section is concerned with safeguards for "protected data" that is legally privileged. It makes provision for the approval of "relevant criteria" to be used for the examination of data. The expression "protected data" is defined in section 203 in Part 7 of the IPA 2016: in broad terms, protected data is likely to be content as opposed to metadata.
	Subsections (2) to (8) set out a regime for the approval of the use of criteria where either a purpose of using the criteria is to identify items subject to legal privilege, or the use of the criteria is likely to do so.
	Where the criteria are referrable to an individual known to be in the British Islands, the approval of the Secretary of State is required and, per subsection (4), this approval must also be approved by a JC. When deciding whether to give approval the JC must apply the same principles as a court on application for judicial review and consider with a degree of care to ensure the JC complies with duties imposed by section 2.
	In all other cases, the approval may be given internally by a senior official. The senior official’s approval does not need to be approved by a JC.
	Where the purpose of the examination is to identify items subject to legal privilege (as opposed to only being likely to do so), the decision maker is required to balance the need to use the relevant criteria against the public interest in the confidentiality of items subject to legal privilege. Use of the criteria may only be authorised if there are exceptional and compelling circumstances that make it necessary to do so.
	The "exceptional and compelling" test is further explained in subsection (7) which provides that there cannot be exceptional and compelling circumstances unless (a) public interest in obtaining the information outweighs public interest in confidentiality of items subject to legal privilege, (b) there are no other means to reasonably obtain the data, and (c) obtaining the information is necessary in the interests of national security or for the purpose of preventing death or significant injury.
	Subsections (9) to (13) set out a regime for the approval of the use of criteria where a purpose of the using the criteria is to examine data (or underlying material i.e. other data from which that data was derived – see subsection (13)) that would be legally privileged but where the intelligence services considers it likely that it was created or held with the intention of furthering a criminal purpose (often called the iniquity exception to legal privilege).
	Where the criteria are referrable to an individual known to be in the British Islands, the approval of the Secretary of State is required – this approval does not need to be approved by a JC (see subsection (10)).
	In all other cases, the approval may be given internally by a senior official. The senior official’s approval does not need to be approved by a JC (see subsection (11)).
	Approval may be given only if the decision maker considers that the targeted data or the underlying material is likely to have been created or to be held with the intention of furthering a criminal purpose.