Part 2: Oversight Arrangements Section 11: Personal data breaches
Section 11(1) inserts a provision into the Investigatory Powers Act (s.235A) for the Investigatory Powers Commissioner to notify affected individuals of serious personal data breaches relating to warrants issued under the IPA 2016, if the IPC determines it is in the public interest to make such a notification.
	Subsection (1) sets out the circumstances in which the provision applies, namely where a Telecommunications Operator is prevented from reporting a personal data breach to the Information Commissioner due to a relevant restriction.
	Subsection (2) sets out that a Telecommunications Operator must report such a personal data breach to the Investigatory Powers Commissioner.
	Subsection (3) confirms that where a Telecommunications Operator has reported a personal data breach to the Investigatory Powers Commissioner, a Judicial Commissioner must then disclose information about the breach to the Information Commissioner. This will ensure that the Information Commissioner can appropriately investigate such a breach.
	Subsection (4) sets out that where a Judicial Commissioner discloses information about a personal data breach to the Information Commissioner, the Information Commissioner must consider whether the breach is serious and if such a consideration is made, the Information Commissioner must notify the Investigatory Powers Commissioner.
	Subsection (5) confirms that the Investigatory Powers Commissioner must inform an individual of any personal data breach relating to that individual of which the Commissioner is notified by the Information Commissioner, if the Commissioner considers that it is in the public interest for the individual to be informed of the breach.
	Subsection (6) sets out the factors the Investigatory Powers Commissioner must consider in deciding whether it is in the public interest to notify an individual who has been affected by a personal data breach.
	Subsection (7) confirms that the Investigatory Powers Commissioner must ask the Secretary of State and any public authority the Commissioner considers appropriate for submissions before making a decision regarding the public interest in notifying the affected individual of a breach.
	Subsection (8) sets out the information the Investigatory Powers Commissioner must provide when notifying an individual who has been affected by a personal data breach of the breach.
	Subsection (9) provides that the Investigatory Powers Commissioner may not inform an individual who has been affected by a personal data breach of a breach notified by the Information Commissioner, except as provided by section 235A.
	Subsection (10) sets out that a personal data breach is considered to be serious if the breach is likely to result in a high risk to the rights and freedoms of individuals.
	Subsection (11) defines the key terms used throughout this section, covering "the 2003 Regulations" (i.e. the Privacy and Electronic Communications (EC Directive) Regulations 2003 (S.I. 2003/2426) - "PECR"), "personal data breach" and "relevant restriction".
	Section 11(2) amends RIPA 2000 to clarify that the Investigatory Powers Tribunal is the appropriate forum for to determine complaints relevant personal data breaches specified in section 235A of the Act.
	Section 11(3) amends RIPA 2000 in consequence of the amendments made at section 11(2) regarding the Tribunal’s jurisdiction.
	Section 11(4) amends section 68(8) RIPA 2000 to add the Information Commissioner to the list of relevant Commissioners who may be required to provide assistance to the Tribunal.
	Section 11(5) repeals regulation 5A(9) of PECR to enable Telecommunications Operators to report certain personal data breaches to the Information Commissioner.
	Section 11(6) repeals paragraph 14 of Schedule 10 IPA 2016, in consequence of the amendment at Section 11(5).