Improvements to the Notices Regime
For many years, the UK government has had the power to place requirements on telecommunications operators to assist with national security and law enforcement; for example, the power in section 94 of the Telecommunications Act 1984. A Telecommunications Operator is defined in Section 261(10) of the IPA 2016 as:
"Telecommunications operator" means a person who-
(a) offers or provides a telecommunications service to persons in the United Kingdom, or
(b) controls or provides a telecommunication system which is (wholly or partly)-
(i) in the United Kingdom, or
(ii) controlled from the United Kingdom.
	The IPA 2016 currently provides for three different types of notice that can be issued to telecommunication operators (and in some cases postal operators):
Data Retention Notices (DRNs) require the retention of specified types of communication data (communications data is the ‘who’, ‘when’, ‘where’ and ‘how’ – often known as metadata) by telecommunications operators.
Technical Capability Notices (TCNs) require telecommunications operators to provide and maintain technical capabilities enabling them to respond to relevant IPA 2016 authorisations or warrants allowing access to communications data, the content of a communication (the ‘what’), or to enable equipment interference. A notice does not itself authorise the activity that the technical capability is intended to enable.
National Security Notices (NSNs) require the telecommunications operator to take such specified steps as the Secretary of State considers necessary in the interests of national security. This may include providing services or facilities for the purpose of facilitating or assisting an intelligence service to carry out its functions or dealing with an emergency (within the meaning of Part 1 of the Civil Contingencies Act 2004).
	All three types of notices must be ‘double-locked’ (approved by both the Secretary of State and an independent Judicial Commissioner) before they can be given to the operator in question. Section 88(1) and 255(3) of the IPA 2016 also lays out the factors the Secretary of State must consider when deciding whether to give a notice. These matters include:
The likely benefits of the notice,
The likely number of users (if known) of any postal or telecommunications service to which the notice relates,
The technical feasibility of complying with the notice,
The likely cost of complying with the notice, and
Any other effect of the notice on the person (or description of person) to whom it relates.
	A notice itself does not allow access to data. Even when there is a notice in place with a Telecommunications Operator (TO), the public authorities and intelligence communities must also have the relevant warrant or authorisation in place before they are able to access data. The decision to issue a warrant or grant an authorisation will, itself, be subject to appropriate safeguards to ensure that it is necessary and proportionate.
	When it was introduced, one of the main aims of the IPA 2016 was to ensure the powers were fit for the digital age. In the period since 2016, the global volumes of data that exist have grown exponentially, and significant, fast-paced technological change has become the norm. The efficacy of the powers has shifted with these changes, resulting in a negative effect on the capabilities of the UK’s law enforcement and intelligence agencies.
	Between 5 June and 31 July 2023, the Government ran a public consultation on the revised notices regimes in the IPA. 5 The consultation set out the Government’s proposed objectives to improve the effectiveness of the current notices regimes in response to technological changes and the risk they pose to investigatory powers, as well the increase in data being held overseas. The consultation sought input to inform potential policy and legislative proposals intended to mitigate those risks whilst still promoting technological innovation and the privacy of citizens.
	The Government consultation response was published 7 November 2023. This response set out the amendments to Part 4 and Part 9 of the IPA 2016 that were made in this Act to maintain the efficacy of these long-standing powers. These measures include: strengthening the notice review process by maintaining the status quo during the notice review period; clarifying the definition of a telecommunications operator; introducing a notification requirement that requires relevant telecommunications operators (who will be directly informed that they are bound by the obligation by the Secretary of State) to inform the Secretary of State if they propose to make changes to their products or services that would negatively impact existing lawful access capabilities; and introduce a notice renewal process with a statutory role for the IPC in order to increase oversight.
	Additionally, under section 255(9) - (11) of the IPA 2016, any TCN is enforceable by civil proceedings against a person in the UK. Only TCNs that provide for interception and targeted communications data acquisition capabilities are enforceable against a person overseas. Section 95 of the IPA 2016 also provides that a Data Retention Notice (DRN) is enforceable by civil proceedings against a person in the UK, but there is no express provision permitting the enforcement of a DRN against a person outside the UK. The Act, therefore, amends Section 95 and 97 to allow extraterritorial enforcement of DRNs to strengthen policy options when addressing emerging technology, bringing them in line with TCNs. This ensures that notices given to international telecommunication operators can be enforced, should they need to be. The Act also clarifies that the non-disclosure obligation imposed on persons to whom a Technical Capability Notice (TCN) or National Security Notice (NSN) is given, at section 255(8), is also enforceable by civil proceedings, bringing it in line with the enforcement provision at section 95(2) and (5).
	Section 87(4) of the IPA 2016 provides that a DRN cannot require the retention of so-called ‘third party data’. There is no intention to revisit the point of principle; however, the Act contains measures seeking to amend section 87(4) in order to address some discrete and unintended consequences which have unduly broadened the effect of that subsection and restricted the type of data that can be subject to a DRN.
	The Government’s consultation response also set out where the Government decided not to proceed with certain proposals – including compelling telecommunications operators to engage in the consultation process for a notice or strengthening enforcement mechanisms – on the grounds that it is in both the Secretary of State and the operator’s best interest to have a workable notice which is necessary and proportionate and that the IPA 2016 already has strong enforcement options, therefore it is not considered necessary to amend enforcement at this time.