Part 1: Bulk Personal Datasets Low or no reasonable expectation of privacy New Section 226B of the IPA 2016: Individual authorisation
Subsection (1) sets out that, for the purposes of Part 7A, "an individual authorisation" is an authorisation that authorises an intelligence service to retain, or retain and examine, any dataset described in that authorisation. Subsection (2) is a cross-reference to section 200 as amended by this Act and is self-explanatory.
	Subsection (3) allows the head of an intelligence service, or a person acting on their behalf, to grant an individual authorisation where certain conditions are met. These conditions are set out in subsections (4) and (5).
	The conditions in subsection (4) require that the person granting the authorisation considers that s226A applies to the dataset (it is a dataset in respect of which there is no, or only a low, reasonable expectation of privacy), the authorisation is necessary for the exercise of the intelligence services functions and the conduct being authorised is proportionate to what is sought to be achieved by it, and that there are appropriate arrangements in force (approved by the Secretary of State) for storing and protecting the data.
	Subsections (5) requires that decisions to grant an individual authorisation must be approved by a Judicial Commissioner (JC). This is subject to the exceptions set out in subsection (6): the approval of a JC is not required if the BPD falls within an existing category authorisation granted under section 226BA, or the person granting the authorisation considers there is an urgent need to grant it.
	Subsection (7) sets out that a person granting an individual authorisation in respect of a BPD that falls within an existing category authorisation may nevertheless, , still seek JC approval if they consider it appropriate to do so..
	Subsection (8) sets out that an individual authorisation relating to a BPD may also authorise the retention or examination of BPDs that do not exist at the time of the authorisation, but which may be reasonably regarded as replacements for the dataset that was authorised. For example, this could include circumstances where a publicly available dataset (that the intelligence service retains under an individual authorisation) is periodically updated with new information of a type that is already contained within the dataset. In such a case the intelligence service would not need to obtain a new individual authorisation to retain or examine an updated version of a dataset that is already the subject of an authorisation.