Communications Data (CD) Section 11
Section 11 of the IPA 2016 created an offence for a relevant person within a relevant public authority of "knowingly or recklessly" obtaining CD from a Telecommunications Operator (TO) or a Postal Operator (PO) without lawful authority. A relevant public authority is an authority listed in Schedule 4 of IPA 2016. The Act now provides examples of what will be included within the meaning of "lawful authority" under section 11.
	When the legislative provision was created it was to ensure there were adequate safeguards and oversight to protect privacy, especially personal data that is not publicly or commercially available and was to be obtained from private sector TOs. The offence set out under section 11 combined with the complexity of the CD definition posed significant challenges to public authorities. This Act therefore set out examples of authorities that will amount to "lawful authority" for the purposes of section 11 with the aim of providing greater reassurance to public authorities when acquiring CD from TOs.
	It was also not the policy or legislative intent to prevent data sharing between public sector organisations required to meet their statutory duties and obligations when administering public services or systems, for example authenticating a citizen’s benefits application against government tax systems and preventing and detecting fraud.
	Government departments are likely to fall within the definition of a TO in the IPA 2016 because of the services they offer via digital platforms for citizens to manage their access to public services, for example submitting tax returns, and applying for benefits, passports, or driving licenses. The measures in this Act aim to remove the risk of them (and other public sector organisations) committing a section 11 offence by receiving CD from another public sector organisation in the exercise of their functions. When referring to public sector organisations the Act uses a similar definition to that used in the Procurement Act 2023.   Not all such organisations will be TOs.
	The sharing of CD between public authorities will still require compliance with data protection legislation and would continue to be subject to sufficient oversight. There is an agreement between the IPC and the Information Commissioner in relation to where their responsibilities may overlap.