Part 3: Authorisations for obtaining communications data Section 69: Duties in connection with operation of filtering arrangements
This section imposes duties in connection with the operation of filtering arrangements. Subsection (1) provides that no communications data must be obtained or processed under the filter except for the purposes of an authorisation granted under section 61(1). Data which has been obtained or processed under the filter, and is to be disclosed in accordance with the authorisation or for the purposes of assisting the designated senior officer, must only be disclosed to authorised individuals. Further, subsection (1)(c) specifically requires any data obtained by the filter to be immediately destroyed in such a way that it can never be retrieved, once the purposes of the authorisation or of the assistance function have been met or if at any time it ceases to be necessary to retain the data for these purposes.
	Subsection (1) will ensure that only the filtered data relevant to the investigation is disclosed to the requesting agency. Once the filter has provided the answer to the question, all the data relating to the request will be deleted by the filter.
	Subsection (2) limits the disclosure of data other than authorised data which is retained under the filtering arrangements:
to assist a designated senior officer to determine whether he believes the tests for granting an authorisation are met;
for the purposes of support, maintenance, oversight, operation or administration;
to the Investigatory Powers Commissioner for the purposes of any of their functions; and
as otherwise authorised by law.
	Subsection (3) requires strict limits to be placed on the number of persons who are permitted to read, obtain or otherwise process data for the purposes of support, maintenance, oversight, operation or administration in connection with the request filter. Only the Secretary of State and designated persons must be permitted to access or use the capability except in pursuance of an authorisation or to assist the designated senior officer to determine whether an authorisation is necessary and proportionate.
	Subsection (5) requires that an adequate security system is in place to protect against any abuse of access to the filter, as well as measures to protect against any unauthorised or unlawful data retention, processing, access or disclosure. The duty in subsection (4) will ensure that a request filter can only be used in accordance with Part 3 and is subject to adequate and effective safeguards against abuse.
	Subsection (6) requires procedures to be put in place and maintained to ensure that the request filter is functioning properly, including regular testing of the relevant software and hardware. A report must also be made, as soon as possible after the end of each calendar year, to the Investigatory Powers Commissioner about the functioning of the request filter during that year. Such a report must, in particular, contain information about destruction of data during that year. Subsections (5) and (6) will ensure that the operation of any request filter is subject to rigorous oversight and control.
	Subsection (8) requires any significant processing errors to be immediately reported to the Investigatory Powers Commissioner.