Part 4: Retention of communications data Section 87: Powers to require retention of certain data
This section provides a power to require telecommunications operators to retain communications data, where necessary and proportionate for one or more of the statutory purposes for which it can be acquired (set out at section 61(7)), for a maximum period of 12 months.
	The power is exercised by the Secretary of State giving a retention notice to a telecommunications operator. The Secretary of State’s decision must then be approved by a Judicial Commissioner (section 89). A retention notice, which may relate to one or more operators, will require the retention of specified items of communications data for the period or periods set out in the notice. The period for which data may be retained must be no more than 12 months. In addition to requiring the retention of specified data a notice may impose additional requirements and restrictions in relation to the retention of the data, such as requirements relating to the processing or security of retained data. Unless, or until, a retention notice is given, a telecommunications operator is not required to retain any communications data under this Act.
	Subsection (4) provides that a retention notice cannot require the retention of so-called ‘third party data’. Where one telecommunications operator is able to see the communications data in relation to applications or services running over their network, but where they do not use or retain that data for any purpose, it is regarded as ‘third party data’.
	Subsection (10) makes explicit that legitimate trade union activity would never be sufficient grounds, of itself, to establish that a requirement to retain data is necessary.
	Subsection (11) describes communications data that can be retained by reference to what it can be used to identify, or assist in identifying. For example, communications data can be retained if it may be used to identify, or could assist in identifying, the sender or recipient of a communication (whether or not a person). Such communications data would include phone numbers, email addresses and source IP addresses.
	Subsection (11) also makes clear that communications data that can be retained includes internet connection records. Internet connection records, which are defined in section 62(7), are a record of the internet services that a specific device connects to – such as a website or instant messaging application – captured by the company providing access to the internet. They could be used, for example, to demonstrate a certain device had accessed an online communications service but they would not be able to be used to identify what the individual did on that service. Section 62 provides certain restrictions on the acquisition of internet connection records.