Communications Data Bill

Can the Police and Public Authorities Access Your Communications Data?

Telephone calls, emails, messaging services and internet use can generate information which may assist the investigation of crime and threats to national security. UK law permits specified public authorities to obtain certain communications data, but this does not mean that every authority can freely read private messages or inspect someone's complete internet history.

The principal legal framework is the Investigatory Powers Act 2016, as amended. It regulates the retention and acquisition of communications data, interception of communications, equipment interference and the use of certain bulk investigatory powers.

What Is Communications Data?

Communications data describes information about a communication rather than what was said or written in it. It is sometimes described as the "who, where, when and how" of a communication.

Depending on the service and the information available, communications data may include:

• The telephone numbers involved in a call
• The date, time and duration of a communication
• The location or network used by a device
• Subscriber or account details
• Internet Protocol addresses
• Information identifying the service or application accessed
• Data showing how a communication was transmitted

Communications data can reveal a great deal about a person's movements, relationships and activities, even though it does not contain the words spoken during a call or the text written in a message.

Is Communications Data the Same as Content?

No. The content of a communication includes the actual words, images, recordings or files exchanged.

Examples of content include:

• The words spoken during a telephone call
• The body of an email
• The text of a private message
• Photographs or videos sent between users
• The contents of an attached document

Obtaining the content of communications generally requires a more intrusive power, such as an interception warrant, rather than an ordinary communications-data authorisation.

What Are Internet Connection Records?

An internet connection record may identify the internet service or online service to which a device connected.

It may, for example, show that a device connected to a particular website, application or online platform at a particular time. It is not intended to provide a complete record of every individual page viewed, search made, or message read.

Even limited connection information can be sensitive because it may reveal patterns of behaviour, contacts and interests.

Can Communications Companies Be Required to Retain Data?

The Secretary of State can issue a data-retention notice requiring a telecommunications or postal operator to retain specified relevant communications data.

A retention notice must identify the data to be retained and the period for which it must be kept. The legislation permits a maximum retention period of 12 months.

This does not mean that every communications company automatically retains every type of information for a year. The obligation depends on the terms of a lawful notice and the data the operator holds or is required to retain.

The requirement must be necessary and proportionate for a permitted statutory purpose. The effect on the operator, likely benefits and Interference with privacy must be considered.

Why Is Historic Communications Data Retained?

Communications data may become relevant after an offence has occurred. Investigators may need to establish who contacted a suspect, where a device was used or how different people and accounts were connected.

It can be used in investigations involving:

• Terrorism and national security
• Murder and serious violence
• Kidnap and missing persons
• Organised crime
• Fraud and money laundering
• Child sexual exploitation
• Drug trafficking
• Cybercrime
• Threats to life

The usefulness of the information does not remove the need for legal authority. The circumstances of the particular investigation must justify access.

Which Public Authorities Can Obtain Communications Data?

The Investigatory Powers Act permits specified public authorities to obtain communications data for defined purposes. These include police forces, intelligence agencies and certain other bodies with criminal-investigation or regulatory functions.

Not every public authority has access to every category of data. The powers available depend on the organisation, the purpose of the request and the applicable legislation.

Local authorities and regulatory bodies cannot simply use these powers for routine administrative convenience. A request must fall within an authorised statutory purpose and satisfy the requirements of necessity and proportionality.

What Does Necessary and Proportionate Mean?

A request should only be approved where obtaining the information is necessary for a lawful purpose. The intrusion into privacy is proportionate to what the investigation is seeking to achieve.

The authority should consider:

• The seriousness of the matter being investigated
• Why the requested data is relevant
• Whether less intrusive information could achieve the same objective
• How much data is being requested
• The period covered by the request
• Whether confidential or sensitive relationships may be affected
• The likely consequences for people who are not under investigation

A broad request for information should not be made merely because the data might prove useful.

Who Authorises a Request?

Many communications-data requests from law enforcement agencies and public authorities require independent authorisation through the Office for Communications Data Authorisations.

The Office considers whether a request is lawful, necessary and proportionate. It operates under the authority of the Investigatory Powers Commissioner.

Different arrangements apply to certain national-security cases, intelligence agency requests and urgent situations involving an imminent threat to life or another emergency.

Urgent Requests

An urgent request may be made where delay could place life at risk, cause serious harm or undermine an immediate investigation.

Urgency does not remove the need for legal justification. The authority must document why the information was required and why the ordinary process could not be followed in time.

An urgent authorisation is generally valid for a shorter period and remains subject to oversight and later inspection.

Can the Government Read Private Messages?

Accessing the content of private communications is governed by separate interception provisions.

A targeted interception warrant may permit the interception of communications relating to a particular person, organisation, premises or set of circumstances.

Such a warrant normally requires approval by the Secretary of State or another authorised decision-maker and approval by a Judicial Commissioner. This is commonly described as the "double-lock" safeguard.

Emergency procedures exist, but they remain subject to legal conditions and subsequent judicial review.

Encryption and Messaging Services

Many communications services use end-to-end encryption, meaning that the provider may not ordinarily be able to read the content of messages.

The Investigatory Powers Act contains powers allowing technical capability notices to be issued to telecommunications operators in defined circumstances. These notices are subject to statutory procedures, necessity and proportionality tests, consultation, oversight and rights of review.

The existence of these powers does not mean that the government has routine access to every encrypted message or that all providers are required to remove encryption for all users.

Equipment Interference

Equipment interference involves obtaining information by interfering with computers, mobile telephones, servers or other devices.

It can include techniques sometimes described as lawful hacking. Depending on the warrant, it may enable an authority to obtain communications, stored files, device information or other data.

Because this is highly intrusive, equipment interference is governed by separate warrant requirements and safeguards.

Bulk Investigatory Powers

The intelligence services have access to certain bulk powers for national-security and related purposes.

Bulk powers are not the same as allowing every public authority to inspect the communications of the entire population. They are restricted to specified agencies and are subject to warrants, selection rules, safeguards, retention requirements and oversight.

The Investigatory Powers (Amendment) Act 2024 changed parts of the framework governing bulk personal datasets, internet connection records and notices issued to communications providers.

Confidential and Privileged Information

Additional safeguards may apply where investigators seek information likely to identify confidential journalistic sources or involve legally privileged communications.

Legal professional privilege protects confidential communications between a lawyer and client made for the purpose of obtaining legal advice or conducting litigation.

The protection is not absolute. It does not extend to communications made to further a criminal purpose, and legislation permits access in tightly controlled circumstances. However, requests involving privileged or journalistic material require particular scrutiny.

Oversight of Investigatory Powers

The Investigatory Powers Commissioner and Judicial Commissioners provide independent oversight of the use of investigatory powers.

Their functions include:

• Reviewing and approving certain warrants
• Inspecting public authorities and intelligence agencies
• Reviewing compliance with legislation and statutory codes
• Identifying errors and areas of concern
• Overseeing the Office for Communications Data Authorisations
• Publishing reports about the use of investigatory powers

Public authorities and communications operators must also follow statutory codes of practice explaining how the powers and safeguards should operate.

Data Protection and Security

Communications data retained or acquired by an organisation must be protected against unlawful access, accidental loss, misuse and unauthorised disclosure.

Authorities should limit access to staff who need the information, maintain audit records and delete data when it is no longer lawfully required.

Data protection legislation can apply alongside the Investigatory Powers Act, although exemptions may apply where necessary to protect national security or avoid prejudicing a criminal investigation.

Can Someone Find Out Whether Their Data Was Accessed?

A person will not normally be told during an active investigation that their communications data has been obtained or that their communications are being intercepted.

Disclosure could alert a suspect, reveal investigative methods or place others at risk.

In some circumstances, an individual may later be informed that a serious error has occurred. However, there is no general right to receive routine notification whenever an authority has lawfully obtained communications data.

Complaints About Surveillance

A person who believes that a public authority has unlawfully used covert investigatory powers may be able to complain to the Investigatory Powers Tribunal.

The Tribunal can consider complaints involving interception, communications data, surveillance, equipment interference and conduct by intelligence agencies.

It can investigate whether conduct was lawful and may have powers to quash warrants, order the destruction of information or award compensation in an appropriate case.

Complaints may involve sensitive procedures. The Tribunal may not be able to disclose all evidence or operational details to the complainant.

Human Rights and Privacy

Article 8 of the European Convention on Human Rights protects private and family life, the home and correspondence.

The right is qualified rather than absolute. Interference may be lawful where it is in accordance with law, pursues a legitimate purpose and is necessary and proportionate.

The central legal question is not simply whether communications data assists investigations. It is whether the powers are sufficiently clear, independently supervised and used only where the intrusion is justified.

Balancing Security and Privacy

Communications data can be important in investigating serious crime and protecting the public. It may help establish relationships between suspects, locate vulnerable people and identify devices used in criminal activity.

At the same time, communications records can reveal detailed information about a person's life. Large-scale retention or unjustified access can interfere significantly with privacy, freedom of expression and confidential relationships.

The law therefore attempts to balance investigative necessity with authorisation, time limits, independent oversight and legal remedies.

Obtaining Legal Advice

A person concerned about unlawful surveillance, misuse of communications data or Interference with legally privileged material should obtain advice from a solicitor experienced in public law, human rights, data protection or criminal investigations.

A communications provider receiving a retention, technical capability or national-security notice should obtain specialist regulatory advice about its obligations and review rights.

Important Information

Solicitors.com is not a firm of solicitors. This article is provided for general information only and does not constitute legal, data protection or security advice. Investigatory powers, statutory codes and data protection rules may change, and their application will depend on the individual circumstances. You should seek advice from a suitably qualified solicitor before taking or refraining from action.