Snooper's Law

The Investigatory Powers Act: What the "Snooper's Charter" Actually Allows

The Investigatory Powers Act 2016 created a comprehensive legal framework governing interception, communications data, equipment interference and bulk investigatory powers in the United Kingdom.

Critics often refer to it as the "Snooper's Charter" because of concerns about privacy, bulk data collection and the ability of the state to obtain information about people's communications and internet use.

Supporters argue that the legislation provides police and intelligence agencies with powers needed to investigate terrorism, organised crime, child sexual abuse, cybercrime and other serious offences, while placing those powers within a clearer system of warrants, oversight and judicial approval.

The Act received Royal Assent on 29 November 2016. It has since been affected by court decisions, revised codes of practice and the Investigatory Powers (Amendment) Act 2024.

What Does the Act Cover?

The Act regulates several different investigatory powers, including:

• interception of communications;
• obtaining communications data;
• retention of specified communications data;
• internet connection records;
• equipment interference;
• bulk interception;
• bulk acquisition of communications data;
• bulk equipment interference;
• retention and examination of bulk personal datasets; and
• oversight by the Investigatory Powers Commissioner.

These powers are not interchangeable. Different legal tests, authorisation procedures and safeguards apply depending on the type of information sought and the organisation using the power.

Does Every Communications Company Have to Keep Everything?

No.

The Act does not automatically require every telephone, internet or messaging company to store the full content of everyone's communications and online activity for 12 months.

The Secretary of State may issue a data-retention notice requiring a telecommunications operator to retain specified categories of relevant communications data.

A notice must be considered necessary and proportionate for a permitted statutory purpose.

The maximum retention period is 12 months, but a notice may require a shorter period where that is sufficient.

What Is Communications Data?

Communications data is information about a communication rather than ordinarily the content of what was said, written or viewed.

It can include information such as:

• the telephone numbers involved in a call;
• the date and time of a communication;
• the duration of a call;
• the location or network used;
• subscriber details;
• the device or service involved;
• an internet protocol address; and
• information about an internet service to which a device connected.

Communications data can still reveal a great deal about a person's life, relationships, movements and interests, even where the content of the communication is not disclosed.

Does the Act Require Messages to Be Stored?

The content of a text message, email or private conversation is different from communications data.

A retention notice under the ordinary communications-data regime does not simply require every provider to preserve the contents of all messages for a year.

Access to the content of communications generally requires an interception warrant or another specific legal power.

A provider may already retain message content for its own operational reasons, but that is separate from a statutory requirement to retain specified communications data.

What Is an Internet Connection Record?

An Internet Connection Record, commonly called an ICR, is a record held by a telecommunications operator showing that a device connected to a particular internet service.

It may indicate, for example, that a device connected to:

• a search engine;
• a social-media platform;
• a messaging service;
• a news website;
• a cloud-storage provider; or
• another internet domain or service.

An ICR is not intended to record every page read, every search term entered, or the complete content exchanged through the service.

For example, it may show that a device connected to a search engine but not necessarily what the user searched for.

Can Authorities Access Internet Connection Records?

Specified public authorities can obtain Internet Connection Records only where a statutory access condition is met,t and the request is properly authorised.

The original conditions focused on purposes such as identifying:

• which internet service a known person or device had used;
• who had used a particular internet service; or
• whether a person had accessed an illegal service.

The Investigatory Powers (Amendment) Act 2024 introduced an additional condition allowing the intelligence services and National Crime Agency to use ICR information in certain investigations where the service or exact time may not initially be known.

The power remains subject to statutory purpose, necessity, proportionality and authorisation requirements.

Who Can Obtain Communications Data?

A range of public authorities may obtain particular categories of communications data where Parliament has given them the relevant power.

These can include:

• police forces;
• intelligence agencies;
• the National Crime Agency;
• HM Revenue and Customs;
• specified regulatory and enforcement authorities; and
• certain other public bodies listed in legislation.

Not every authority can obtain every type of data or use every investigatory power.

The most intrusive powers are generally limited to a much smaller number of police, intelligence and law-enforcement bodies.

Is a Warrant Always Required?

Not every request for communications data requires a warrant signed by a minister.

Many communications-data applications are independently considered through the Office for Communications Data Authorisations, which operates within the Investigatory Powers Commissioner's Office.

Different arrangements apply to intelligence agencies and urgent cases.

The most intrusive powers, including interception and certain forms of equipment interference, generally require a warrant and the double-lock approval process.

What Is Interception?

Interception involves obtaining the content of a communication while it is being transmitted or made available through a communications system.

It may include access to:

• telephone conversations;
• emails;
• text messages;
• online communications; or
• other transmitted content.

Targeted interception normally requires a warrant issued for a specified person, premises, organisation or group connected with an investigation.

The warrant must satisfy statutory tests concerning necessity and proportionality.

The Double-Lock Safeguard

The "double lock" is not an anything-goes surveillance protocol.

It is a two-stage approval system for the most intrusive investigatory warrants.

In the usual process:

• a Secretary of State or another designated decision-maker first decides whether the warrant is necessary and proportionate; and
• a Judicial Commissioner then independently reviews the decision before the warrant can normally take effect.

The Judicial Commissioner is a senior judicial office-holder operating through the Investigatory Powers Commissioner's Office.

If approval is refused, the warrant cannot ordinarily proceed.

What Does the Judicial Commissioner Consider?

The Judicial Commissioner considers whether the decision to issue the warrant complies with the applicable legal requirements.

This includes matters such as:

• whether the proposed activity has a lawful purpose;
• whether it is necessary;
• whether the expected benefit justifies the intrusion;
• whether less intrusive methods could reasonably be used;
• whether safeguards are adequate; and
• whether the warrant is sufficiently specific.

Urgent procedures exist for exceptional circumstances, but urgent warrants remain subject to subsequent judicial scrutiny within the statutory period.

Equipment Interference

Equipment interference is the legal term used for obtaining information by interfering with electronic equipment.

It may involve techniques commonly described as device hacking.

Depending on the warrant, it may allow an authorised agency to:

• obtain stored information;
• monitor communications;
• access data held on a telephone or computer;
• activate or use equipment capabilities;
• obtain information before it is encrypted; or
• identify users, devices or networks.

Equipment interference can be highly intrusive and is governed by warrant, necessity, proportionality and oversight requirements.

Can the Authorities Access Encrypted Messages?

End-to-end encryption is designed so that the content of a communication can be read only on the devices of the sender and intended recipient.

A service provider may therefore be unable to provide the message content in readable form.

The Act permits technical capability notices and other lawful requirements in specified circumstances, but this does not mean that every provider can automatically decrypt every communication.

Authorities may instead seek access through:

• a targeted device;
• lawful equipment interference;
• unencrypted backups;
• communications data;
• information held by another participant; or
• other investigative evidence.

Encryption remains controversial because it protects ordinary users, businesses, journalists, lawyers and victims of abuse while also making some criminal investigations more difficult.

Technical Capability Notices

A technical capability notice can require a telecommunications operator to maintain a capability to give effect to specified lawful warrants or authorisations.

Requirements may concern matters such as:

• removing electronic protection where legally and technically possible;
• maintaining systems for lawful interception;
• providing information in an intelligible form;
• supporting the delivery of retained communications data; or
• maintaining appropriate security and confidentiality.

A notice must satisfy statutory tests and is subject to consultation, review and approval procedures.

Whether a requirement is technically feasible and proportionate is central to the process.

Changes Introduced in 2024

The Investigatory Powers (Amendment) Act 2024 updated the 2016 framework following a statutory review.

The amendments included changes concerning:

• Internet Connection Records;
• bulk personal datasets;
• communications-data definitions;
• data-retention notices;
• technical capability notices;
• national security notices; and
• the duties of telecommunications operators when making certain technical changes.

The Government argued that the amendments were necessary to address technological developments and the increasing international operation of communications services.

Privacy and technology organisations raised concerns about the effects on security, encryption, overseas providers and the introduction of new services.

Notification of Technical Changes

The amended regime can require specified telecommunications operators to notify the Government of certain planned changes to their services or systems.

The purpose is to allow the authorities to assess whether the change could affect an operator's ability to comply with an existing or possible lawful notice.

The regime does not mean that the Government must automatically approve every minor software update.

The obligations depend on the operator, notice and regulatory arrangements involved.

Bulk Interception

Bulk interception permits the collection of substantial volumes of communications passing through specified systems or routes.

These powers are generally available only to the intelligence services and are directed principally at obtaining overseas-related communications and intelligence.

The acquisition of material and its later selection for examination are separate stages subject to legal controls.

Safeguards apply to the examination, storage, dissemination and destruction of material.

Bulk Personal Datasets

A bulk personal dataset is a large collection of information about people, many of whom may not be of intelligence interest.

Examples could include datasets containing:

• travel information;
• financial information;
• communications details;
• commercial records;
• identity information; or
• other structured personal data.

The 2024 amendments introduced a separate regime for certain third-party bulk personal datasets considered to present a low or no reasonable expectation of privacy.

More sensitive datasets remain subject to stronger warrant requirements.

Who Oversees the Use of These Powers?

The Investigatory Powers Commissioner oversees the use of investigatory powers by intelligence agencies, law-enforcement organisations and other public authorities.

The Commissioner is supported by Judicial Commissioners, inspectors, legal advisers and technical specialists.

Oversight can include:

• reviewing warrants through the double-lock process;
• inspecting public authorities;
• examining records and systems;
• investigating errors;
• making recommendations;
• publishing annual reports; and
• requiring serious errors to be reported to affected people where the legal test is met.

The Investigatory Powers Tribunal

A person who believes that they have been subjected to unlawful surveillance may be able to complain to the Investigatory Powers Tribunal.

The Tribunal can examine complaints involving:

• the intelligence services;
• interception;
• communications data;
• equipment interference;
• covert surveillance;
• informants and undercover sources; and
• other conduct involving investigatory powers.

The Tribunal can investigate in circumstances where evidence may be sensitive or classified.

It can make findings, quash warrants, order the destruction of information and award compensation where appropriate.

Legal Challenges and Human Rights

The investigatory powers regime has been subject to several legal challenges concerning privacy, freedom of expression and the protection of confidential information.

Relevant human rights include:

• the right to respect for private and family life;
• freedom of expression;
• protection of journalistic sources;
• legal professional privilege; and
• the right to an effective legal remedy.

Courts have accepted that states may use secret surveillance to protect national security and investigate serious crime.

However, powers must be sufficiently clear, necessary, proportionate and accompanied by effective safeguards against arbitrary use.

Legal Professional Privilege

Confidential communications between a solicitor and client may be protected by legal professional privilege.

The fact that communications are privileged does not make interception technically impossible, but special legal protections apply to their targeting, selection and examination.

Communications made to further a criminal purpose are not protected merely because a solicitor is involved.

Journalists and Confidential Sources

Special safeguards apply where investigatory powers could identify confidential journalistic sources or obtain legally protected journalistic material.

The authorities must address the importance of press freedom and the particular sensitivity of the information.

The applicable procedure depends on the power used and whether the journalist or source is being deliberately targeted.

Security of Retained Data

Telecommunications operators required to retain information must maintain appropriate technical and organisational security.

Retained data must be protected against:

• accidental loss;
• unauthorised access;
• unlawful disclosure;
• alteration;
• destruction; and
• other misuse.

Data should be destroyed when the lawful retention period ends unless another legal obligation requires it to be preserved.

The possibility of hacking, insider misuse or accidental disclosure remains a legitimate concern because communications data can reveal highly sensitive information about individuals and organisations.

Can a VPN Hide Internet Activity?

A virtual private network, or VPN, encrypts traffic between a device and the VPN provider and can conceal some browsing information from the user's ordinary internet provider.

However, a VPN does not make a person anonymous or prevent every form of lawful investigation.

Information may still be available through:

• the VPN provider;
• the destination service;
• account records;
• payment details;
• the user’s device;
• malware or equipment interference;
• traffic analysis;
• other participants in a communication; or
• separate surveillance evidence.

VPNs are also widely used for legitimate purposes, including business security, remote working and protection on public Wi-Fi.

Is Using Privacy Technology Suspicious?

No. Using encryption, a VPN, secure messaging or privacy settings is not by itself evidence of criminal activity.

These technologies have many legitimate uses and can protect people from identity theft, corporate espionage, stalking and cybercrime.

The significance of privacy technology in an investigation will depend on the wider evidence and how it was used.

Can Local Authorities Use the Act?

Local authorities and regulatory bodies may have access to limited investigatory powers for specified statutory purposes.

They do not have the same powers as MI5, GCHQ, the police or the National Crime Agency.

Some local-authority surveillance is governed by the Regulation of Investigatory Powers Act 2000 rather than solely by the 2016 Act.

Authorisation, seriousness and independent approval requirements restrict the circumstances in which these powers may be used.

Does the Act Allow Routine Monitoring of Everyone?

The Act provides bulk and retention powers capable of affecting information relating to large numbers of people who are not suspected of wrongdoing.

That is one reason the legislation remains controversial.

However, the existence of retained or bulk data does not mean that every public official can freely search every person's communications.

The acquisition, selection and examination of data are governed by separate legal tests, authorisation procedures, access controls and oversight.

The Arguments in Favour of the Act

Supporters argue that communications data and interception can help authorities:

• identify terrorist networks;
• locate missing or vulnerable people;
• investigate child sexual abuse;
• trace kidnappers and organised criminals;
• identify cyberattackers;
• connect suspects with victims or locations;
• prevent attacks; and
• obtain evidence for prosecution.

They argue that the law gives previously fragmented powers a clearer statutory basis and introduces stronger judicial oversight.

The Arguments Against the Act

Critics argue that the regime:

• permits the collection of information about people who are not suspected of crime;
• creates risks to privacy and freedom of expression;
• may weaken the security of communications systems;
• places substantial obligations on technology businesses;
• can affect journalists, lawyers and campaigners;
• relies on secret processes that are difficult to challenge; and
• creates valuable databases that criminals or hostile states may target.

They also question whether broad data collection is always more effective than focused investigation.

What Should a Person Do if They Suspect Unlawful Surveillance?

A person concerned about unlawful surveillance should preserve any available evidence and obtain specialist legal advice.

Depending on the circumstances, possible routes may include:

• a complaint to the Investigatory Powers Tribunal;
• a data-protection complaint;
• judicial review;
• a complaint to the relevant public authority;
• a police complaint;
• an application concerning intercepted or seized material; or
• a human-rights claim.

A general suspicion that a device is being monitored will not necessarily establish that a public authority is responsible. Similar signs may result from criminal hacking, spyware, technical faults or another person with access to the device.

The Current Position

The Investigatory Powers Act remains in force and continues to regulate the principal interception, communications-data and equipment-interference powers used by UK authorities.

It does not require every provider automatically to store the contents of every message and every webpage visited by every user.

Instead, specified telecommunications operators may receive notices requiring the retention of relevant communications data for a necessary and proportionate period of up to 12 months.

The most intrusive warrants are normally subject to the double-lock process involving executive authorisation and independent approval by a Judicial Commissioner.

The Investigatory Powers (Amendment) Act 2024 expanded and adjusted parts of the regime, particularly those concerning Internet Connection Records, bulk personal datasets and obligations placed on communications providers.

The debate continues over whether the legislation achieves the correct balance between national security, effective policing, privacy and secure communications.

Finding a Human Rights or Technology Solicitor

Use the search facility at the top of this page to find a solicitor experienced in human rights, privacy, data protection, surveillance, criminal law or technology disputes.

Disclaimer

Solicitors.com is not a firm of solicitors. This article provides general information about investigatory powers in the United Kingdom and does not constitute legal or cybersecurity advice. The applicable powers and safeguards depend on the authority, information and circumstances involved.

Feedback

If you believe this page contains an error or requires updating, please get in touch with us. We welcome amendments that help keep our legal information accurate and useful.