Government proposes to amend the Investigatory Powers Act

The government has launched a consultation on The Investigatory Powers Act 2016 (IPA) in light of the 2016 decision by the Court of Justice of the European Union. The CJEU said that the UK’s law was incompatible with EU law. The government accepted that there was no provision for independent authorisation of requests for access to retained data; and the crime purpose for retaining and accessing data was not limited to serious crime.

The government now proposes that offences carrying a potential prison sentence of six months or more should be considered "serious crimes" for which communications data can be collected. In future, it would not be possible to collect communications data for the purpose of public health, collecting taxes or regulating financial markets. In addition, the government would set up a new body, the Office for Communications Data Authorisations to authorise or decline law enforcement requests.

However the main point in the CJEU’s decision was extensive data retention. Revision of the law in that respect is important should the UK need to apply for an EU adequacy determination for international data transfers. It is questionable whether the UK would currently satisfy the adequacy test due to the bulk data retention provisions in the IPA.

The consultation is open until 18 January. See https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/663668/November_2017_IPA_Consultation_-_consultation_document.pdf

PL&B has organised a Roundtable in London on 31 January to enable peer-to-peer discussion on GDPR implementation. The theme of this Roundtable is Managing Risk.