The Communications Data Act text: part 1

Communications Data Act


BE IT ENACTED by the Queen’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:—

PART 1: ENSURING OR FACILITATING AVAILABILITY OF DATA

Ensuring or facilitating availability

1 Power to ensure or facilitate availability of data

(1) The Secretary of State may by order—
(a) ensure that communications data is available to be obtained from telecommunications operators by relevant public authorities in accordance with Part 2, or
(b) otherwise facilitate the availability of communications data to be so obtained from telecommunications operators.

(2) An order under this section may, in particular—
(a) provide for—
(i) the obtaining (whether by collection, generation or otherwise) by telecommunications operators of communications data,
(ii) the processing, retention or destruction by such operators of data so obtained or other data held by such operators,
(iii) the entering into by such operators of arrangements with the Secretary of State or other persons under or by virtue of which the Secretary of State or other persons engage in activities on behalf of the operators on a commercial or other basis for the
purpose of enabling the operators to comply with requirements imposed by virtue of this section,
(b) impose requirements or restrictions on telecommunications operators or other persons or provide for the imposition of such requirements or restrictions by notice of the Secretary of State.

(3) Requirements imposed by virtue of subsection (2) may, in particular, include—
(a) requirements (whether as to the form or manner in which the data is held or otherwise) which ensure that communications data can be disclosed without undue delay to relevant public authorities in accordance with Part 2,
(b) requirements for telecommunications operators—
(i) to comply with specified standards,
(ii) to acquire, use or maintain specified equipment or systems, or
(iii) to use specified techniques,
(c) requirements which—
(i) are imposed on a telecommunications operator who controls or provides a telecommunication system, and
(ii) are in respect of communications data relating to the use of telecommunications services provided by another telecommunications operator in relation to the telecommunication system concerned.

(4) Nothing in this Part authorises any conduct consisting in the interception of communications in the course of their transmission by means of a telecommunication system.

(5) In this section—
“processing”, in relation to communications data, includes its reading, organisation, analysis, copying, correction, adaptation or retrieval and its integration with other data, “relevant public authority” has the same meaning as in Part 2.

(6) See—
(a) section 25 for the way in which this Part applies to public postal operators and public postal services, and
(b) section 28 for the definitions of “communications data” and “telecommunications operator” and for other definitions relevant to this Part.

Safeguards

2 Consultation requirements

(1) Before making an order under section 1, the Secretary of State must consult OFCOM.

(2) Before making an order under section 1, the Secretary of State must consult—
(a) such persons appearing to be likely to be subject to the requirements or restrictions for which it provides,
(b) such persons representing persons falling within paragraph (a), and
(c) such persons (other than OFCOM) with statutory functions in relation to persons falling within that paragraph, as the Secretary of State considers appropriate.

(3) Before making an order under section 1, the Secretary of State must consult the Technical Advisory Board.

(4) In this section “OFCOM” means the Office of Communications.

(5) In this Act “the Technical Advisory Board” means the Board established by section 13 of the Regulation of Investigatory Powers Act 2000.

3 Data security and integrity

A telecommunications operator who holds communications data by virtue of this Part must—
(a) secure that the data is of the same quality and subject to the same security and protection as the data on any system from which it is derived, and
(b) protect the data against accidental or unlawful destruction, accidental loss or alteration, or unauthorised or unlawful retention, processing, access or disclosure.

4 Period for which data is to be retained

(1) A telecommunications operator who holds communications data by virtue of this Part must retain the data until—
(a) the end of—
(i) the period of 12 months, or
(ii) such shorter period as may be specified in an order under section 1 or a notice given to the operator in pursuance of such an order, beginning with the date of the communication concerned, and
(b) any extension of that period under subsection (3).

(2) A public authority may, before the end of the period mentioned in subsection
(1)(a), notify the telecommunications operator concerned that the data is, or may be, required for the purpose of legal proceedings.

(3) If such a notification has been given, the period mentioned in subsection (1)(a) is extended until the public authority notifies the operator that the data is not required for the purpose of legal proceedings.

(4) The public authority must, as soon as reasonably practicable after the authority becomes aware of the fact, notify the operator that the data is not required for the purpose of legal proceedings.

(5) A notification under this section must be in writing.

5 Access to data

(1) A telecommunications operator who holds communications data by virtue of this Part must not disclose the data except—
(a) in accordance with the provisions of Part 2, or
(b) otherwise as authorised by law.

(2) The operator must put in place adequate security systems (including management checks and controls) governing access to the data in order to protect against any disclosure of a kind which does not fall within subsection (1)(a) or (b).

6 Destruction of data

(1) A telecommunications operator who holds communications data by virtue of this Part must destroy the data if the retention of the data ceases to be authorised by virtue of this Part and is not otherwise authorised by law.

(2) The requirement in subsection (1) to destroy data is a requirement to destroy the data in such a way that it can never be retrieved.

(3) It is sufficient for the operator to make arrangements for the destruction of the data to take place at such monthly or shorter intervals as appear to the operator to be convenient.

7 Other safeguards

(1) A notice of the Secretary of State provided for by an order under section 1 must—
(a) be in writing,
(b) specify the person to whom it is given, and
(c) be given in such manner (whether by publication or otherwise) as the Secretary of State considers appropriate for bringing it to the attention of the person concerned.

(2) An order under section 1 must ensure that a person, to whom a notice of the kind mentioned in section 1(2)(b) is given, can refer the notice to the Technical Advisory Board.

(3) Such an order must provide for—
(a) any such reference to the Board to be made before the end of such period as may be specified in the order,
(b) the Board to have a discretion, on such grounds as may be specified, to extend any period so specified,
(c) there to be no requirement (other than in the case of any notice specified in the order) to comply with a notice referred to the Board until proceedings on the reference are completed,
(d) the Board—
(i) to consider any technical matters relating to the notice referred to them and the financial consequences, for the person making the reference, of the notice, and
(ii) to report their conclusions on those matters to that person and to the Secretary of State,
(e) the Secretary of State, after considering the Board’s report, to be able to—
(i) withdraw the notice, or
(ii) give a further notice confirming its effect, with or without modifications,
(f) a further notice given by virtue of paragraph (e)(ii) not to be the subject of a further reference to the Board.

(4) See also—
(a) sections 22 and 23 (which confer roles on the Interception of
Communications Commissioner, the Information Commissioner and
the Investigatory Powers Tribunal in relation to reviewing the exercise
of functions exercisable by virtue of this Part), and
(b) section 24 (which abolishes certain general powers to secure the
disclosure of communications data by telecommunications operators
etc.).

Enforcement and protection for compliance

(1) It is the duty of a telecommunications operator or other person on whom a requirement or restriction is imposed by—
(a) section 3, 4(1), 5 or 6, or
(b) a notice of the Secretary of State provided for by an order under section 1, to comply with the requirement or restriction concerned.

(2) That duty is enforceable by civil proceedings by the Secretary of State for an injunction, or for specific performance of a statutory duty under section 45 of the Court of Session Act 1988, or for any other appropriate relief.

(3) Conduct is lawful for all purposes if—
(a) it is conduct in which a person is authorised or required to engage by virtue of this Part, and
(b) the conduct is in accordance with, or in pursuance of, the authorisation or requirement.

(4) A person (whether or not the person so authorised or required) is not to be subject to any civil liability in respect of conduct that—
(a) is incidental to, or is reasonably undertaken in connection with, conduct that is lawful by virtue of subsection (3), and
(b) is not itself conduct for which an authorisation or warrant—
(i) is capable of being granted under any of the enactments mentioned in subsection (5), and
(ii) might reasonably have been expected to have been sought in the case in question.

(5) The enactments referred to in subsection (4)(b)(i) are—
(a) an enactment contained in Part 2,
(b) an enactment contained in the Regulation of Investigatory Powers Act 2000,
(c) an enactment contained in Part 3 of the Police Act 1997 (powers of the police and of customs officers), or
(d) section 5 of the Intelligence Services Act 1994 (warrants for the intelligence services).