Investigatory Powers (Amendment) Bill [HL]

The Investigatory Powers Act (Amendment) Bill was announced in the King’s Speech on 7 November 2023. The accompanying briefing said that the Bill would update the Investigatory Powers Act 2016 and deliver “urgent changes” needed to protect the British people.

What is the Investigatory Powers Act 2016?

The Investigatory Powers Act 2016 overhauled the framework governing the powers of public bodies, including the intelligence and security agencies and law enforcement, to obtain the content of communications and communications data (information about a communication).

Reviews of the Investigatory Powers Act

Following a statutory Home Office review (PDF) of the Investigatory Powers Act 2016 in 2022, Lord Anderson was asked to conduct an independent review, considering various proposals for reform.

Lord Anderson’s Independent Review of the Investigatory Powers Act 2016 (PDF) was published in June 2023.  

Its most significant recommendations was to create a new category of bulk personal dataset(sets of personal information about a large number of individuals, the majority of whom will not be of any interest to the security and intelligence agencies) in which there was a low or no expectation of personal privacy, because, for example, it is already publicly available . This category would be subject to a lighter-touch regime of safeguards than that which currently applies to bulk personal datasets under Part 7 of the Investigatory Powers Act. He made further recommendations about the how long bulk personal data sets can be retained and how they should be renewed.

Lord Anderson also recommended that a new legal basis for accessing internet connection records, records of which internet sites or services have been used, should be added to the Investigatory Powers Act, in order to enable the detection of new subjects of interest.

He also made recommendations about updating certain definitions in the Act and improving the efficiency, flexibility, and resilience of processes around issuing warrants and oversight measures.

Notices under the Investigatory Powers Act

Separately, the Home Office consulted on several proposals to change the notices regime contained in Parts 4 and 9 of the Investigatory Powers Act in June 2023.

The regime currently comprises three kind of notice which can be imposed on telecommunications operators by the Government:

• Data retention notices: requiring that operators retain communications data
• Technical capability notices: requiring operators to provide and maintain technical capabilities enabling them to provide any assistance as required by an authorisation under the IPA
• National security notices: requiring operators to take any steps considered necessary by the Secretary of State in the interests of national security. This may include providing services or facilities to enable the intelligence services to carry out their functions or deal with an emergency.

The consultation noted that changes in technology and an increase in data being held overseas risked reducing the capabilities of law enforcement and intelligence agencies. It made proposals, reflected in the Bill, which aim to make it easier to access data held overseas, and to enable intelligence agencies to work with telecommunications operators to ensure lawful access to data.

What would the Bill do?

The Bill would implement most of the proposals from the reviews. In particular it would:

• Introduce a new, lighter-touch regime for the retention and examination of bulk personal datasets where there is a low or no expectation of privacy in the data
• Create an additional condition, allowing authorities to access internet connection records in order to identify individuals accessing specific internet sites and services where necessary to address serious crime or to protect national security
• Create a new requirement for telecommunications operators to notify the Government of proposed changes to products or services which could impede intelligence services in lawfully accessing data

It would extend to the whole of the UK.

Proceedings in the House of Lords and wider reaction

The Bill was introduced in the House of Lords in November 2023 and completed third reading in January 2024.

It had cross party support, although members of the House of Lords tabled probing amendments on issues including the adequacy of oversight provisions and other safeguards. Several Government amendments were agreed, as well as opposition amendments relating to the role of the Prime Minister in approving warrants to intercept the communications of parliamentarians and oversight by the Intelligence and Security Committee.

Some privacy campaigners and technology companies have expressed concerns about whether the Bill strikes the right balance between privacy and security (PDF).  

Further information and next stage

The Bill had second reading in the House of Commons on 19 February 2024. It had two committee sittings on 7 March and is due to have report stage on 25 March

Bill documents, including the explanatory notes, impact assessment and European Convention on Human Rights memorandum are available on the Bill pages.

The Government has also published a series of factsheets on the Bill, draft excerpts from codes of practice, and other relevant documents.