UK surveillance laws reformed in new Investigatory Powers Act

The Act received Royal Assent on Tuesday after being finalised in parliament earlier this month. It will govern how UK authorities access 'communications data', lawfully intercept communications, gather data about the public in bulk, and use equipment interference methods.

UK home secretary Amber Rudd said: "This government is clear that, at a time of heightened security threat, it is essential our law enforcement, security and intelligence services have the powers they need to keep people safe. The internet presents new opportunities for terrorists and we must ensure we have the capabilities to confront this challenge. But it is also right that these powers are subject to strict safeguards and rigorous oversight."

"The Investigatory Powers Act is world-leading legislation that provides unprecedented transparency and substantial privacy protection," she said.

The Act will affect telecommunications operators, telecommunications service or systems providers and postal operators or postal service providers. UK intelligence agencies and law enforcement bodies are among the agencies that can use powers under the Act to enlist those telecoms or postal bodies' help in taking action, such as disclosing data or intercepting communications, for limited purposes provided for in the legislation. Those purposes include to tackle serious crime, and to protect the UK's economic interests.

Each of the individual powers provided for under the new legislation is subject to its own distinct governance framework. A range of privacy safeguards, including a special privacy clause, and oversight mechanisms, are built in to the new laws. For example, UK intelligence agencies have a qualified right to obtain personal datasets in bulk for national security reasons under warrants that would be issued by UK ministers.

The Investigatory Powers Act has proved to be a controversial piece of legislation, attracting criticism from civil liberties campaigners. A petition has been signed by more than 145,000 seeking its repeal. As the petition has more than 100,000 signatures the UK parliament must consider a debate on the issue.

Beyond the debate, however, the future of the legislation remains unclear. A legal challenge brought before the EU's highest court, the Court of Justice of the EU (CJEU), could have a bearing on the Investigatory Powers Act.

The CJEU has been asked by the Court of Appeal in London to answer questions relevant to the Data Retention and Investigatory Powers Act (DRIPA), which the Investigatory Powers Act now replaces. DRIPA broadly requires telecoms providers to retain information about customers' communications and to disclose that information to law enforcement agencies when asked to do so.

DRIPA was introduced as a replacement for UK rules that previously implemented the EU's Data Retention Directive which was invalidated by the CJEU in 2014. However, a legal challenge against DRIPA, fronted by two UK MPs, was launched shortly after the new legislation came into force, with concerns raised that the faults with the Data Retention Directive had been repeated in DRIPA and that the Act infringed privacy rights.

In July last year the High Court in London ruled that DRIPA was incompatible with human rights legislation but that decision was appealed by the UK government to the Court of Appeal. In July this year, an advocate general to the CJEU gave his non-binding opinion on the case referred by the Court of Appeal. Henrik Saugmandsgaard Øe recommended criteria for legitimate data retention laws. The CJEU often follows the opinions issued by its advocate generals. It is not yet clear when the CJEU will issue its binding judgment in the case.

Jim Killock, executive director of the Open Rights Group, said the Investigatory Powers Act is "one of the most extreme surveillance laws ever passed in a democracy".

"Although there are some improvements to oversight, the Bill will mean the police and intelligence agencies have unprecedented powers to surveil our private communications and internet activity, whether or not we are suspected of a crime," Killock said.