Obtaining and disclosing communications data

‘Communications data’ is a statutory term which covers a variety of information likely to be held by, or be available to, a ‘communications service provider’ such as a telephone company, postal company or ISP. Communications data is ‘content-neutral data’ which can include a customer’s details such as name and address, and the types of communication that he or she has received or made, but will not include the substance of those communications. For a telephone company, this will include numbers called and how long calls lasted, but not what was said; for a postal company, it will include details of the type of post received so far as it can be ascertained from the outside of the item delivered, but not what the post contained; for an ISP it will include details of the websites visited, but not their content. Whilst access to this information will not involve intercepting a communication, it can still involve a substantial interference with your right to privacy. Such information will often reveal not only your identity, but also significant detail about your life, your interests and your activities.

Chapter II of Part I of RIPA is intended to regulate the ways in which such information can be obtained and disclosed by public authorities. The framework establishes a system for public authorities (such as the police, the Serious Organised Crime Agency, customs and tax authorities, and the intelligence services) to do one of two things: they can either authorise their own officers, staff or employees to obtain communications data (a process known as “authorization”) , or they may issue “notices” to private communications services providers (CSPs) requiring the CSPs to disclose communications data to them. Notices and authorisations last one month, but can be extended.

The list of public bodies entitled to issue authorizations and notices under these provisions was expanded in 2003 , 2005 and 2006 : at the time of writing it includes many central government Departments, all local authorities, and a large number of other bodies such as the Financial Services Authority, Ofcom, the emergency services (ambulance and fire authorities), the Food Standards Agency, the Charities Commission, the Gangmasters Licensing Authority, the Environment Agency and the Gambling Commssion.

In order for an authorisation to be granted, it must be both necessary and proportionate . In order to be ‘necessary’ one of the specified reasons must apply: national security; prevention or detection of crime; prevention of disorder; economic well-being of the UK; public safety; protection of public health; assessment or collection of tax or duty or other governmental charge; preventing, in an emergency, death or injury or damage to a person’s health. RIPA also allows the Secretary of State to specify further reasons by order , and in 2006, the following were added : assisting investigations into alleged miscarriages of justice; assisting in identifying any person who has died otherwise than a result of crime, or identifying any person who is unable to identify himself because of a physical or mental condition, other than one resulting from crime; and obtaining information about the next of kin or other connected person of such people, or about the reasons for their death or condition.

An authorisation may be granted by a ‘designated person’ within each relevant public authority; and there are rules as to which specific offices and ranks of people are sufficiently senior to grant authorisations, and also sufficiently senior to be authorised as a result to gather communications data. The precise ranks and offices in each case differ depending on the public authority: they are all set out in an Order of the Secretary of State.

Back to to top