The impact of the Investigatory Powers Bill

On 4 November 2015, the UK government published its draft Investigatory Powers Bill. The Bill builds on the work of three recent independent reviews and aims to consolidate the powers that are already available to UK law enforcement, security, and intelligence agencies to obtain the content of (and data about) communications; overhaul the mechanism for authorising and overseeing these powers; and ensure that the powers afforded in existing legislation are fit for the digital age.

Global technology and communications businesses should take note, as the Bill's extraterritorial reach could potentially require non-UK entities to assist UK law enforcement agencies, or
even become subject to bulk equipment interference (interception) warrants.

The Bill expands the range
of organisations that will be subject to data retention and access obligations. Under previous legislation, these obligations mainly affected traditional telecoms companies. However, providers of so-called over-the-top services, such as providers of messaging apps, are also caught by such provisions.

Overseas enforcement

The Bill provides for certain powers to be enforced against overseas companies through the courts. Indeed, a person outside the UK may be required by notice to comply with an authorisation for obtaining communications data. The secretary of state would enforce this duty through proceedings for an injunction
or specific performance, and seeking local enforcement in
the applicable overseas country using the appropriate multi-jurisdictional enforcement agreement. This means the
UK government will need to negotiate a mutual legal assistance treaty on intelligence with the US, making it legal for
US companies to share data if requested under UK law.

The Bill makes the explicit provision for powers to access large volumes of data and will require that bulk interception
and equipment interference warrants may only be issued where the main purpose is to acquire intelligence relating
to individuals outside the UK. Conduct within the UK, or affecting the privacy of persons
in the UK, will be permitted only to the extent that it is necessary for that purpose. If this power seeks to facilitate access to overseas communications, private information, and equipment data, the main target could be providers of cloud computing or social networking-type services based overseas.

Obligations on CSPs

Communications service providers (CSPs) can be required to keep internet connection records for a maximum of 12 months so that law enforcement agencies can establish what services a suspect has used to communicate online.

This is despite the ruling handed down by the European Court of Justice, which held that the Data Retention Directive, requiring the retention of EU citizens' data for between six
and 24 months, constituted a disproportionate interference with both the right to a private life and the right to data protection.

The Bill also imposes similar obligations on all companies providing services or exercising control over communications systems in the UK. This includes the requirement that CSPs provide wider assistance to law enforcement and the security
and intelligence agencies.

Upon the serving of a notice, CSPs may be required to remove any encryption applied to assist in giving effect to interception warrants. The Bill also provides for the possibility to pass regulations imposing obligations relating to the removal of electronic protection (encryption) applied by technology providers.

Decisions will be taken by
a minister subject to a review
by a judicial commissioner to determine whether the warrant is necessary and the conduct authorised under it is proportionate. However, there
is a legitimate question as to whether this is sufficient.
Would a better safeguard be for a warrant to be authorised by a judge in the first place? Recent high-profile litigation generated by the grant of search and surveillance warrants has exposed deficiencies in the approach taken by the state.

The new investigatory
powers commissioner will have
a significantly expanded role in authorising and overseeing the use of these powers by the security and intelligence agencies in the UK.

The Bill will also strengthen
the right of redress for individuals by allowing a domestic right of appeal from the Investigatory Powers Tribunal.

In spite of the government's plans to introduce a revised Bill, which is expected to become law later this year, it is remarkable
that US tech firms have already submitted written evidence to the joint committee scrutinising proposed legislation. Indeed,
in the committee's report of February 2016, concerns with the legislation were highlighted and it was recommended that more clarity regarding the implications of the Bill was needed. SJ

Jonathan Pickworth, pictured, is a partner and Tim Hickman an associate at White & Case, London. Robert Blamires is counsel at the firm’s Silicon Valley office