and deliberately acts in a manner inconsistent with their powers or duties under RIPA
and there has been an adverse impact on an individual. They may act “recklessly” for the
purposes of Paragraph 8.3 if, having failed to take account of an obvious and serious risk,
there has been an adverse impact on an individual.
The circumstances in which an error would be classified as “serious” include:
•
•
•
Technical errors relating to CSP secure disclosure systems, which result in a
significant number of erroneous disclosures.
Errors where the public authority has, as a consequence of the data, initiated
a course of action that impacts on any individual (for example, the arrest of a
person).
Errors which result in the wrongful disclosure of a large volume of
communications data or a particularly sensitive data set.
IOCCO’s error investigation procedure determines whether any reportable error falls into
one of the above categories. In some cases, there may be no direct adverse impact on
any individual (for example, a technical system error which led to false negative results).
In this case, an inspector would still investigate the error and ensure that measures are
put in place to prevent any recurrence.
In cases where there was wilful or reckless conduct and an individual had been adversely
affected, I would invoke my power under Paragraph 8.3. In cases where there was no
wilful or reckless conduct, I would still consider using my discretionary power in Paragraph
6.22. I would assess the impact of the interference on the affected individual’s rights and
might decide to inform them of the error.
Importantly, under the Investigative Powers Act 2016, there will be a change in the
thresholds regarding when the Investigatory Powers Commissioner can inform an individual.
Section 231 of the Act requires the Commissioner to inform a person of any relevant error
where they consider it is serious and in the public interest for that person to be informed. The
Commissioner is not permitted to determine that a matter is serious unless they conclude
that the error has caused significant prejudice or harm to the person concerned.
Whether this will have an impact on the numbers of persons being informed of serious
errors is difficult to judge. Under the existing regime, all occasions on which I have
notified individuals of an error were cases in which they had suffered significant prejudice
or harm (such as being arrested) and so would be covered under the new Act.
In circumstances where a serious error is assessed to have occurred, an Inspector is
allocated to investigate the cause of the error, the impact on the affected individuals’
rights (if applicable) and the measures put in place to prevent recurrence. In cases where
human error is identified, a timeline of events is prepared to establish how the error came
about and any missed opportunities to identify it.
In the case of technical errors, the inspector works with the CSP and their vendors to
discuss the cause and the measures put in place to remedy the issue. Potentially erroneous
disclosures are checked and assessed. My office then contacts the relevant public
authority to understand the impact that each disclosure may have had upon an individual
www.iocco-uk.info
19