Report of the Interception of Communications Commissioner - March 2015
5.15 Section 4(4) DRIPA 2014 amends section 11 of RIPA 2000 (implementation of
interception warrants) by inserting a new subsection (5A), which sets out factors to be
taken into account whether steps for giving effect to a warrant are reasonably practicable.
That amendment takes account of restrictions that laws in the countries or territories
outside the UK might impose on the persons upon whom a requirement might be levied.
5.16 Section 4(8) DRIPA 2014, which amends section 22 of RIPA 2000 (obtaining and
disclosing communications data), does not appear to take account of any laws in the
country or territory outside of the UK and any restrictions that might be in place that
could prohibit the disclosure sought.
5.17 The larger element of our inspection regime is to engage with all police forces, law
enforcement agencies, the intelligence agencies and other public authorities who may
undertake the acquisition of communications data in accordance with Chapter II of Part
I of RIPA 2000. During these inspections my office has asked the question as to whether
Accredited Officers (AOs) within the Single Points of Contact (SPoCs) have been aware of
the changes to RIPA brought about by DRIPA, in particular, the extra-territorial effect of
notices served on overseas CSPs. Several examples have been shared with us by those
using their powers to acquire communications data from CSPs outside of our territory
albeit the SPoCs were, in practice, mostly unaware of the amended extra-territorial effect
of the notice.
5.18 Their general observations are that whilst the overseas CSPs take receipt of notices
requiring the disclosure of data, the CSPs continue to maintain that the notices cannot be
enforced or compelled through civil sanction within the UK as the CSP is outside of UK
jurisdiction. It is common for the CSPs to require information in addition to the notice to
determine whether they are able to disclose communications data taking into account
the laws within the jurisdiction in which they generate and retain the data. In the CSPs
view they are disclosing the data “voluntarily” and are not required to disclose it.
5.19 For example, one SPoC recently shared with our inspectors that an overseas CSP
had declined a notice requiring the disclosure of internet-related data as they required
additional information about the nature of the investigation to enable them to consider
the laws they are subject to and determine whether they were able to “voluntarily” disclose
the data. In practice this is common as the additional information assists the overseas
CSP to determine if the criminal act within the UK infringes their user agreements and /
or laws within their jurisdiction.
5.20 Turning to interception warrants, some overseas CSPs are providing assistance in
very limited circumstances.
5.21 The policy effect of the amendments has been to make explicit that which was
implicit in RIPA concerning extra-territorial reach. I can report however that this does not
appear to have changed or amended the operational practice of those public authorities
using their powers under Part I, or the conduct undertaken by overseas CSPs. Furthermore
there remain a number of CSPs who still do not recognise or consider that they are
bound by RIPA 2000.
16
@iocco_oversight