Report of the Interception of Communications Commissioner - March 2015
the material or data (if not destroyed earlier) is destroyed as soon as there are
no longer any grounds for retaining it as necessary for any of the authorised
purposes.”
6.62 My office’s investigation led to the interception agencies embarking on major
reviews of the retention, storage and destruction of intercepted material (and related
communications data). In a small number of cases the interception agencies had already
started this process due to planned organisational or IT system changes. I discovered that
every agency has a different view on what constitutes an appropriate retention period
for material. Although it is not for me to dictate what that period should be, I am keen to
ensure that retention periods are not arbitrary and that the policies governing this area
are well considered and underpinned by evidence.
6.63 Although my office’s investigation demonstrated that indiscriminate retention
for long periods of unselected intercepted material (content) does not occur and the
interception agencies delete intercepted material (if it is retained at all) after short periods,
and in accordance with section 15(3) of RIPA 2000, I reported that related communications
data are in some instances retained for a variety of longer periods and that I had yet to
satisfy myself fully that some of the retention periods were justified.
6.64 This investigation led my office to make 22 specific recommendations in 2013
and 11 specific recommendations in 2014 for the interception agencies to review or
shorten their retention periods and/or destroy intercepted material and/or related
communications data where there was no persuasive justification provided for its
ongoing retention. A number of the 2014 recommendations were to ensure that the
interception agencies remained focused on the issue, to boost their efforts to review
their retention periods or destroy certain material, and to create a corporate culture of
reviewing regularly and destroying material and data when it is no longer necessary and
proportionate to retain it.
6.65 I can report that all of the recommendations were accepted by the interception
agencies. The large majority have already been fully implemented. This has caused
a significant amount of intercepted material and related communications data to be
destroyed, and in some instances entire systems have been decommissioned. In other
cases the maximum retention periods have been halved. Those agencies which have
not yet managed to implement the recommendations in full are waiting on significant
technical changes to be made to IT systems. I have made clear that future retention and
destruction policies should not be dependent on broad assumptions about the value
of the material or data. Reviews should be conducted regularly, informed by profiling
exercises to ensure that the retention and destruction policies are not arbitrary. I welcome
the progress made and my office will continue to monitor this area of the process.
Inspection Recommendations and Observations
6.66 The total number of recommendations made in our inspection reports for the 9
interception agencies was 69, an average of 8 per interception agency. We also, for the
www.iocco-uk.info
33