Report of the Interception of Communications Commissioner - July 2016
are subject to the disclosure provisions of the Criminal Procedure and Investigations Act
(CPIA) 1996). The same is not the case for the intelligence agencies as their systems in
general do not separate out intercepted material from other types of intelligence which
we have no statutory function to oversee. We have made arrangements to view the
applications electronically in one of the intelligence agencies and later in the report we
set out a number of changes that we will make to the inspection regime in 2016 to bring
about increased scrutiny and oversight to other parts of the process.
6.57 Retention, storage and deletion of intercepted material and related
communications data. Each interception agency has a different view on what constitutes
an appropriate retention period for intercepted material and related communications
data. There is no period prescribed by the legislation, but the agencies must comply with
section 15(3) of RIPA which provides that the material or data must be destroyed as soon
as there are no longer any grounds for retaining it as necessary for any of the authorised
purposes in section 15(4) of RIPA.
6.58 In 2013/14 we conducted an audit of the retention, storage and deletion of
intercepted material and related communications data during which we examined
the interception agencies’ systems and policies in place.36 This audit concluded that
indiscriminate retention for long periods of unselected intercepted material (content) does
not occur and that the interception agencies delete intercepted material (if it is retained
at all) after short periods, and in accordance with section 15(3) of RIPA. We identified
that related communications data are in some instances retained for a variety of longer
periods and made 22 recommendations in 2013 and 11 in 2014 for the interception
agencies to review or shorten their retention periods and / or destroy intercepted
material (and related communications data) where there was no persuasive justification
provided for its ongoing retention. We can report that all of the recommendations have
now been implemented by the interception agencies. The recommendations caused a
significant amount of material and related communications data to be destroyed, and in
some instances entire systems have been decommissioned.
6.59 The majority of content is reviewed and automatically deleted after a short period
of time unless action is taken to retain the content for longer because it is necessary
to do so. The retention periods for selected content differ within the interception
agencies but range from between 30 days to one year. The retention periods for related
communications data also differ within the interception agencies but range from between
six months and one year.
6.60 It is important for the agencies’ retention and destruction policies to not be
dependent on broad assumptions about the value of the material or data. Reviews should
be conducted regularly, informed by profiling exercises to ensure that the retention and
destruction policies are not arbitrary. On an annual basis we require an update on any
changes to the retention, storage and deletion arrangements for systems containing
intercepted material and related communications data. In 2015 a number of interception
36 See Paragraphs 3.48 to 3.57 of our 2013 annual report http://www.iocco-uk.info/docs/2013%20
Annual%20Report%20of%20the%20IOCC%20Accessible%20Version.pdf and Paragraphs 6.60 to 6.65 of
the 2014 Annual Report http://iocco-uk.info/docs/IOCCO%20Report%20March%202015%20(Web).pdf
30
@iocco_oversight