48
BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM JUDGMENT
information about the connection, disconnection and reconnection of
services to which the subscriber or account holder is allocated or has
subscribed to (or may have subscribed to) including conference calling, call
messaging, call waiting and call barring telecommunications services, and
potentially static IP addresses;
information about apparatus used by, or made available to, the subscriber
or account holder, including the manufacturer, model, serial numbers and
apparatus codes; and
information provided by a subscriber or account holder to a CSP, such as
demographic information or sign‑up data (to the extent that information,
such as a password, giving access to the content of any stored
communications is not disclosed save where the requirement for such
information is necessary in the interests of national security).
...
2.35. Additional types of data may fall into the category of subscriber information,
as communications services have developed and broadened, for example where a CSP
chooses to collect information about the devices used by their customers. Prior to the
acquisition of data which does not fall into the illustrative list of traditional subscriber
information above, specific consideration should be given to whether it is particularly
sensitive or intrusive, in order to ensure that such a request is still necessary and
proportionate, and compliant with Chapter II.
Further Guidance on Necessity and Proportionality
2.36. Training regarding necessity and proportionality should be made available to
all those who participate in the acquisition and disclosure of communications data.
Necessity
2.37. In order to justify that an application is necessary, the application needs as a
minimum to cover three main points:
the event under investigation, such as a crime or vulnerable missing person;
the person, such as a suspect, witness or missing person, and how they are
linked to the event; and
the communications data, such as a telephone number or IP address, and
how this data is related to the person and the event.
2.38. Necessity should be a short explanation of the event, the person and the
communications data and how these three link together. The application must
establish the link between the three aspects to be able to demonstrate the acquisition
of communications data is necessary for the statutory purpose specified.
Proportionality
2.39. Applications should include an outline of how obtaining the data will benefit
the investigation or operation. If more than one item of data is being sought, the
relevance of the additional data should be explained.
2.40. This should include explaining how the level of intrusion is justified when
taking into consideration the benefit the data will give to the investigation. This
justification should include confirmation that relevant less intrusive investigations
have already been undertaken where possible. For example, the subscriber details of a