32
BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM JUDGMENT
material may be disclosed as the recipient needs. For example, if a summary of the
intercepted material will suffice, no more than that should be disclosed.
7.4. The obligations apply not just to the original interceptor, but also to anyone to
whom the intercepted material is subsequently disclosed. In some cases this will be
achieved by requiring the latter to obtain the originator’s permission before disclosing
the intercepted material further. In others, explicit safeguards are applied to secondary
recipients.
7.5. Where intercepted material is disclosed to the authorities of a country or
territory outside the UK, the agency must take reasonable steps to ensure that the
authorities in question have and will maintain the necessary procedures to safeguard
the intercepted material, and to ensure that it is disclosed, copied, distributed and
retained only to the minimum extent necessary. In particular, the intercepted material
must not be further disclosed to the authorities of a third country or territory unless
explicitly agreed with the issuing agency, and must be returned to the issuing agency
or securely destroyed when no longer needed.
Copying
7.6. Intercepted material may only be copied to the extent necessary for the
authorised purposes set out in section 15(4) of RIPA. Copies include not only direct
copies of the whole of the intercepted material, but also extracts and summaries which
identify themselves as the product of an interception, and any record referring to an
interception which includes the identities of the persons to or by whom the intercepted
material was sent. The restrictions are implemented by requiring special treatment of
such copies, extracts and summaries that are made by recording their making,
distribution and destruction.
Storage
7.7. Intercepted material and all copies, extracts and summaries of it, must be
handled and stored securely, so as to minimise the risk of loss or theft. It must be held
so as to be inaccessible to persons without the required level of vetting. This
requirement to store intercept product securely applies to all those who are responsible
for handling it, including CSPs. The details of what such a requirement will mean in
practice for CSPs will be set out in the discussions they have with the Government
before a Section 12 Notice is served (see paragraph 3.13).
Destruction
7.8. Intercepted material, and all copies, extracts and summaries which can be
identified as the product of an interception, must be marked for deletion and securely
destroyed as soon as possible once it is no longer needed for any of the authorised
purposes. If such intercepted material is retained, it should be reviewed at appropriate
intervals to confirm that the justification for its retention is still valid under
section 15(3) of RIPA.
7.9. Where an intercepting agency undertakes interception under a section 8(4)
warrant and receives unanalysed intercepted material and related communications
data from interception under that warrant, the agency must specify (or must determine
on a system by system basis) maximum retention periods for different categories of
the data which reflect its nature and intrusiveness. The specified periods should
normally be no longer than two years, and should be agreed with the Interception of
Communications Commissioner. Data may only be retained for longer than the
applicable maximum retention periods if prior authorisation is obtained from a senior
official within the particular intercepting agency on the basis that continued retention