intercepted material is retained, it should be reviewed at appropriate
intervals to confirm that the justification for its retention is still valid
under section 15(3) of RIPA.
7.9. Where an intercepting agency undertakes interception under a
section 8(4) warrant and receives unanalysed intercepted material and
related communications data from interception under that warrant,
the agency must specify (or must determine on a system by system
basis) maximum retention periods for different categories of the data
which reflect its nature and intrusiveness. The specified periods
should normally be no longer than two years, and should be agreed
with the Interception of Communications Commissioner. Data may
only be retained for longer than the applicable maximum retention
periods if prior authorisation is obtained from a senior official within
the particular intercepting agency on the basis that continued
retention of the data has been assessed to be necessary and
proportionate. If continued retention of any such data is thereafter
assessed to no longer meet the tests of necessity and proportionality, it
must be deleted. So far as possible, all retention periods should be
implemented by a process of automated deletion, which is triggered
once the applicable maximum retention period has been reached for
the data at issue.
Personnel security
7.10. All persons who may have access to intercepted material or need
to see any reporting in relation to it must be appropriately vetted.
On an annual basis, managers must identify any concerns that may
lead to the vetting of individual members of staff being reconsidered.
The vetting of each individual member of staff must also be
periodically reviewed. Where it is necessary for an officer of one
agency to disclose intercepted material to another, it is the former’s
responsibility to ensure that the recipient has the necessary clearance.
43