76
4.15
A Democratic Licence to Operate
The DPA 1998 does not provide an absolute right to data privacy, but it does introduce
a number of important safeguards to ensure data is appropriately handled by
organisations. An exemption from the full requirements of the DPA 1998 exists in certain
circumstances, such as where national-security interests are engaged (Section 28). The
national-security exemption applies to any or all of the substantive provisions of the
DPA 1998 and can be relied on so far as the exemption is required for the purpose of
safeguarding national security.
The Regulation of Investigatory Powers Act 2000
4.16
The ability of public-sector organisations to intercept communications has been on a
statutory footing since the Interception of Communications Act 1985. However, this Act
primarily concerned communications sent by post or fixed-line public-telecommunication
systems, and the rapid changes in telecommunications in subsequent years, coupled with
decisions by the European Court of Human Rights, prompted a government consultation
in 1999. RIPA 2000 was enacted the following year, providing a legal basis for the lawful
interception of communications and access to communications data, surveillance
and the use of undercover agents and informers (also known as CHIS), and access to
protected data.
4.17
There was also a need to establish new legislation in light of the requirements of the
HRA 1998 and, in particular, the interference with an individual’s right to privacy through
intercepting the content of their communications. RIPA 2000 sets out the possible
justifications for such interception, namely: in the interests of national security; for
the purpose of preventing or detecting serious crime; for the purpose of safeguarding
the economic well-being of the UK in circumstances relating to national security
(as amended).5
4.18
One of the fundamental principles guiding RIPA 2000 is that a distinction can be made
between communications data and content, with acquisition of the former considered
less intrusive to an individual’s privacy than the latter. Authorisations for the acquisition
and disclosure of communications data are therefore issued by designated persons
within the organisation seeking the data. However, in order to gain access to the actual
content of a communication (for example, the text of an e-mail message or a telephone
conversation), a warrant issued by the secretary of state is generally required.6
4.19
A second principle of RIPA 2000 is that there is a difference between ‘internal
communications’ (that are both sent and received in the British Isles) and ‘external
communications’ (in which the sender and/or recipient are outside the British Isles).
There are therefore two types of interception warrant for which the individuals listed
5.
6.
Philip Ward and Alexander Horne, ‘Interception of Communications’, House of Commons
Note, SN/HA/6332, 2015, p. 3.
Ibid., p. 1. Under the Police and Criminal Evidence Act, content can also be requested via a
judicial warrant.