The publication of the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015 ({SI 2015/355: http://www.legislation.gov.uk/uksi/2015/355/contents/made}) was greeted with a great deal of publicity on 25 February. I am not sure all the coverage was accurate; Chris Evans on Radio 2 told me that cold-calling was to end, and that those responsible for making such calls would be locked up in jail. I have struggled to find the basis for that claim in the amendment regulations themselves but this is one context where there is something in the ‘all publicity is good publicity’ cliché. After all, you would have been hard pressed not to know something had happened in this area even if the full purpose of the amendments has been rather glossed over. Did you know that they cover exceptions for emergency alerts (which look distinctly Orwellian to me) and amend the Data Protection Act 1998, s 55E as well as the much publicised lowering of the monetary penalty threshold in s 55A? (Neil Brown has a useful, but unofficial, mark-up of s 55A as amended {here: http://neilzone.co.uk/s55A_Data_Protection_Act_1998.pdf}.)
{b}Criminal Justice and Courts Act 2015{/b}
Still at least those amendments are coming into force soon (6 April) – that is clear and understandable. The other much publicised recent change has to be the criminalisation of revenge porn – which tends to have a social media link even though not strictly IT law. I lost patience with the number of times I read that it had now been made a crime. The references were always to the Criminal Justice and Courts Act 2015, {ss 33 to 35: http://www.legislation.gov.uk/ukpga/2015/2/section/33/enacted}, which are not yet in force. But it’s tricky to explain to the average person that Parliament has determined that certain behaviour is so injurious that it should be made a crime, and the Act received Royal Assent on 12 February (and so is ‘law’), but Parliament also decided that that there’s no hurry – it is happy to let ministers decide when the time is ripe for that law to have effect. It gets even harder to gain understanding if you point out that most of the behaviour that people associate with ‘revenge porn’ was a crime under existing legislation. And you need to keep people in a locked room in order to explain to them that ss 33 to 35 don’t have much to do with revenge or porn. I would expand on that point (and {have before: http://www.scl.org/site.aspx?i=bp39075} but when I got to the point of explaining that pictures of me naked taken from the field opposite would be covered by the new provisions, though they would be of the horror genre rather than a porn flick, the people in the locked room broke the door down – so I imagine you have had enough too. The most shocking thing about ss 33 to 35 is that the MoJ, the very body that could bring the provisions into force but has yet to do so, has claimed credit for making revenge porn illegal, stating (on 12 February) ‘Revenge porn has been made a criminal offence by the Ministry of Justice (UK). This means those who share private, sexual images of someone, without consent and with the intent to cause distress, will now face up to two years in prison.’ Not content with the inaccuracy of the ‘now’ (a typo for ‘some day’?) and the highly dubious revelation that this law was made by the Ministry not Parliament, the MoJ has even had the cheek to have a ‘Say No to Revenge Porn’ campaign while not finding time to draft a commencement order for ss 33 to 35. No wonder people are confused.
There are a number of other matters to note in the Criminal Justice and Courts Act 2015.
• Section 127 of the Communications Act 2003 (improper use of public electronic communications network) is amended so as to allow proceedings in a magistrates’ court to be commenced after a much longer period than was previously the case, namely within three years of the day on which the offence was committed, but a six-month time-limit still applies from the date when a prosecutor first became aware of sufficient evidence to justify proceedings (see {s 51: http://www.legislation.gov.uk/ukpga/2015/2/section/51/enacted} – not yet in force).
• {Sections 69 to 72: http://www.legislation.gov.uk/ukpga/2015/2/section/69/enacted} make provision aimed at reducing the likelihood of jurors researching a case or the background of the defendant on the Internet. There is power to confiscate ‘electronic communications devices’ and researching a case is made a specific offence. And it is not just checking out the defendant’s past convictions which is barred – carrying out a Google search to clarify court procedure or evidence points raised in a case could leave a juror liable to two years’ imprisonment (see {s 71: http://www.legislation.gov.uk/ukpga/2015/2/section/71/enacted}). These provisions are not yet in force but I understand that they may be brought into force in April.
• Schedule 15 makes special provision for ‘persons providing information society services’ in respect of new reporting restrictions that, when brought into force, will include lifetime reporting restrictions. These may be a minefield for ISPs but sch 15 offers them very considerable protection.
{b}Counter-Terrorism and Security Act 2015{/b}
This Act also received Royal Assent on 12 February. {Section 21: http://www.legislation.gov.uk/ukpga/2015/6/section/21/enacted} amends s 2(1) of the Data Retention and Investigatory Powers Act 2014 (temporary provision about the retention of relevant communications data subject to safeguards: definitions). The reality behind the apparently trivial amendment of the definitions that apply has been covered at the Bill stage in {an article by Rosemary Jay: http://www.scl.org/site.aspx?i=ed40676} (see section 8 of the article). Those amendments came into force on Royal Assent. As Rosemary put it:
“{i}The amendments would extend the definition of communications data to include information related to internet access service or an internet communications service which:
{/i}’…may be used to identify, or assist in identifying, which internet protocol address, or other identifier, belongs to the sender or recipient of a communication’.{i}
It would exclude data which only show the identity of the communications service through which the communication is transmitted or data that are processed in the course of providing the service. It would however, taken with the extension of the definition of telecommunications service in DRIPA (see 6.1 above), extend the range of data which could be subject to retention notices and subsequent access under RIPA. As such, it would mark a step towards meeting the aims of the Government to extend the scope of the data available for investigation without the need to bring forward specific legislation.{/i}”
{b}Serious Crime Act 2015{/b}
Although this Act does not yet exist (it was supposed to have Royal Assent by now but they are still fiddling with the Bill), it will very shortly become an Act. IT lawyers will need to be aware of some important changes.
Chapter 4, Part 2 consists of a series of amendments to the Computer Misuse Act 1990 which are supposed to update existing offences to ensure sentences for attacks on computer systems deemed to have damaged national security, human welfare, the economy or the environment reflect the damage they cause. It transposes the EU Directive on attacks against information systems into UK law. These changes have attracted relatively little attention, although the 1990 Act has always seemed to be a much neglected piece of legislation. But I would have thought that the proposed s 3ZA(1)(d) and (2)(d) might have got the occasional mention in the GCHQ/NSA context (broadly, unauthorised acts damaging the national security of {i}any{/i} country) and in relation to dissident foreign groups. This is an offence that carries a maximum sentence of 14 years’ imprisonment so the North Koreans and Russians may be interested. The changes re the territorial reach of the 1990 Act may be of interest too – all sorts of hidden dangers there. Computer misuse offences also get ‘upgraded’ so that they now qualify for serious crime prevention orders.
There are also new provisions protecting the anonymity of victims of female genital mutilation; the usual protection for providers of information society services applies but it is another area where ISPs need to be alert. Similar protection for ISPs and the like arises in relation to the newly created offence of possessing any item that contains advice or guidance about abusing children sexually
Although still subject to possible amendment, there are provisions relating to ‘sexual communication with a child’ that social media lawyers and Internet lawyers should be aware of. While other forms of communication are covered, most of the offences under the new s 15A of the Sexual Offences Act 2003 are likely to spring from Facebook and chatrooms. The intent is to move on from having to prove sexual grooming, where at least two meetings or communications have to be proved; under s 15A, any single communication of a sexual nature from a person aged over 18 to a person aged under 16 if the communication is ‘for the purpose of obtaining sexual gratification’ is likely to constitute an offence.
{b}Regulation of Investigatory Powers (Communications Data) (Amendment) Order 2015 (SI 2015/255){/b}
This Order is hardly on the same scale as the earlier items but remains of interest. The Order adds an additional allowable purpose for the obtaining of communications data under RIPA. The effect is that the Financial Conduct Authority and Prudential Regulation Authority may obtain communications data for the purpose of exercising functions relating to the regulation of financial services and markets or to financial stability. More strikingly, it removes 13 public authorities from the list in the Regulation of Investigatory Powers (Communications Data) Order 2010 of those who may grant an authorisation or give a notice in respect of the acquisition and disclosure of communications data, for the purposes of Chapter 2 of Part 1 of the Regulation of Investigatory Powers Act 2000. The 13 delisted authorities include the Department of the Environment, the Department for Business, Innovation and Skills, the Charity Commission and the Food Standards Agency. I was a bit shocked to discover that the Charity Commission ever had these powers!
