The Home Office has published a Code of Practice for Communications Data setting out how public authorities can acquire and retain communications data under Parts 3 and 4 of the Investigatory Powers Act 2016.
The Code runs to 137 pages and is split into four sections covering (broadly):
Introduction: this defines who is covered (such as where telecommunications is not the primary operation of an organisation) and what is communications data (for example the who, when etc not the ‘what was written’)
Communications data acquisition and disclosure: covers the power to authorities to acquire data, the considerations for when it is necessary, the application process and duration of authorisations
Communications Data retention: sets out the powers to make an organisation retain its data, the notice process, the retention period and security or destruction of retained data
General Matters: costs, record keeping, who oversees the process and the complaints procedure
The Introduction also makes clear that failure to comply with the Code does not make a person liable to criminal or civil proceedings but the code is admissible in evidence in related legal proceedings.
The full Code of Practice is available on the Home Office website.
