Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025

Considered in Grand Committee

Moved by

That the Grand Committee do consider the Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025

My Lords, it is a pleasure to be here today to bring forward these regulations, which are enabled by the Investigatory Powers Act 2016, during the passage of which some nine years ago I recall sitting for many hours. The IPA provides a framework designed to protect the public by giving law enforcement and the intelligence services the tools they need to prevent, detect and prosecute crime. It also safeguards the privacy of individuals by setting out stringent controls over the way the IPA powers are used.

Communications data reveals the who, where, when and how of a communication but not, I emphasise, its content, such as what was written or said. CD is routinely relied on as evidence in 95% of serious organised crime investigations and has played a significant role in every major terrorism investigation over the past decade.

These regulations will update the public authorities listed in Schedule 4. Only those public authorities listed in the schedule are permitted to use the CD powers in the Act and therefore have the authority to compel communications data from telecommunications or postal operators. In addition to this safeguard, Part 3 of the IPA sets out the specific statutory purposes for which the communications data may be acquired by the relevant public authorities. The Communications Data Code of Practice provides guidance on the process of making a Part 3 application under the Act, which ensures that the power is used only when it is both necessary and proportionate. The IPA requires public authorities to have regard to the code in the exercise of their functions.

These regulations add 11 new entries to the schedule: the Intellectual Property Office, an executive agency sponsored by the Department for Science, Innovation and Technology; the Driver & Vehicle Standards Agency, an executive agency sponsored by the Department for Transport; the Security Industry Authority, an executive non-departmental public body sponsored by my department, the Home Office; Counter Fraud Services Wales, an organisation hosted by the Velindre University NHS Trust; the integrated corporate services counter fraud expert services team—a bit of a mouthful—situated within the Department for Business and Trade; the integrated corporate services counter fraud expert services team situated within the Department for Energy Security and Net Zero; the counter fraud and investigation team situated within the Department for Environment, Food and Rural Affairs; and the South East Coast Ambulance Service, the North West Ambulance Service, the West Midlands Ambulance Service and the East Midlands Ambulance Service.

Except for the four ambulance trusts, the public authorities to be added are all new entrants to the schedule and to CD powers. Following their addition to Schedule 4, the seven newly added public authorities will be able to apply for an independently approved authorisation via the Investigatory Powers Commissioner’s Office, which, if granted, can be used to compel tele- communications or postal operators to disclose CD for the purposes set out within their designation in Schedule 4. They will not be given the power to internally authorise CD applications.

My Lords, I will not detain noble Lords for long. I have three questions for the Minister. First, I want a little detail on the process that is undertaken by the department. Who triggers the review into which organisations have these powers, whether that is as a result of requests from organisations that currently do not have powers but require them or whether it is a periodic review that the department will undertake? It would be helpful to know a bit more about the process.

Secondly, I have a question on the powers that are now given to the Driver & Vehicle Standards Agency, which is an executive agency of the Department for Transport. I have looked at those powers and at the other parts of the Department for Transport that have similar powers. They all seem very sensible, so I support the change that is being made. My question is on the Driver & Vehicle Licensing Agency, which is another executive agency of the Department for Transport. As far as I can tell, it does not have these powers, but I would have thought that the same arguments that apply to the DVSA—around public safety and the criminality involved in, for example, forging driving licences, which are important identity documents—would also require the use of communications data. Why has the DVSA been given these powers and not the DVLA? Surely the arguments for one are also true in the case of the other.

The other area is that provoked by the report from the Secondary Legislation Scrutiny Committee on the arguments around the ambulance trusts. It makes a reasonably coherent argument that there seems to be some inconsistency. I understand that organisations that require these powers must demonstrate that they have a compelling need and that they have appropriate compliance activities in place. It seems a little odd, therefore, that the powers are being removed from all the ambulance trusts in England. They are being restored for four of them but I do not understand, because there is no detail set out, what it is about those four that means that there are compelling needs that do not apply to the others. Also, of the four that are kept, only one had requested to keep the powers; the others had not expressed a preference. Given that organisations are supposed to have a compelling need in order for them to have these powers—I remember the debate when, as the Minister set out, the Investigatory Powers Bill was going through both Houses of Parliament; I was Chief Whip at the time—it seems to me that, in the case of three of those ambulance trusts, the compelling need case cannot have been made because they did not respond to say that they needed the powers. The powers appear to have been left with them only because they had not specifically said that they did not want them, but that does not appear to be the legal and policy test applied by the department. I would be grateful if the Minister could set that out.

My Lords, I thank the Minister for his informed and expert introduction to these timely regulations. When he and I were serving in another place, we were contiguous neighbours; I saw how he was ubiquitous, conscientious, much liked and very successful as an elected Member.

Like the Minister, I spent many years as a member of the Intelligence and Security Committee. The committee saw a lot of the security services and high-ranking police officers—understandably so. In all this, the Investigatory Powers Commissioner was, justifiably, for ever lurking in the background. He was very much a wise, reflective, independent person of stature, as the committee thought. Paragraph 2.2 of the Explanatory Memorandum refers to Lucy Montgomery-Pott, a deputy director for the investigatory powers unit. They are truly an important person in all this.

Not so long ago, as members of a Joint Committee, we crossed south of the river for a briefing by the then commissioner of the Metropolitan Police. Alongside him was a future commissioner of the Met. The commissioner had assembled the very people who, under direction, exercised those then new powers. We talked to them and noted professionalism and reassuring ordinariness. It was police and Parliament at work together for the common good.

I support these regulations and wish the professionals well, though I think, in all seriousness, that a parliamentary democracy and its security services need always to consider each other very seriously. Arguably they will never sit together easily, because we are a democracy. I speak today as a matter of principle to formally challenge the Executive, in the person of the Minister, who propose orders and regulations. Time is of the essence and the temperature is high, but my formal questions are these. Who is the Investigatory Powers Commissioner? What is the length of his service and what might be his contract? Will you declare the annual money or fees he draws for his most honourable services? Presumably he is from the field of law, but what is his expertise and how many staff serve in his office? Again, I thank the Minister for his introductory remarks.

My Lords, we on this side recognise the Government’s intention to update the Investigatory Powers Act introduced by the previous Government, and we are supportive of introducing measures that protect the public by giving law enforcement the tools they need to prevent and prosecute crime.

As noble Lords across the Committee are aware, technology is a fast-moving space. As society’s use of technology changes, it is essential that we adapt and it is imperative that our public authorities are fully equipped with capabilities to prevent criminals exploiting technology features, hiding their identity, evading detection and putting the public at risk.

This statutory instrument amends the Investigatory Powers Act by providing 11 new public authorities with the power to obtain communications data. Seven of the new public authorities listed will have the power to apply for an independently approved authorisation to compel telecommunications and postal operators to disclose communication data. The remaining four entries are English ambulance trust services that were previously designated under the definition of an ambulance trust in England, which included a total of 10 ambulance services in England. Under the changes, this definition has been removed and replaced with individual entries, as six of these ambulance services have confirmed they no longer require the communication data powers.

Following the Home Office’s review of Schedule 4, this instrument ensures that only public authorities with a need to acquire communications data will be able to request access. While we on these Benches do not oppose the amendments being made, we must question why certain ambulance services will hold the ability to retain this power over other ambulance services.

We recognise that some ambulance services should retain these powers, which may help in preventing serious injury or death, but we must consider whether the inconsistent treatment of ambulance services presents any future risks. We understand that access to communications data is useful for some ambulance services, but we must not rule out that others might require access in future. Can the Minister assure us that services requiring access in future will not be unduly limited or delayed if judged to be in the pursuit of legitimate public interest?

I am grateful to noble Lords for the short and useful debate. As my noble friend Lord Jones, who I have known for a very long time, said, it is useful to challenge the Executive on a number of matters to date.

If I may, I will start with my noble friend Lord Jones, who made an all-encompassing comment regarding the Investigatory Powers Commissioner. The current IPC is Sir Brian Leveson. He will be well known to Members of this House and has served in a number of capacities, including as a High Court judge. The commissioner is assisted by a team of 13 commissioners, who must all have held senior judicial office. Together they are responsible for the use of investigatory powers by public authorities. They are supported by a body of civil servants, known as the Investigatory Powers Commissioner’s Office, which includes authorising officers and inspectors. Self-evidently, as I mentioned earlier, they were put in place by the Investigatory Powers Act 2016. Their responsibilities include a statutory obligation to inspect the use of certain investigatory powers and to exercise delegated functions, as part of which they independently review communications data under Section 60A applications submitted by public authorities.

My noble friend touched on a point raised by the noble Lord, Lord Harper, and the noble Lord, Lord Davies of Gower, on the budget. In the financial year 2023-24, the Investigatory Powers Commissioner’s Office operated within a budget of £15.74 million, of which it spent only £13.06 million. That was confirmed in the IPCO annual report 2023, which was published in May of this year. I hope that helps my noble friend.

I am grateful for his service, not just in both Houses but on the Intelligence and Security Committee, and for his kind words about my service. I hope that also answers in part the points made by the noble Lord, Lord Harper—who I will come back to in a moment—and the noble Lord, Lord Davies of Gower.

I would be grateful if the Minister would allow me to probe this a bit further. To be clear, on the ambulance trust, given that the wide-ranging power for all ambulance trusts in England already existed in the schedule, what exactly was the trigger for a consultation? These trusts already had the power; this just changes the way the power has been described in the legislation. Further, if there was some kind of interaction between the trusts and the department and some trusts specifically asked for this, for those that did not, given that there was a conversation and a consultation process and there is supposed to be a compelling need, why has the power been left in place for those ambulance trusts that did not say they needed it?

The noble Lord puts his finger on the point that, originally, all ambulance trusts were included in the schedule. As part of their general reflection, the six English ambulance trusts that are being removed by the regulations today specifically said they do not need those powers anymore. That left Scotland, Wales and Northern Ireland. Scotland and Wales equally said they do not want the power, so they are being removed, and Northern Ireland has not requested removal and therefore is in the schedule.

Of the four remaining trusts, one of them determined that it wanted to retain the powers under the Act. Again, as part of the consultation, that went through the Investigatory Powers Commissioner’s Office, which agreed. Three of the trusts did not respond to the Home Office in relation to the consultation and discussion that we had. They had not requested to be removed. We asked them if they wanted to stay on, and they have not responded. For the safety of the Home Office’s reputation and for the security of reducing risks, we have left them on, but we will continue to press them to ensure that, if they wish to be removed, they can be.

I have discussed already with officials that I think we should be going back to those trusts again. We can bring a further instrument forward, but I do not think it is appropriate that we take them off because they have not responded. There is an argument about whether they should have responded—that is a legitimate challenge to put to me and to the Home Office, and I am having discussions on it internally—but I do not want to take them off in case that decision was just a slip between cup and lip.

I am grateful for that answer. I can certainly understand—and do not necessarily disagree with—a safety-first approach from the Minister. I have one further question: given that ambulance trusts broadly all do the same thing, has the Home Office or the health service undertaken any work to understand for what reasons those trusts that have wanted to keep the powers are using those powers, to test whether they are actually necessary? If they are necessary, for what reason do those trusts that do not want the powers, or have not asked for them, not need them? It does not seem entirely obvious why some ambulance trusts would need the powers and some would not.

That is a fairly valid challenge. The decision to apply is for the ambulance trusts. They were initially all included. Some have determined that they have not used this power, and therefore they do not wish to have it any more. One trust has maintained the power because it wishes to use it, and three have not responded, so we have kept them on just in case because we do not want to risk operational errors.

The type of purpose that they could use it for may well be, for example, that an individual who comes into contact with the ambulance trust is in the middle of a mental health episode, is disorientated, does not know who they are and is not aware of where they are, what they have done or where they have been. There could be individuals who are involved in alcohol intoxication. There is a range of reasons why there might need to be access. As it happens, the vast majority of trusts have said they do not need or want this power. If one trust has said it wants to retain the power, it is reasonable that we assess that further downstream. But the determination is that the trusts themselves decide whether they want that power. Therefore, we are making sure that there are no operational risks in that.

On removing the authorities that did not respond, I am not particularly pleased that we did not have a response from three authorities—I will put that on the record. They should respond accordingly. But there is always the danger that, if we took them off now, they may end up using their powers without realising they do not have them any more. They may find themselves in a litigious position, and I do not want to see that either.

For the moment, that is a very valid challenge and this should be kept under review, but that is the logic behind it—if that helps the noble Lord.

In case it may help, I was involved in the original RIPA 2000 and discussions about this. I remember the whole thing about ambulances. The reason it was thought of then was vexatious 999 calls to the ambulance service. Obviously, that had happened somewhere, but, clearly, it does not happen in many areas, so they do not need this training. But, if it does happen in some areas, it is quite reasonable that it should be retained somewhere just in case, because it may need tidying up. It will probably depend on whether there are particular individuals in certain areas, and you may need to give the powers and take them away again. I seem to remember that that was one of the main reasons we gave it in the first place.

I am grateful to the noble Earl for that intervention. The decision that the Home Office has taken is that it is for organisations to apply. With the ambulance trusts, once we have determined that we will remove the general exemption—because organisations have requested removal—we are then in a position to allow them to do that. Both noble Lords have made fair challenges on the assessment and oversight of that. Ultimately, the Investigatory Powers Commissioner is the determinant of that matter, and I am facilitating that process today.

The noble Lord, Lord Harper, mentioned the Driver and Vehicle Standards Agency, and asked why the DVLA was not included. This may or may not be helpful, but the DVSA asked for it and the DVLA did not. There may be a discussion around whether “government” should be encouraging certain agencies to do so, but that is the position as of now. That is why one has, and one has not, been included. I hope that is of assistance to the noble Lord.

I have probably covered all the issues raised by noble Lords in the Committee. The noble Lord, Lord Davies of Gower, discussed the resourcing of the Investigatory Powers Commissioner and his office. Under Section 238(2) of the Act, the Home Secretary is required to consult the IPC regarding funding to ensure that the independent officer is able to carry out their vital oversight functions. As I mentioned in response to my noble friend Lord Jones and the noble Lord, Lord Harper, only £13.06 million of the £15.74 million budget set was spent in the last financial year for which we have records. Self-evidently, there is some headroom.