Draft Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025
(Limited Text - Ministerial Extracts only)
Read Full debate
The Minister for Security (Dan Jarvis)
I beg to move,
That the Committee has considered the draft Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025.
It is a pleasure to serve under your chairmanship, Dr Murrison. The regulations are enabled by the Investigatory Powers Act 2016. The IPA provides a framework for the use and oversight of investigatory powers by our intelligence services, law enforcement and other public authorities. It is designed to protect the public by giving law enforcement the tools it needs to prevent and prosecute crime. In this context, it also safeguards the privacy of individuals by setting stringent controls over the way IPA powers are authorised and overseen.
Part 3 of the IPA sets out the public authorities that are permitted to acquire communications data, or CD, and under what statutory purposes CD may be acquired. CD reveals the who, where, when and how of a communication, but not its content, such as what was written or said. CD is routinely used as evidence in upwards of 95% of serious organised crime investigations and has played a significant role in every major terrorism investigation over the past decade. The data is vital evidence in criminal and national security investigations.
The relevant public authorities that are permitted to use CD powers, and that therefore have the authority to make a request to compel CD from telecommunication and postal operators, are listed in schedule 4 to the IPA. As technology and society’s use of technology change, it is important that we adapt and equip public authorities with the capability to prevent criminals from exploiting technology features, hiding their identity, evading detection and putting the public at risk.
The regulations will update the public authorities listed in schedule 4. Updating the schedule ensures that only those public authorities that need powers to acquire CD remain listed in the schedule. In addition to this safeguard, the communications data code of practice provides guidance on the processes associated with making an application to use the power, as well as the safeguards and oversight arrangements that will ensure that the power is used in the intended manner: in a targeted way, and only when necessary and proportionate. The CD code has statutory force, and individuals exercising functions to which the code relates must have regard to it.
Eleven entries will be added to the schedule. The entries relate to the Intellectual Property Office, an executive agency sponsored by the Department for Science, Innovation and Technology; the Driver and Vehicle Standards Agency, an executive agency sponsored by the Department for Transport; the Security Industry Authority, an executive non-departmental public body sponsored by the Home Office; NHS Counter Fraud Service Wales, an organisation hosted by the Velindre University NHS Trust; the integrated corporate services counter fraud expert services team in the Department for Business and Trade; the integrated corporate services counter fraud expert services team in the Department for Energy Security and Net Zero; and the counter fraud and investigation team in the Department for Environment, Food and Rural Affairs. The following ambulance services will also be added: the South East Coast ambulance service, the North West ambulance service, the West Midlands ambulance service and the East Midlands ambulance service.
Except for the four ambulance trusts I have just mentioned, the public authorities to be added are entirely new entries to the schedule and CD powers. Following their addition to schedule 4, the seven newly added public authorities will be able to apply for an independently approved authorisation via the Investigatory Powers Commissioner’s Office that, if granted, can be used to compel telecommunications and postal operators to disclose CD for the purposes set out within their designation in schedule 4. They will not be given the power to internally authorise CD applications.
The four entries relating to the English ambulance trusts were previously designated in schedule 4 under the umbrella definition of
“An ambulance trust in England”,
which included a total of 10 English ambulance trusts. That definition has been removed and replaced with the four individual entries. Therefore, six English ambulance trusts will be removed from schedule 4 having confirmed with the Home Office that they no longer require CD powers. The four English ambulance trusts remaining in the schedule are the South East Coast ambulance service, the North West ambulance service, the West Midlands ambulance service and the East Midlands ambulance service. Those trusts will retain their CD powers, including the ability to authorise internal applications.
The Welsh Ambulance Services NHS Trust and the Scottish ambulance service board will also be removed from schedule 4, having confirmed with the Home Office that they no longer need to retain their CD powers. The regulations make no change to the Northern Ireland ambulance service or its designation in the schedule.
The regulations will amend the Insolvency Service’s designation to include the Department for Business and Trade, following machinery of Government changes. There is no change to the Insolvency Service’s ability to acquire CD for the purposes already listed in schedule 4. As part of our effort to ensure the continued operational utility of the IPA, the regulations will make necessary and vital changes to schedule 4.
To conclude, the changes will enable various public authorities to carry out and fulfil their essential statutory duties, including safeguarding the public from national security threats and criminal activity. I therefore commend the regulations to the Committee.
Kit Malthouse (North West Hampshire) (Con)
It is a great pleasure to appear before you for the first time, Dr Murrison. I do not want to detain the Committee too long, but I have a couple of questions.
Obviously, I am familiar with this legislation, having served at the Home Office. We should be under no illusion: the powers that we are extending today are actually very intrusive. While the Minister is absolutely right, for example, that there is not a single murder in this country that is not solved without this kind of data, the extension of these powers to the organisations named in the regulations is broadly what was predicted by critics of the Investigatory Powers Bill when it was introduced in 2016. Slowly but surely, they said, everybody would grab these powers just in case they needed them. As Members of Parliament, whose job it is to balance the rights of the public against the Government’s ability to intrude on them, we need to think carefully about whether what we are doing today is proportionate.
My first question, which troubled me when I was at the Home Office, is about the internal conflict for the commissioner. The way that the Act is drawn, the commissioner both authorises and supervises. Although the commissioner is responsible to Parliament and produces reports to it, I am not entirely sure that the commissioner should effectively be both judge and jury on whether an organisation should have authorisation and therefore, presumably, whether its internal structures for controlling and managing the data are satisfactory. One would have thought that in normal circumstances there would be some separate authorisation system that was then assessed to be adequate by the commissioner. That conflict causes me some problems, and I would be interested in the Minister’s comments on it.
My second question is about the use case, which was raised by both the hon. Member for South West Devon and the hon. Member for Sutton and Cheam. It seems odd that some ambulance services are saying, “We don’t actually need this,” but others are saying that they do. What is special about the East Midlands ambulance service that means it needs to retain this power? It would be interesting to understand the use cases for all these organisations. For example, why is location and time data for telephone communications useful to the Intellectual Property Office? I do not quite see it myself. I might be missing something—I am not an expert in intellectual property—but it would be helpful to see the use case that I presume it made to the commissioner for the authorisation. Has that been published?
The guidance states that there has been a consultation with the commissioner. I presume that the consultation has been published, although I have not been able to find it. If it has, does it contain information about how the commissioner tested the use cases? Has the commissioner tested the proportionality—that is what we are making a judgment on here—of the case made by each organisation? Are there real examples that Members can look at and say, for example, “Okay, we understand that East Midlands needs it because it is particularly prone to fraud in which this kind of data is useful for prevention and detection, but the other ambulance services aren’t”?
Similarly, for the other organisations, I can see why location data would matter for DVSA, but I have never heard of the integrated corporate services counter fraud expert services team. I do not know what it does; I would love to know. It would be great if either now or afterwards we could get some information on what it feels like in the real world so Members can make a proportionate judgment, albeit after the fact.
On authorisation levels, the Minister said that there is no requirement because the organisations are all going for authorisation direct from the IPC, but in the regulations, in the column that is amended in the legislation, it gives authorisations at particular levels. For example, it states that in the East Midlands ambulance service, a duty manager of an ambulance control room is able to authorise a request. In the Department for Business and Trade,
“so far as relating to the Insolvency Service”
it specifies:
“Grade 7 in the Investigation and Enforcement Services Directorate”.
Will the Minister explain why he is happy with that level of internal organisation? To me it feels a little low that a request so intrusive and, in certain circumstances, speculative could be authorised by a no doubt hard-working and dedicated duty manager of an ambulance control room, rather than somebody who we might imagine was part of a senior management team of an organisation who is able to take a strategic view about whether a request was proportionate.
As I say, I understand the need for the legislation. It was introduced in 2016 in my first year in the House; I was not the Minister at the time, but obviously I voted for it. It seemed to be the right kind of construct, but we always knew the day would come when we expanded it. The undertaking given then by the Government was that MPs would exercise their judgment about the proportionality of these organisations beyond the police, counter-terrorism and normal enforcement organisations that were really the primary targets of the legislation.
Dan Jarvis
First, let me thank the hon. Member for South West Devon for her remarks, which are much appreciated, not least for the constructive tone in which she delivered them. It is important that we ensure there is broad political support for the investigatory powers regime. These are vital powers for our intelligence services, law enforcement and, as we have heard, a number of public authorities. It is absolutely right that we debate these matters and that they are subject to scrutiny in this House. On that basis, I welcome the challenge from Opposition Members, because it behoves the Government to justify the continued need of these powers in the way that we seek. I will say a little more about that in a moment.
The hon. Member for South West Devon asked about the use of powers and consultation with public authorities. She asked for an assurance that adequate, appropriate resources are in place to support the use of the powers, which I can give her. I also say to her that the Home Office, as I am sure was the case under the previous Government, takes such matters incredibly seriously, both in terms of ministerial oversight and the work of officials in the Department. We look very carefully to ensure that the use of powers is necessary, proportionate and appropriate. I assure her that there has been an appropriate level of consultation leading up to these regulations. I am grateful for her broad support of the regulations and of the investigatory powers regime more generally.
The hon. Member for Sutton and Cheam specifically asked about ambulance trusts. I can tell him that the six English ambulance trusts being removed, as well as the Scottish ambulance service and the Welsh ambulance service, made a direct request to the Home Office for removal from schedule 4. For the purposes of clarity, the remaining four English ambulance trusts—the West Midlands ambulance service, the South East Coast ambulance service, the North West ambulance service and the East Midlands ambulance service—and the Northern Ireland ambulance service have not requested removal and therefore remain listed in schedule 4. Only one ambulance trust, the West Midlands ambulance service, responded to object to its removal. I assure him that the Government will continue to review the necessity of communications data powers for all public authorities listed in schedule 4, including these ambulance trusts, to ensure that their inclusion in the schedule remains justified. Basically, we do not want organisations to be listed in the schedule if they are not using the powers.
Kit Malthouse
I guess what we are asking is why these four did not respond. Was there communication with them to say, “We haven’t heard from you. Should you have responded? Have you missed it? Is it in the pile?” Six have made the case that they have never used the powers. Four have not responded—I would guess they have not used the powers either but just did not respond. How far did the investigation go? From our point of view, it would be interesting to understand why Birmingham objected. What is the real-life case for which an ambulance service needs this data? Make it live for us, Minister. Give us a story that we can tell our constituents.
Dan Jarvis
I genuinely welcome the challenge offered by the right hon. Gentleman; he is right to press us on this. I assure him that there are specific operational reasons why ambulance trusts may wish to retain and use this power. One reason why we have proceeded in the way that we have is that removing public authorities that did not respond to the Home Office’s correspondence from schedule 4 could risk operational errors—for example, ambulance trusts, unaware that they were no longer listed in schedule 4, could continue to make requests for CD without the necessary authorisation. I broadly agree with his points, and I accept that there is a case for further tidying up. I assure the Committee that we will continue to do that, and ensure that the right public authorities, which are using the powers for genuine operational reasons, are listed in schedule 4. I assure him that there are genuine operational reasons—if he will forgive me, I will not go into specific detail—why an ambulance trust might want to exercise these powers. However, I accept his basic point that we will need to look carefully at this and do any further tidying up of the four.
Luke Taylor
Does the Minister agree that there is, if not a red flag, potentially a question about why only one ambulance service made a specific request to retain the powers, while others did not respond, or potentially do not have the correct procedures in place to deal with requests of this type and manage the data? That would be a concern for me. Are those that specifically requested to be removed not utilising a power that may well improve their operations, and their ability to serve their residents?
Dan Jarvis
Again, I am grateful to the hon. Member, because it is an entirely fair challenge. I assure the Committee that the Home Office works very closely with the Investigatory Powers Commissioner’s Office—I will say a little more about that in response to the questions of the right hon. Member for North West Hampshire—to ensure that all the entries in schedule 4 remain up to date and reflect those with a requirement or compelling need for the use of CD powers. The consideration of a public authority’s addition to the schedule is entirely based on the operational case, its proposed approach to compliance and its understanding of the appropriate, necessary and proportionate use of the powers. We give these matters very careful consideration, but I will happily reflect further on the point made by the hon. Member for Sutton and Cheam with regard to the single ambulance trust.
Let me turn to the points made by the right hon. Member for North West Hampshire about proportionality, which he was right to raise. He will know from his time in government, both as deputy mayor and as a Home Office Minister, about the vital requirement for these powers. As I said in my introductory remarks, communications data is routinely used as evidence in upwards of 95%—that is probably a conservative estimate—of serious organised crime investigations. That is a key statistic. That data has played a significant role in every major terrorism investigation over the past decade. It provides vital evidence in both criminal and national security investigations. At the same time, he is right to make the point that we need to be proportionate in its use: strong powers, yes, but with an absolute requirement for strong oversight as well. I completely understand and am genuinely pleased about what he has said. It is not that often that we get the opportunity to debate these niche but important matters about the role of the commissioner.
The commissioner, Sir Brian Leveson, does an outstanding job. Anyone who knows him is aware that he is, by any metric, an extraordinary character and a true public servant with a wisdom and integrity that are a huge credit to the work that he does. He is incredibly well supported by an excellent team who work hard to ensure appropriate levels of oversight for this regime. We would not be able to operate without the independent oversight that he and his team have carried out for the previous Government and this Government, and will carry out for the next one, without fear or favour. All that said, it continues to be right, of course, for us to look carefully at the structural arrangements in place and, as a still relatively new Government, to satisfy ourselves that they are fit for purpose, that they are appropriately resourced and that the right people are doing what is a difficult and important job.
I give the right hon. Gentleman an absolute assurance that the Home Secretary and I personally take these matters very seriously. I meet Sir Brian and his team regularly, who look carefully at the work we do. But if the right hon. Gentleman or any other Member has any thoughts about how the regime could be tweaked or improved, I will happily have that conversation.
Kit Malthouse
I do not want to cast any aspersions on Brian Leveson, whom I know well—not least because he was educated at the same school as I was; obviously, a little before.
The challenge is about proportionality. We all acknowledge the importance of such evidence if we are dealing with serious criminality, violence or terrorism—as I said, 100% of murders are solved with the use of this data—but I guess my concern starts when the powers stray into matters that are primarily commercial, for example. The Intellectual Property Office deals essentially with commercial matters—disputes about patents and intellectual property, and possible fraud thereabouts. It is unlikely that anybody will go to prison as a result of the operation of the Intellectual Property Office, although they might pay a big fine or compensation to somebody.
I guess the issue is where the line is between criminality, violence, terrorism or serious and organised crime, and more commercial matters. Take the Driving and Vehicle Standards Agency: it may be a crime under DVSA regulations to do x, y or z, but the British public would not put that up there with terrorism. That is the proportionality that we are asking about: whether we are straying too far. The Government obviously do not think so, which is why they have put the regulations forward, but I ask the Minister whether he has satisfied himself about the point I am making.
I am sorry to make this slightly long intervention, but my prediction is that we will be here again in 12 months’ time. Suddenly all sorts of organisations will be saying, “D’you know what? It might be useful to have a bit of a fishing trip—we just don’t know. Let’s see if we can persuade the Minister whether, once he has put the Intellectual Property Office in, we can be in as well.”
Dan Jarvis
I am genuinely grateful to the right hon. Gentleman, because he raises some important points. Some of us were here a week ago debating a not dissimilar statutory instrument. I had a very constructive debate with a former security Minister on his Benches—the right hon. Gentleman knows him well—and we repeated some of the debate that we had during the passage of the Investigatory Powers (Amendment) Act 2024 in the previous Parliament. We debated precisely the issues that the right hon. Gentleman raises.
I do not disagree with much of what the right hon. Gentleman said, but let me seek to give him a bit of assurance. First, we definitely do not do fishing exercises—as the Minister, I would not consider that remotely appropriate—and we do not do mission creep either. We need to be really careful to ensure that all the public authorities listed have an absolute operational requirement to use the powers.
The right hon. Gentleman’s raised the Intellectual Property Office in his earlier remarks, and helpfully did so again just a moment ago. The Intellectual Property Office engages with law enforcement agencies and other Departments to tackle intellectual property crimes, including those relating to patents, designs, trademarks and copyright, via a multi-agency approach. It also supports investigations to tackle serious organised crime, such as countering counterfeit goods, illegal streaming and associated money laundering offences under the Proceeds of Crime Act 2002. I take his point, but I hope that in the specific example he raises I am able to assure him that the powers vested in that organisation are necessary and proportionate. I further assure him that I will continue to look very carefully at these matters to satisfy myself that all the public authorities listed have that operational requirement.
Finally, I thought the right hon. Gentleman made a reasonable point about authorisation. I assure him that very careful consideration is given to matters relating to authorisation—I am sure he remembers that from his time in the Department. He raised an interesting example, but I assure him that, as a Minister, I have looked very carefully at the details of this, as have officials. We will satisfy ourselves that matters relating to authorisation are designated at an appropriately senior level. He is right to raise that point. I assure him that the regulations are appropriate, but I will look carefully at them to further satisfy myself that that is the case.
I hope that I have responded reasonably to all the questions, and that I have illustrated the importance of the regulations, which I commend to the Committee.
Question put and agreed to.
Resolved,
That the Committee has considered the draft Investigatory Powers (Communications Data) (Relevant Public Authorities and Designated Senior Officers) Regulations 2025.