Investigatory Powers (Codes of Practice, Review of Notices and Technical Advisory Board) Regulations 2025

Debate between Lord Davies of Gower and Lord Deben

Monday 12th May 2025 Grand Committee

[Lord Deben (Con)]

I wonder whether the Minister would be kind enough in his reply to give us some idea of the ongoing arrangements for the updating of this kind of material. He has shown that the constant need for this is because of the speedy change of the world outside. Who is responsible for it? How are they able to keep up to date and how regularly do we think we are likely to have statutory instruments updating the material that we have? We are dealing with an ever-changing scene which is changing ever more quickly. I would like to understand the government structure that enables us to make satisfactory changes rapidly enough to see that we are fully in control.

[Lord Davies of Gower (Con)]

My Lords, I thank the Minister for introducing these regulations. These regulations implement key provisions of the Investigatory Powers Act 2024, which was passed by the previous Conservative Government. These regulations introduce three codes of practice and revise five existing ones.

The new codes provide a framework for two regimes introduced by the 2024 Act— the treatment of bulk personal datasets where there is a low or no reasonable expectation of privacy, and the authorisation of access to third-party datasets. A third new code consolidates guidance on the notices regime, including the operation of notification notices and what constitutes a relevant change—a key test for when telecoms operators must inform the Secretary of State of technical updates.

The revised codes also enhance oversight and safeguards by clarifying the conditions for lawful access to data, strengthening protection for journalistic material and requiring notification of serious data breaches where it is in the public interest. These regulations also make important structural updates to the technical advisory board, expanding its membership and adjusting its quorum rules to ensure it can operate effectively when dealing with complex or concurrent reviews.

We welcome these provisions and, with that in mind, I raise several broader points. First, on legislative responsiveness, these regulations reflect the speed at which both threats and the technologies behind them are evolving. The 2024 Act rightly introduced flexible tools for handling internet connection records and bulk data. But agile legislation should not rely solely on periodic amendments. Can the Minister confirm whether the Government plan to conduct regular reviews of the framework and whether a structured timetable has been established to ensure that the legislation continues to meet operational needs?

Secondly, on stakeholder engagement, the Government’s consultation included contributions from technology companies, civil liberties organisations and public bodies. Although this engagement is welcome, several respondents raised concerns, particularly regarding the practical implications of notification notices and the definition of “relevant change”. Given that, can the Minister outline how the Government intend to maintain an open and ongoing dialogue with stakeholders as these codes are implemented?

Finally, on oversight and accountability, the powers under discussion are significant. Their legitimacy depends on effective safeguards; this is especially true for third-party bulk datasets, where individuals may not reasonably expect their data to be protected. Can the Minister confirm that the revised codes provide the Investigatory Powers Commissioner with the necessary clarity and authority to ensure that these powers are exercised lawfully and proportionately?

The 2024 Act was designed to safeguard national security in a rapidly evolving digital world. However, the use of investigatory powers must always be lawful, properly overseen and proportionate in its impact. Although these reforms offer practical steps to modernise the existing framework, we must ensure that these powers are used responsibly, reviewed regularly and held accountable, balancing security with our democratic values.