Privacy & Cybersecurity Law Blog

On November 16, 2016, the UK Investigatory Powers Bill (the “Bill”) was approved by the UK House of Lords. Following ratification of the Bill by Royal Assent, which is expected before the end of 2016, the Bill will officially become law in the UK. The draft of the Bill has sparked controversy, as it will hand significant and wide-ranging powers to state surveillance agencies, and has been strongly criticized by some privacy and human rights advocacy groups. 

The Bill was initially proposed by the current UK Prime Minister, Theresa May, during her previous tenure as UK Home Secretary. The Bill allows intelligence and law enforcement agencies to require telecommunications service providers to retain and hand over communications data. Telecommunications service providers also will be required to store individuals’ browsing histories over the previous year in real time, and submit bulk datasets to intelligence services and law enforcement agencies where those agencies have obtained a warrant from the Secretary of State. The Bill also will permit both targeted and bulk equipment interference (i.e., obtaining data from an electronic device) by intelligence services and law enforcement agencies where authorized by a lawfully-issued warrant.

The Bill’s entry into law could potentially complicate Brexit negotiations between the UK and EU with regard to privacy and data protection issues. Revelations that U.S. intelligence agencies engaged in bulk surveillance practices similar to those contemplated by the Investigatory Powers Bill ultimately led to the demise of the U.S.-EU Safe Harbor data transfer framework. With the UK planning its exit from the EU, the Investigatory Powers Bill could create similar issues for the UK in the context of negotiating a cross-border data transfer framework with the EU.