United KingdomInvestigatory Powers Act 2016, Unlawful Interception and Lawful Business Monitoring
Investigatory Powers Act 2016, ss. 3, 8, 44 and 46; S.I. 2018/356
In force since .
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
What it requires
- Do not intentionally intercept, or procure another person to intercept, a communication in the course of its transmission by a telecommunication system or a public postal service in the United Kingdom unless you have lawful authority to do so.NIST Privacy FrameworkCT.PO-P1
- Before you make the content of a call or message available to anyone who is neither its sender nor its intended recipient, a recording, transcription or monitoring vendor included, get the consent of both the sender and the intended recipient or rely on the business-monitoring authority below; recording a call you are a party to, for your own use, is not interception.NIST Privacy FrameworkCT.PO-P1
- If you are a business, a government department, a public authority, or another body exercising a statutory function, you may record or monitor communications on your own telecommunication system for a listed legitimate purpose, such as establishing facts, checking compliance with regulatory standards, or securing the system's own effective operation, if you have made all reasonable efforts to tell every person who may use the system that their communications on it may be intercepted.NIST Privacy FrameworkCM.AW-P1
- If you control a private telecommunication system, do not intercept communications on it without lawful authority: the criminal offence excludes you, but the sender or the intended recipient can sue you for it.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A person who commits the offence of unlawful interception is liable, on summary conviction in England and Wales to a fine, on summary conviction in Scotland or Northern Ireland to a fine not exceeding the statutory maximum, or on conviction on indictment to imprisonment for up to two years or a fine, or both.
Who enforces it
Enforcement body
Prosecution by, or with the consent of, the Director of Public Prosecutions (or the Director of Public Prosecutions for Northern Ireland); a civil claim under section 8 is brought by the affected sender or recipient.
Settledness
- As of
- Open questions
- Does 'all reasonable efforts to inform every person who may use the telecommunication system' in regulation 4(1)(c) of the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 require a business to tell an outside caller before a call is recorded, or can a notice published to the system's users satisfy it?
- Does a copy of a call recording that a party to the call passes to a transcription or analytics vendor make content available 'to a person who is not the sender or intended recipient' under section 4(1)(b) of the Investigatory Powers Act 2016, so that the vendor's access needs authority under section 44 or section 46?
What this law does
Section 3 makes it a criminal offence to intentionally intercept a communication in the course of its transmission by a public or private telecommunication system or a public postal service in the United Kingdom without lawful authority, though a private system's own controller, or someone with that person's express or implied consent, does not commit this offence by intercepting on it.
Under section 4 a person intercepts a communication only if the effect of what they do is to make its content available to a person who is not its sender or intended recipient, so a party who records a call for their own use is outside the offence.
Section 44 gives lawful authority to intercept where both the sender and the intended recipient have consented, or where one of them has consented and surveillance by that interception is separately authorised under Part 2 of the Regulation of Investigatory Powers Act 2000.
Section 46, read with the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, gives lawful authority to a business, government department, public authority, or other body exercising a statutory function to intercept its own communications for a listed purpose, such as establishing facts, checking regulatory compliance, or securing the system's effective operation, on conditions including that the body has made all reasonable efforts to inform every person who may use the system that their communications may be intercepted.
Section 8 gives the sender or the intended recipient of a communication a civil claim against a private telecommunication system's own controller who intercepts it without lawful authority. The Regulation of Investigatory Powers Act 2000's own interception offence and civil-liability provisions were repealed in stages during 2018 as this Act's provisions came into force.
When LexLint raises it
When your app profile says your app records calls, records text chat or processes voice recordings.
Back to the example · Lint your app
Page updated .