Investigatory Powers (Codes of Practice, Review of Notices and Technical Advisory Board) Regulations 2025

Lord Davies of Gower Excerpts

Monday 12th May 2025 Grand Committee

[Lord Deben (Con)]

I wonder whether the Minister would be kind enough in his reply to give us some idea of the ongoing arrangements for the updating of this kind of material. He has shown that the constant need for this is because of the speedy change of the world outside. Who is responsible for it? How are they able to keep up to date and how regularly do we think we are likely to have statutory instruments updating the material that we have? We are dealing with an ever-changing scene which is changing ever more quickly. I would like to understand the government structure that enables us to make satisfactory changes rapidly enough to see that we are fully in control.

[Lord Davies of Gower (Con)]

My Lords, I thank the Minister for introducing these regulations. These regulations implement key provisions of the Investigatory Powers Act 2024, which was passed by the previous Conservative Government. These regulations introduce three codes of practice and revise five existing ones.

The new codes provide a framework for two regimes introduced by the 2024 Act— the treatment of bulk personal datasets where there is a low or no reasonable expectation of privacy, and the authorisation of access to third-party datasets. A third new code consolidates guidance on the notices regime, including the operation of notification notices and what constitutes a relevant change—a key test for when telecoms operators must inform the Secretary of State of technical updates.

The revised codes also enhance oversight and safeguards by clarifying the conditions for lawful access to data, strengthening protection for journalistic material and requiring notification of serious data breaches where it is in the public interest. These regulations also make important structural updates to the technical advisory board, expanding its membership and adjusting its quorum rules to ensure it can operate effectively when dealing with complex or concurrent reviews.

We welcome these provisions and, with that in mind, I raise several broader points. First, on legislative responsiveness, these regulations reflect the speed at which both threats and the technologies behind them are evolving. The 2024 Act rightly introduced flexible tools for handling internet connection records and bulk data. But agile legislation should not rely solely on periodic amendments. Can the Minister confirm whether the Government plan to conduct regular reviews of the framework and whether a structured timetable has been established to ensure that the legislation continues to meet operational needs?

Secondly, on stakeholder engagement, the Government’s consultation included contributions from technology companies, civil liberties organisations and public bodies. Although this engagement is welcome, several respondents raised concerns, particularly regarding the practical implications of notification notices and the definition of “relevant change”. Given that, can the Minister outline how the Government intend to maintain an open and ongoing dialogue with stakeholders as these codes are implemented?

Finally, on oversight and accountability, the powers under discussion are significant. Their legitimacy depends on effective safeguards; this is especially true for third-party bulk datasets, where individuals may not reasonably expect their data to be protected. Can the Minister confirm that the revised codes provide the Investigatory Powers Commissioner with the necessary clarity and authority to ensure that these powers are exercised lawfully and proportionately?

The 2024 Act was designed to safeguard national security in a rapidly evolving digital world. However, the use of investigatory powers must always be lawful, properly overseen and proportionate in its impact. Although these reforms offer practical steps to modernise the existing framework, we must ensure that these powers are used responsibly, reviewed regularly and held accountable, balancing security with our democratic values.

[Lord Hanson of Flint (Lab)]

I am grateful for those two contributions. First, the noble Lord, Lord Davies, mentioned again how the Government will keep these matters under review. He will know that, basically, the 2016 Act was passed on the basis of cross-party support. The 2024 Act was a review of whether the 2016 Act needed to be amended further, while the regulations before the Grand Committee today are the outcome of some of the changes to that 2024 Act.

The Investigatory Powers (Amendment) Act made a series of targeted changes to ensure that the regime was fit for purpose but, self-evidently, the Home Office will keep under examination the new technology and the need to make any further amendments. I cannot give the noble Lord an assurance as to when and how that will be done, but he can rest assured that if amendments to the 2016 Act, which was amended in 2024, are required, they will be brought to the House as a matter of some urgency.

The noble Lord, Lord Davies, also mentioned public consultation; I very much welcome his welcome for of these regulations today. The responses that the Government received included various suggestions for amendments to the draft codes of practice and the regulations. We have made changes as a result; these are quite wide but include changes to the Technology Advisory Panel’s membership requirement. I know that he mentioned telecommunication companies in particular. Again, we are satisfied that there was sufficient input from them during the passage of the 2024 Act and that the points they raised were taken into consideration when preparing the codes. Obviously, again, we need to examine the wide space between telecommunications companies’ powers and responsibilities, including their responsibility to protect the individual and the consumer. I think that we have got the balance right here.

The noble Lord, Lord Davies, asked about oversight. Strong safeguards are in place to ensure that investigatory powers are used in a necessary and proportionate way. There is independent oversight by the Investigatory Powers Commissioner and the right of redress via the Investigatory Powers Tribunal for anybody who believes they have been the victim of unlawful action by a public authority using covert investigative techniques. The Investigatory Powers Commissioner independently oversees the use of investigatory powers and will ensure that they are used in accordance with the law and in the public interest. Several other powers—I hope this also reassures the noble Lord—are subject to the double lock, where warrants must be signed by the Secretary of State and an independent judicial commissioner. These powers are deployed only in connection with the most serious of crimes or national security.