This document discusses legal challenges to the Investigatory Powers Act (IPAct) regarding data protection adequacy. Key issues being challenged include whether the IPAct allows for generalized and indiscriminate data retention and bulk data collection. Recent court rulings have found that access to retained data must be limited to serious crimes and require independent prior review. Other IPAct provisions around non-crime data uses and data location requirements are also pending decisions from UK and EU courts on whether they comply with data protection standards. The document analyzes how these legal challenges could impact whether the IPAct is deemed adequate for data flows from the EU.

1. Investigatory Powers Act
and data protection adequacy
Graham Smith
@cyberleagle
August 2018

2. Legal challenges – shifting adequacy baseline?
Liberty judicial review of IPAct following Watson
● Data retention provisions
• Judgment 27 April 2018
● Bulk powers
• Yet to be heard
CJEU
● Privacy Shield CJEU challenges to bulk powers
● Watson 2, Ministerio Fiscal (Spain) and Belgium data
retention references
ECtHR
● BBW, BIJ, 10 NGOs v UK
• TEMPORA/PRISM – bulk powers and sharing

3. Watson – impact on IPAct so far
Issue Status
Generalised and indiscriminate
retention?
No. Liberty have permission to appeal.
Crime purpose for access to retained
data not limited to “serious crime”
Conceded. IPAct being amended.
Access to retained data not subject to
independent prior review.
Conceded for events data/non-national
security. Office for Communications Data
Authorisations (OCDA) to be established
under IPCO.
National security within scope of EU
law? (MI5, MI6, GCHQ)
Pending CJEU reference from IPT Privacy
International case.
Non-crime retention and acquisition
purposes?
Public health, tax, regulation of financial
services/markets and financial stability to be
removed from IPAct.
Does mandatorily retained data have to
be held within the EU?
Pending CJEU reference from IPT Privacy
International case.
Notification of those whose data has
been accessed?
Pending CJEU reference from IPT Privacy
International case.
Page 3
Via Liberty IPAct judicial review litigation

4. IPAct and adequacy
Generalised and indiscriminate (data retention and bulk)
● Clear, precise and limited on face of statute?
● Or too much left to discretion and oversight?
• Liberty pending judicial review appeal
• Canada PNR Agreement (CJEU, 26 July 2017)
• But Centrum for Rattvisa v Sweden (ECtHR, 19 June 2018)
Authorisation and oversight – new IPAct safeguards
● Judicial Commissioner/OCDA approval of all warrants and
notices
Page 4

5. IPAct bulk powers adequacy
Legitimate to apply metadata standards to content?
● Interception, equipment interference, BPD warrants.
● Content, systems data, identifying data
● IPAct power to extract identifying data from content and treat
as metadata
Page 5

6. Graham Smith
graham.smith@twobirds.com
@cyberleagle
Bird & Bird is an international legal practice comprising Bird & Bird LLP and its affiliated and associated businesses.
Bird & Bird LLP is a limited liability partnership, registered in England and Wales with registered number OC340318 and is authorised and regulated by the
Solicitors Regulation Authority. Its registered office and principal place of business is at 15 Fetter Lane, London EC4A 1JP. A list of members of Bird & Bird LLP and
of any non-members who are designated as partners, and of their respective professional qualifications, is open to inspection at that address.
twobirds.com
Thank you