Report published on oversight and use of investigatory powers

The latest report by the Investigatory Powers Commissioner has been published.

The 2022 Annual Report details the use and oversight of investigatory powers by public authorities; including the intelligence agencies, law enforcement, and local authorities. The report also includes details of inspection findings, recommendations, errors, and breaches.

IPCO staff undertook a total of 380 inspections in 2022, overseeing the use of powers including the interception of communications, the acquisition of communications data, and the use of covert human intelligence sources.

Sir Brian Leveson, the Investigatory Powers Commissioner, said:

“I am delighted to share my fourth Annual Report covering my third year as Investigatory Powers Commissioner.

“Once again, our findings reveal high levels of compliance with the relevant legislation and codes of practice across the many organisations we oversee. There are areas of concern that need to be addressed, but it is reassuring that public authorities are reporting only a very low number of serious errors.

“I am confident that IPCO continues to provide robust oversight and scrutiny to ensure public authorities in the UK are using investigatory powers in a manner that is compliant with the law, including their human rights obligations.”

In 2022, most authorisations for the use of the investigatory powers were for the purpose of preventing or detecting crime. For communications data authorisations, the most common crime type under the “prevent and detect” statutory purpose related to drug offences.

The report covers work undertaken in 2022 by the Investigatory Powers Commissioner’s Office (IPCO) and its sister organisation, the Office for Communications Data Authorisations (OCDA). Both support the Commissioner in carrying out his functions under the Investigatory Powers Act 2016.

In March 2024, IPCO and OCDA merged formally to form one organisation for administrative purposes. The name chosen for the merged organisation is the Investigatory Powers Commissioner’s Office. The independence of the decision-making and oversight functions of both groups will remain. A further update on this project will be provided in our 2023 report.

Some of the key points from the report are:

• IPCO identified examples of good practice among various authorities, including within MI5 regarding bulk personal datasets, GCHQ’s processes used to acquire communications data, and the Competition and Markets Authority’s oversight and processes for online and social media investigations.
• The UK-US Data Access Agreement came into force in October 2022. The Agreement enables public authorities to request data held by telecommunications operators in each other’s jurisdictions to prevent, detect, investigate, and prosecute serious crimes, including terrorism.
• IPCO undertook 12 serious error investigations in 2022. Eleven cases were found not to be serious (within the meaning of the Investigatory Powers Act) and one is currently before the Investigatory Powers Tribunal.
• IPCO undertook an in-depth review of MI5’s handling of legally privileged material and found that the retention of some of this material was not compliant with the Investigatory Powers Act 2016. MI5 agreed to consider how best to resolve the issue and IPCO will provide an update on this in its 2023 report.
• IPCO reviewed 104 cases under The Principles in 2022, noting a high level of compliance from the six public authorities subject to the policy. The Investigatory Powers Commissioner keeps under review all statistics presented in the Annual Report, including the figures relating to The Principles, and will take into consideration the statistics published in the Intelligence and Security Committee’s inquiry into International Partnerships. An update on this review will be included in our 2023 Annual Report.
• After IPCO identified an error made by the Home Office regarding the signing of out-of-hours warrants in 2021, we are satisfied that the issue has now been addressed, with measures put in place to avoid future non-compliance.
• Towards the end of 2021, IPCO found several errors at the UK National Authority for Counter-Eavesdropping (UK NACE) relating to the acquisition of communications data, which led to the IPC taking the extraordinary step to instruct the authority to cease internal authorisation of the powers. Following great efforts to tackle the issues and an inspection by IPCO in December 2022, the IPC determined that responsibility for authorisation should be returned to UK NACE.
• Areas of concern include records product management, the management of intercept material and the National Crime Agency’s use of thematic authorisations relating to The Principles.

The Investigatory Powers Commissioner has a statutory obligation to publish his findings and activities to the Prime Minister each year before it is laid in Parliament.