Regulation of intelligence gathering

STOP PRESS: The Investigatory Powers (Amendment) Act 2024 (IP(A)A 2024) received Royal Assent on 25 April 2024. The Act is the first major amendment of the Investigatory Powers Act 2016 since it was enacted and seeks to expand the surveillance powers of the UK’s police, intelligence services and government. The Investigatory Powers (Amendment) Act 2024 (Commencement No 1 and Transitional Provisions) Regulations 2024, SI 2024/1021 brings certain provisions of the IP(A)A 2024 into force on 14 October 2024. This Overview is in the process of being updated to reflect the changes.

Regulation of intelligence gathering

A range of statutory obligations regulate the acquisition, retention, examination and dissemination of private material by public authorities for intelligence purposes. These include:

•
Investigatory Powers Act 2016 (IPA 2016)
•
Regulation of Investigatory Powers Act 2000 (RIPA 2000)
•
Human Rights Act 1998 (HRA 1998)
•
Intelligence Services Act 1994 (ISA 1994)
•
Security Service Act 1989 (SSA 1989)
•
Computer Misuse Act 1990 (CMA 1990)
•
Wireless Telegraphy Act 2006 (WTA 2006)
•
Investigatory

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

Cabinet Office updates PPNs on data protection and payment spot checks

The Cabinet Office has added two new Procurement Policy Notes (PPNs) to the suite of PPNs republished in conjunction with the Procurement Act 2023 (PA 2023) go-live—PPN 020: Guidance on data protection legislation and PPN 021: Payment Spot Checks in Public Sub-Contracts. PPN 020: Guidance on data protection legislation provides updated guidance on relevant data protection requirements under the UK GDPR and the UK International Data Transfer Agreement (IDTA) governing the export of personal data from the UK. PPN 020 applies with immediate effect. It replaces PPN 03/22 which contained streamlined guidance and updated model clauses to take account of the UK’s exit from the EU. It also includes guidance on international transfers of personal data. PPN 020 does not constitute a change in policy, but in-scope organisations should circulate and adhere to the guidance and use the updated model clauses at Annex A for new contracts. PPN 021: Payment Spot Checks in Public Sub-Contracts provides guidance and templates for contracting authorities to spot check public contract supply chains to ensure suppliers meet the payment terms set out in PA 2023. PPN 021 includes additional guidance on how in-scope organisations should conduct spot checks to ensure the correct payment terms are being included and adhered to by suppliers, plus model terms at Annex A which support spot checks being carried out. PPN 021 applies from 1 October 2025. Both PPNs apply to all central government departments, their executive agencies and non-departmental public bodies.

ICO fines compensation firm £90,000 for PECR marketing call breaches

The Information Commissioner's Office (ICO) has imposed a £90,000 fine on AFK Letters Co Ltd for breaching the Privacy and Electronic Communications Regulations (PECR) between January and September 2023. The enforcement action addressed 95,277 unsolicited marketing calls to Telephone Preference Service registrants, inadequate consent records, and non-compliant third-party data collection. The case highlights the ICO's interpretation of Regulation 21 requirements for valid marketing consent and proper record-keeping obligations.

EDPB annual report reveals major data protection legal developments in 2024

The European Data Protection Board (EDPB) has released its annual report for 2024 on 23 April 2025, detailing significant legal developments in EU data protection. The report outlines eight major Art. 64(2) Regulation (EU) 2016/679 (General Data Protection Board (GDPR)) opinions, including new guidance on AI models and 'Consent or Pay' practices. The EDPB adopted four new guidelines, including rules on Article 48 GDPR international transfers. DPAs across the EU issued €1.2bn in fines, while the EDPB expanded its regulatory scope through a new cooperation agreement with PEReN and enhanced supervision of EU IT systems.

Commission fines Apple and Meta for EU DMA breaches

The European Commission has fined Apple €500m and Meta €200m for breaching EU Digital Markets Act (EU DMA) obligations. Apple violated anti-steering rules by restricting app developers from informing users about alternative payment options outside the App Store. Meta breached user consent requirements with its 'consent or pay' model for Facebook and Instagram. Both companies have 60 days to comply with the Commission's decisions or face additional penalties. The Commission also removed Meta's Facebook Marketplace from EU DMA designation due to falling below business user thresholds.

View Information Law by content type :

News