Regulation of intelligence gathering

STOP PRESS: The Investigatory Powers (Amendment) Act 2024 (IP(A)A 2024) received Royal Assent on 25 April 2024. The Act is the first major amendment of the Investigatory Powers Act 2016 since it was enacted and seeks to expand the surveillance powers of the UK’s police, intelligence services and government. The Investigatory Powers (Amendment) Act 2024 (Commencement No 1 and Transitional Provisions) Regulations 2024, SI 2024/1021 brings certain provisions of the IP(A)A 2024 into force on 14 October 2024. This Overview is in the process of being updated to reflect the changes.

Regulation of intelligence gathering

A range of statutory obligations regulate the acquisition, retention, examination and dissemination of private material by public authorities for intelligence purposes. These include:

•
Investigatory Powers Act 2016 (IPA 2016)
•
Regulation of Investigatory Powers Act 2000 (RIPA 2000)
•
Human Rights Act 1998 (HRA 1998)
•
Intelligence Services Act 1994 (ISA 1994)
•
Security Service Act 1989 (SSA 1989)
•
Computer Misuse Act 1990 (CMA 1990)
•
Wireless Telegraphy Act 2006 (WTA 2006)
•
Investigatory

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest Information Law News

ICO releases new guidance on anonymisation and pseudonymisation techniques

The Information Commissioner's Office (ICO) has published comprehensive guidance on anonymisation and pseudonymisation techniques on 28 March 2025, accompanied by a webinar scheduled for 22 May 2025. The guidance explains anonymisation and pseudonymisation concepts, outlines data protection obligations, and provides practical advice on implementing appropriate technical measures. It specifically addresses organisations using or considering anonymising personal data, including artificial intelligence developers, and details risk mitigation strategies for protecting individual privacy.

Automated decision-making and DSARs: right to access means a right to explainability (CK v Magistrat Der Stadt Wiendun & Bradstreet Austria GMBH)

Information Law analysis: The Court of Justice provided several clarifications around the scope of data subject access requests (DSARs) in the context of automated decision-making. The court held the determining factor for whether information constitutes ‘meaningful information about the logic involved’ under Article 15(1)(h) of the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) is whether the information enables the data subject to understand the logic involved in automated decision-making involving their personal data. The court also held disclosure by controllers should be underpinned by the principles of transparency, which requires information to be clear, accessible and intelligible, both in terms of content and form, from the perspective of data subjects. In the context of automated decision-making this doesn’t necessarily mean providing the exact algorithm, if it doesn’t help the data subject’s understanding of the ‘how’. The court confirmed DSARs do not mandate the disclosure of trade secrets, but this can only be decided by the relevant supervisory authority or competent court, after assessing all relevant information provided to them by a controller. The protection of trade secrets cannot be used as a blanket excuse by businesses to withhold certain information from individuals making a request under Article 15(1)(h) of the EU GDPR. Written by Marija Nonkovic, associate at Kemp IT Law LLP.

NCSC releases new principles for privileged access workstation implementation

The National Cyber Security Centre (NCSC) has published new principles for implementing privileged access workstations (PAWs). The principles provide organisations with guidance on establishing restricted workstations for accessing high-risk systems. The guidance emphasises that PAWs should be implemented as part of broader security controls, with focus on establishing trust through auditable systems and validated controls. The principles aim to help organisations protect against privilege escalation and reduce vulnerability to cyber attacks through administrative interfaces.

Information Law weekly highlights—27 March 2025

Welcome to this week’s edition of the Information Law weekly highlights: a hand-picked summary of news analysis, updates and new content related to laws governing the use and dissemination of information and personal data. Each week these highlights focus on developments in key topics such as data protection, ePrivacy, cybersecurity, breach of confidence, misuse of private information, and defamation.

View Information Law by content type :

News