Report finds regulatory gaps remain in Investigatory Powers Act

The UK's Investigatory Powers Act 2016 (IPA) has come under scrutiny by the Investigatory Powers Commissioner (IPC), Sir Brian Leveson, for failing to address significant regulatory gaps. In his latest annual report, Leveson found that despite the introduction of the Investigatory Powers (Amendment) Act 2024 (IPAA), essential reforms are still needed, particularly concerning oversight of privileged information from foreign partners, such as that shared by the UK intelligence agency GCHQ. Such information is often obtained without the necessary authorisation under the IPA, creating a regulatory oversight loophole. Furthermore, the IPC noted that the UK intelligence community (UKIC) does not need to report serious personal data breaches to the Information Commissioner's Office (ICO), raising concerns about public-interest disclosures. This exemption may prevent proper oversight of potential data breaches, which, if not reported, could undermine data protection. 

Leveson also touched on the ongoing debate over Technical Capability Notices (TCNs), which can require companies, such as Apple, to create a backdoor to enable government access to its encrypted data. Sir Leveson welcomed a tribunal ruling that mandated public disclosure of TCNs, insisting that informed public discourse on lawful access is vital.