Consultation outcome

Consultation document (accessible)

Updated 16 March 2023

This was published under the 2019 to 2022 Johnson Conservative government

Ministerial foreword

With so much more of our lives lived online, devices such as mobile phones now hold large volumes of information about us, some of which is highly sensitive and personal. When someone is a complainant or a witness to a crime there may be crucial information on a device that could help to bring someone to justice.

The invasive nature of the process around disclosure of this digital information has long been raised as an issue by victims and can stop someone from reporting a crime or continuing with a prosecution. It is vital that victims and witnesses are confident they will be treated with sensitivity and dignity when reporting crimes and that their rights to privacy are protected so that more victims feel able to come forward.

That is why I have introduced, in the Police, Crime, Sentencing and Courts Act, new statutory powers to govern the practice of extraction information from electronic devices. This Act completed Parliamentary passage in April and creates a clear statutory basis for police and other authorities to extract this information with the agreement of a device user. These powers contain important safeguards that prioritise the privacy of the individual and ensure any request to obtain information from a victim or witness is necessary and proportionate.

The use of the powers will be supported by a code of practice, and it is this guidance which I now seek views on. The draft code has a number of important functions and includes:

• detailed guidance on when and how these powers should be used and the considerations when making assessments of necessity and proportionality including where there is a risk of obtaining either confidential information or information which may not be necessary for the purpose for which the powers are being exercised
• an overview of the existing responsibilities for authorised persons under the Human Rights Act and the Data Protection Act
• guidance on ensuring a device is provided voluntarily by a user (or on behalf of the user) and with their agreement to the extraction of information
• specific guidance on the use of the powers with children and adults without capacity
• detailed guidance about the use of the powers with victims who may be vulnerable due to the trauma they have experienced and who may need more support to make decisions about issues that affect them, such as whether to provide agreement to the extraction of information from their device

These new powers and the code of practice present an opportunity to drive real cultural change in the way information belonging to complainants and witnesses is obtained, putting an individual’s right to privacy at the centre of the decision-making process.

Rt Hon Kit Malthouse MP

Scope of the consultation

Topic of this consultation:

This consultation is on the draft Extraction of Information from Electronic Devices: code of practice under Part 2, Chapter 3 of the Police, Crime, Sentencing and Courts Act 2022.

Scope of this consultation:

This consultation seeks representations on the draft code of practice.

Geographical scope:

UK-wide.

Basic information

To:

Representations are welcome from public authorities that have powers under Part 2, Chapter 3 of the Police, Crime, Sentencing and Courts Act 2022, statutory consultees as detailed within the Act, other professional bodies, interested groups and the wider public.

Duration:

Commencing on 17 May for 8 weeks, closing on 12 July.

Enquiries and responses:

Please email your enquiries and responses to PCSCExtractioncode@homeoffice.gov.uk

After the consultation:

Following the consultation period, responses will be analysed, and the draft code will be revised as necessary. The code will then be laid before Parliament for approval.

Background

Getting to this stage

The Government introduced, in Part 2, Chapter 3 of the Police, Crime, Sentencing and Courts Act, new statutory powers for the extraction of information from electronic devices. These powers provide authorised persons with a clear legal basis in which devices can be examined in a limited number of scenarios where strict criteria has been met. This is needed to limit the amount of sensitive personal information being extracted from devices belonging to victims and witnesses and to better protect the privacy of these individuals.

The power in section 37 of the Act allows authorised persons to extract information stored on a device used by a victim or witness when it has been voluntarily provided and agreement has been given that information can be extracted. This power may only be exercised for the purposes of preventing, detecting, investigating, or prosecuting crime, helping to locate a missing person, or protecting a child or an at-risk adult from neglect or physical, mental, or emotional harm. The power in section 41 of the Act allows authorised persons to extract information from a device where a person who was a user of the device has died and, immediately before they died, they were a user of the device. This power may be exercised for the purposes of certain investigations or inquests into the person’s death.

These powers strengthen the law to ensure that there is a consistent approach to requesting information from phones and other electronic devices, and that in all cases, requests to complainants and witnesses are necessary and proportionate.

The PCSC Act creates a requirement for the Secretary of State to prepare a code of practice on the lawful use of these powers. This code will give clear guidance for all authorities exercising these powers. Amongst other things, the code will address assessing if use of the powers is necessary and proportionate and how to ensure agreement is freely given and the device user’s rights are understood. All authorised persons have a duty to have regard to the code when exercising, or deciding whether to exercise, the power. The code is admissible in evidence in criminal or civil proceedings and failure to act in accordance with it may be taken into account by a court.

We published the first draft of the code in July 2021 to support Parliamentary scrutiny of the extraction of information clauses and an updated draft in the autumn to reflect further feedback from stakeholders, interested groups and the Government during the Bill’s passage up to that point.

The draft of the code of practice published for this consultation reflects the final clauses contained in the PCSC Act, and continued consultation with the bodies affected and other interested groups.

In preparing the draft code we have consulted extensively with civil society organisations, the law enforcement community and technical experts, the Information Commissioner’s Office, the Victim’s Commissioner for England and Wales and the Devolved Administrations of Scotland and Northern Ireland.

What is the Code of Practice?

Chapter 3, Part 2 of the Police, Crime, Sentencing and Courts Act 2022 establishes for the first time, a clear statutory basis for the extraction of information from electronic devices with the agreement of the device user, and introduces safeguards to protect the privacy of victims, witnesses, and others.

The new powers and the code of practice will ensure that there is a consistent approach to requesting the information from phones and other electronic devices, and that in all cases, requests to victims and witnesses are necessary and proportionate. The code also makes clear that the powers should only be used as last resort.

The code sets out the processes and safeguards governing the use of the extraction powers by law enforcement agencies, including the police. The new powers and the code introduce a set of strict criteria that limit the amount of sensitive personal information that can be extracted from the devices used by complainants and witnesses. The code gives detail on how the relevant powers should be used, including examples of best practice. It is intended to provide detailed guidance on the lawful use of these powers and to ensure the highest standards of professionalism and compliance with this legislation. The code also provides a summary of some of the relevant Human Rights and Data Protection requirements and considerations. It does not replace other codes of practice or guidance for other legislation.

The code is intended to guide those law enforcement and public authorities which can exercise the powers under Part 2, Chapter 3 of the Police, Crime, Sentencing and Courts Act 2022, but may also be useful to other agencies and professionals who support victims and witnesses.

Why are we consulting?

Under the Police, Crime, Sentencing and Courts Act 2022, the Secretary of State is required to prepare a code of practice containing guidance about the powers in sections 37(1) and 41(1) of the Act.

In preparing the code, the Secretary of State must consult:

(a) the Information Commissioner

(b) the Scottish Ministers

(c) the Department of Justice in Northern Ireland

(d) the Commissioner of Victims and Witnesses

(e) the Domestic Abuse Commissioner

(f) the Commission for Victims and Survivors for Northern Ireland, and

(g) such other persons as the Secretary of State considers appropriate

We are taking the opportunity to consult the bodies listed above as well as all who may be affected by these powers.

Following consultation, the Secretary of State will consider any representations made about the draft code. The code will be laid before Parliament before it can come into effect.

Extraction powers – Summary

Section 37 – Extraction power

Defines the criteria that must be met to use the extraction power for the purposes of:

• preventing, detecting, investigating or prosecuting crime
• helping to locate a missing person
• protect a child or an at-risk adult from neglect or physical, mental or emotional harm

Section 38 – The application of section 37 where the device user is a child or an adult without capacity

Defines who can make decisions on behalf of a child or an adult without capacity.

Section 39 – Requirements for voluntary provision and agreement

Defines the information that must be provided and the criteria that must be met to ensure that the device has been voluntarily provided and agreement lawfully obtained.

Section 40 – Three special cases where the section 37 power can be used without agreement

May be used when:

• the user of the device has died, and the person was a user of the device immediately before their death

or

• the user of the device is a child or an adult without capacity, and the user’s life is at risk or there is a risk of serious harm to them

or

• the user of the device is missing, they were a user of the device immediately before they went missing, and their life is at risk or there is a risk of serious harm to them

Section 41 – Extraction power

Defines the criteria that must be met to use the extraction power for the purposes of assisting an investigation into the person’s death where the device user has died, and they were a user of the device immediately before their death under:

• Chapter 1 of Part 1 of the Coroners and Justice Act 2009
• the Coroners Act (Northern Ireland) 1959
• an investigation into the person’s death by the Lord Advocate
• for the purposes of determining whether an investigation should be conducted, or an inquest should be held

Section 42 – Code of practice

Requires the Secretary of State to prepare a code of practice containing guidance about the exercise of the powers in sections 37(1) and 41(1).

Defines who must be consulted on the code of practice.

Section 43 – Confidential information

Defines the meaning of “confidential information” for the purposes of the section 37 and 41 powers.

Section 44 – Authorised persons

Defines with are authorised persons for the purposes of the section 37 and 41 powers.

Contact details and how to respond

Responses can be submitted online

Enquiries (including requests for the paper in an alternative format) to:

email: PCSCExtractioncode@homeoffice.gov.uk

or by post to:

The Extraction of information code of practice consultation
The Data and Identity Directorate
2 Marsham Street
London
SW1P 4DF

Complaints or comments

If you have any complaints or comments about the consultation process you should contact the Home Office at the above address.

Publication of response

A paper summarising the responses to this consultation will be published. A response paper will be available online at www.gov.uk/government/consultations.

Consultation principles, disclosure of responses and data protection

The principles that government departments and other public bodies should adopt for engaging stakeholders when developing policy and legislation are set out in the consultation principles.

The Home Office, 2 Marsham Street, London, SW1P 4DF, is the data controller in respect of any information you provide in your answers. Your personal data is being collected and processed by the Home Office on the basis of informed consent. We will hold the data you provide for a maximum of 2 years. Further information can be found within the Government’s Home Office Personal Information Charter.

We will process the names and addresses and email addresses provided by respondents, and information about which organisations respondents belong to, where this is provided. We will also process the information that you provide in relation to your responses. When the consultation ends, we will publish a summary of the key points raised on the Home Office website.

This will include a list of the organisations that responded, but not any individual’s personal name, address, or other contact details. All responses and personal data will be processed in compliance with the Data Protection Act 2018 and the UK General Data Protection Regulation.

If you want some or all of the information you provide to be treated as confidential, it would be helpful if you could clearly identify the relevant information and explain why you consider it confidential in your response. Please note that we may be required by law to publish or disclose information provided in response to this consultation in accordance with the access to information regimes: primarily the Freedom of Information Act 2000 and the Data Protection Act 2018 and the UK General Data Protection Regulation. If we receive any request to disclose this information, we will take full account of your explanation, but cannot give you an absolute assurance that disclosure will not be made in any case. We will not regard an automatic disclaimer generated by your IT system as a relevant request for these purposes.

Once you have submitted your response to the consultation you will not be able to withdraw your answers from the analysis stage. However, under the Data Protection Act 2018 (and the UK General Data Protection Regulation), you have certain rights to access your personal data and have it corrected or erased (in certain circumstances), and you can withdraw your consent to us processing your personal data at any time. You have the right to lodge a complaint to the Information Commissioner’s Office about our practices, to do so please visit the Information Commissioner’s Office website or contact the Information Commissioner at casework@ico.org.uk or:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Textphone: 01625 545860

Monday to Friday, 9am to 4:30pm

If you need any further information please contact us at: PCSCExtractioncode@homeoffice.gov.uk.