Consultation outcome

Government response to Extraction of Information from electronic devices code of practice (accessible)

Updated 16 March 2023

Introduction

1. The Police, Crime, Sentencing and Courts (PCSC) Act 2022 introduces a clear legal basis for authorised persons^{[footnote 1]} to obtain and extract information from electronic devices, where there is agreement from the device user. With so much more of our lives being lived online, the ability to extract information from devices can be a crucial factor in bringing offenders to justice. We must ensure that victims and witnesses are confident they will be treated with sensitivity and dignity when reporting crimes and that their rights to privacy are protected.

2. An authorised person can exercise the extraction of information powers for the purposes of:

• preventing, detecting, investigating or prosecuting crime,

• helping to locate a missing person, or

• protecting a child or an at-risk adult from neglect or physical, mental or emotional harm.

3. These powers strengthen the law to ensure there is a consistent approach to requesting information from phones and other electronic devices, and that in all cases, requests to extract information held on an electronic device are only made when necessary and proportionate, in line with a reasonable line of enquiry.

4. The extraction of information powers are supported by a statutory code of practice that provides guidance to authorised persons on when and how to exercise these powers. Authorised persons using the powers must have due regard to the code, meaning that the code is an important piece of guidance, it will be admissible in evidence and failure to comply with the code may result in action being taken by the court.

5. In May 2022, the Home Office launched a public consultation on the draft ‘Extraction of Information from electronic devices: code of practice’ to seek views on the guidance it contained for authorised persons seeking to exercise the extraction of information powers in the Police, Crime, Sentencing and Courts (PCSC) Act 2022.

6. This document is the post-consultation report for the consultation paper and provides a summary of the responses received and the government response to these. It covers:

• the background to the consultation

• a summary of the consultation responses

• a detailed response to the specific questions in the consultation paper

• conclusion and the next steps following this consultation

• consultation principles

Contact details

7. Further copies of this report and the consultation paper can be obtained by contacting Extractionofinformationcode@homeoffice.gov.uk or by writing to the Data and Identity Unit at the address below:

Data and Identity Unit
Extraction of Information code of practice

Home Office

2 Marsham Street

London
SW1P 4DF

Email: Extractionofinformationcode@homeoffice.gov.uk

8. This report is also available at Extraction of information from electronic devices: code of practice

9. Alternative format versions of this publication can be requested from Extractionofinformationcode@homeoffice.gov.uk

Complaints or comments

10. If you have any complaints or comments about the consultation process, you should contact the Home Office at the above address.

Background

11. The consultation paper on the ‘Extraction of Information from electronic devices: code of practice’ was launched on 17 May 2022. It was a public consultation which invited respondents to provide comments, views or concerns on the draft code of practice, prepared by the Home Office and which contained guidance about the powers in sections 37(1) and 41(1) of the Police, Crime, Sentencing and Courts (PCSC) Act 2022.

12. The consultation paper set out the powers introduced in the PCSC Act 2022 and the requirement for the Secretary of State to issue a code of practice containing guidance about the use of these powers. The consultation also named a number of statutory consultees who must be consulted on this code.

13. The consultation asked respondents to consider the guidance provided in each part of the code of practice and provide a response as to whether they ‘strongly agree’, ‘agree’, ‘neither agree nor disagree’, ‘disagree’ or ‘strongly disagree’ with the questions being asked. Where relevant, they were asked to consider this separately for the power in Section 37 and for the power in Section 41. They were further asked to consider if the guidance in the code could be implemented operationally, if there were any gaps in the guidance that should be addressed and if the code contained all relevant links to other information. Respondents were also able to provide a rationale for their answer.

14. The consultation period was initially due to run for 8 weeks and close on 12 July, but this was extended by one week to ensure all interested parties and statutory consultees were able to respond, it therefore closed on 19 July. This report summarises the responses received from this consultation, including how these responses have helped shape the final draft of the code.

15. A list of the types of respondents who have engaged in this consultation is at Annex A.

Summary of responses

How responses were received

16. A total of 83 responses to the consultation paper were received. Of these:

• 31 were received by email to the Gov.uk email address set up for the consultation

• 52 were received online via the consultation survey link

17. Fifteen of the email returns, from a mixture of respondent types, were thematic responses to the code. This means that rather than responding to the specific questions set out in the consultation paper they provided an overall summary of feedback on the drafted code of practice, such as feedback on the application of the Human Rights Act and Data Protection Act the draft code provided. They included comments on aspects of the code they welcomed and areas they felt were missing or needed to be amended.

Respondent types

18. Of the 52 online responses 17 provided no response to any questions.

19. The online responses came from the following respondent types:

• 14 were from authorised persons named in Schedule 3 of the act

• 1 was from another government body

• 1 was from a third sector/non-governmental organisation

• 36 did not record a name or state the type of organisation they represented

20. The 31 email responses came from the following respondent types:

• 11 were from authorised persons named in Schedule 3 of the act,

• 6 were from Independent Commissioners,

• 5 were from other government bodies,

• 4 were from a third sector/non-governmental organisation,

• 3 were from legal professional bodies,

• 2 were from members of the public

21. One of the third sector/non-governmental organisations returns received by email represented the collaborated views of 9 non-governmental organisations (NGO). These NGOs were a range of civil society and privacy focused groups.

Positive feedback

22. The consultation survey provided all respondents the opportunity to provide comments alongside their answers to the questions in the consultation paper to give further detail of their feedback on the code of practice. These included generally positive feedback about the clarity of the code with one authorised person providing a comment stating:

The guidance the code of practice provides on the circumstances in which the powers can be used and requirements met is clear, easy to understand and unambiguous in relation to victims and witnesses.

A further comment from another authorised person stated:

The guidance clearly sets out the circumstances and the grounds for using these powers.

23. We also received comments from respondents on the areas of the code they thought were useful and helpful for an authorised person to have detail on when exercising these powers. These included positive feedback on:

• the data protection, GDPR and human rights section

• the guidance relating to children and adults without capacity and the need to obtain their views given they are unable to provide their own agreement to the extraction of their information

• the detail provided on how to determine the correct legal power to use and how to confirm the extraction of information is necessary and proportionate

Summary of feedback that has been taken forward

24. We received comments from respondents on additional guidance they felt the code needed to include or where amendments were required. All comments were analysed to identify areas where respondents believed that it should be updated either because the draft was deemed to be unclear, misleading or offered insufficient guidance to authorised persons on when and how to extract information from an electronic device.

25. Many respondents gave examples of specific wording or suggested themes/topics they would like the code to include. All suggestions were reviewed and where possible, these have been accepted and updated within the code of practice. This has included, but is not limited to, updates to the following aspects of the code of practice:

• the action that should be taken with regards to information that is extracted but that is not relevant to the investigation

• reference to and capturing of aspects of other legislation, such as referencing independent guardians, which are specific roles created under s.21 of the Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015 and who can assist in making a decision on behalf of a child

• the types of devices that the extraction of information powers relate to; as some respondents felt the guidance in the code was primarily aimed at the extraction of information from a mobile phone and that further detail should be included to cover other types of electronic devices, such as CCTV devices

• the breadth of the definition of vulnerability and what it means to be vulnerable, as well as the support that should be offered to vulnerable people and the need to include specific references to the Victims Code

• the detail of information that should be provided to the device user within the written notice

• the action to be taken when confidential information is extracted

• the interpretation of certain aspects of the extraction of information powers in the code, such as what is meant by ‘immediately before they went missing’, and ‘immediately before their death’ in relation to circumstances where agreement from the device user is not required

• greater detail and better safeguards to explain what constitutes agreement, including how agreement should be recorded, the device user being provided with access to an interpreter where needed, and which other means of obtaining the information have been explored

• detail on the possible outcomes of failing to comply with the code of practice

Summary of feedback that has not been taken forward

26. Not all the feedback we received could be adopted in the final version of the code of practice. This includes the following:

• inclusion of case studies or scenarios in which the powers will be exercised

• further detail on the use of other powers or pieces of legislation, such as further guidance on PACE powers and the inclusion of details of the United Nations Conventions on the Rights of the Child (UNCRC)

• a requirement that authorised persons should procure technology options that ensure the most selective extraction methods can be used when extracting electronic information

• further detail on the extraction of information and related issues not covered by the powers in the act, such as:

  • guidance on the extraction of remotely stored electronic data
  • the provision of free legal advice to victims
  • the collection of third-party material, such as education or medical records
  • a right for victims to request an independent review of the request being made to extract information from their electronic device through these powers

27. Many of these issues are outside the scope of either the PCSC Act or the code and therefore could not be included. In some instances, further legislation or significant operational changes would be required to implement the feedback received.

28. The recommendation for victims to be able to make their own request for an independent review of the extraction of information request they have been asked to provide agreement on was not taken forward. The government is currently conducting a pilot with Thames Valley police which provides rape and sexual assault victims the opportunity to challenge police requests to access personal information, such as digital material and material held by third parties (such as GPs, social services or schools etc.). This pilot allows victims to request a review by a senior officer to determine whether the information request is proportionate and in accordance with reasonable lines of enquiry. This pilot is ongoing and requires evaluation before considering wider implementation.

29. Specific detail on what has and has not been taken forward in the final version of the code of practice following the feedback from respondents is set out in the section ‘Responses to specific questions’ below.

Responses to specific questions

Q1 (a) To what extent do you agree or disagree with the guidance the code of practice provides on the circumstances in which the powers can be used and the requirements that must be met for section 37?

Response to Q1 a	Total
Strongly agree	5
Agree	21
Neither agree nor disagree	8
Disagree	6
Strongly disagree	2
Blank (no response)	41
Total	83

Summary of feedback

30. Of those who responded that they ‘strongly agree’, or ‘agree’ to this question, twelve were from authorised persons, two were from a government body, two were from Independent Commissioners, one was from a legal professional body, one was from a member of the public and eight did not state where they were from.

31. Of those who responded that they ‘disagree’ or ‘strongly disagree’, three were from third sector/NGO organisations, three did not state their organisation and two were from authorised persons. One of those who ‘disagreed’ with the guidance in this section stated that this code should contain guidance about when other powers should be used. Another asked that the explanation of what an electronic device is be expanded as they felt the code focused too heavily on guidance relating to mobile phones.

32. Those who ‘agreed’ with the guidance in this section responded that it was clear and accurately set out the requirements of the PCSC Act.

33. Additional comments received from respondents included requests for the purposes of Section 37 to be stated at the beginning of this part of the code to ensure that authorised persons were clear which purposes the section related to. Others asked for clarification on how these powers should be used where a device may have multiple users and for further clarification on what the term ‘immediately before they went missing’ means when considering use of the powers where a person is missing.

34. A number of respondents sought further detail on the consequences of failing to follow the code and requested examples of which parts of the police code of ethics might be breached if a police officer failed to adhere to this code of practice.

35. Further feedback was provided by multiple respondents to define ‘harm’ and ‘serious harm’ and to include further information on other powers which may be used to extract information where the device user refuses to provide agreement under the powers of the PCSC Act.

Government response

36. We have not taken forward the suggestion to include information on other powers which can be used to extract information as this code of practice focuses solely on the exercising of the extraction of information powers within the PCSC Act.

37. The references to ‘harm’ and ‘serious harm’ in the Act are based upon the wording in the Data Protection Act (DPA) 2018. There is no definition in the DPA for these terms beyond ‘harm’ meaning both physical and mental harm. A specific definition for these terms has not been included in the code of practice either beyond confirming that ‘harm’ may also include financial abuse or coercive control.

38. The code has been updated to:

• make clear the purposes for which the power in Section 37 can be used

• expand on the consequences of failing to adhere to the code

• assist the reader in having further guidance on what ‘immediately before they went missing’ means

• provide further detail about applicable electronic devices, so that it is clear the guidance doesn’t just refer to the extraction of information from mobile phones

• include details on how to proceed if a device has multiple users.

Q1 (b) To what extent do you agree or disagree with the guidance the code of practice provides on the circumstances in which the powers can be used and the requirements that must be met for section 41?

Response to Q1 b	Overall response
Strongly agree	3
Agree	17
Neither agree nor disagree	10
Disagree	4
Strongly disagree	1
Blank (no response)	48
Total	83

Summary of feedback

39. Of those who responded that they ‘strongly agree’ or ‘agree’ to this question, eleven were authorised persons, one was from a government body, one was from an Independent Commissioner, one from a legal professional body, one was from a member of the public and five did not state where they were from.

40. Of those who responded with ‘strongly disagree’ or ‘disagree’ to this question, one was from an authorised person, one from a third sector/non-government organisation and three did not state where they were from.

41. A respondent who ‘agreed’ that the guidance in this section was appropriate also asked that the code include more information about powers of seizure available to Coroners.

42. Two respondents asked for additional information on what ‘immediately before they died’ means when using the power in section 41. An Independent Commissioner asked for clarity in the code about data protection law and deceased persons.

Government response

43. In order to ensure that the reader fully understands what is meant by ‘immediately before they died’, we have provided a more comprehensive explanation supported by an example. We have also provided more detail on the considerations that should be made when examining a deceased person’s device that may contain another identifiable living person’s personal information.

44. The code has not been updated to include guidance on other powers available to coroners as this does not fall within the remit of this code.

Q2. (a) To what extent do you agree or disagree with the guidance that the code of practice provides on the exercise of the powers in accordance with data protection and human rights legislation for section 37?

Response to Q2 a	Overall response
Strongly agree	4
Agree	24
Neither agree nor disagree	5
Disagree	1
Strongly disagree	3
Blank (no response)	46
Total	83

Summary of feedback

45. Of those who responded that they ‘strongly agree’ or ‘agree’ to this question, fifteen were authorised persons, two were from Independent Commissioners, two were from a government body, one was from a legal professional body, one was from a member of the public and seven did not state where they were from.

46. Of those that responded ‘strongly disagree’ or ‘disagree’ to this question, three were from third sector/non-governmental organisations and one did not state where they were from.

47. Several respondents remarked that they found the guidance to be clear and concise and that it provided sufficient detail on data protection and human rights considerations. Of those who ‘strongly disagreed’, two were third sector /NGOs who were concerned with wider government activity on human rights and data reform and how future changes to legislation would affect the current legal protection provided.

48. Clarity was sought on how Article 6 of the HRA interacts with the code of practice, with the following suggestions being made:

• One professional body suggested that further guidance was needed to explain how Article 8 and Article 6 interact and may be weighed up against each other

• One Independent Commissioner stated that they were pleased to see Article 8 rights “front and centre” of the code

• A direct link was requested to the Data Protection Act (DPA) 2018 by one respondent

• A civil society organisation suggested that the code should require all forces to carry out a Data Protection Impact Assessment and an Equality Impact Assessment before using the powers

49. Another Independent Commissioner recommended that further clarity was needed on the differences between ‘agreement’ and ‘consent’ under the DPA.

Government response

50. In response to the feedback we have received for this question we have:

• expanded existing guidance in Part 2: Human Rights and Data Protection section to include reference to the Equality Act 2010

• added additional references to relevant existing guidance, such as the Attorney Generals Guidance on disclosure, to assist authorised persons in balancing the Article 8 right ECHR to private and family life and the right to a fair trial under Article 6 ECHR

• included a recommendation that authorities named on Schedule 3 should consider whether there is a need to complete or update an existing Data Protection Impact Assessment

• added a direct reference to the Equality Impact Assessment for the act that demonstrates compliance with the Public Sector Equality Duty (PSED)

• provided clarity on the differences between the voluntary provision of a device, the agreement to extract information from it, and processing information using ‘consent’ under the DPA 2018 making it clear that in most cases ‘consent’ should not be considered an appropriate authority to process personal information.

Q2. (b) To what extent do you agree or disagree with the guidance that the code of practice provides on the exercise of the powers in accordance with data protection and human rights legislation for section 41?

Response to Q2 b	Overall response
Strongly agree	5
Agree	18
Neither agree nor disagree	7
Disagree	1
Strongly disagree	1
Blank (no response)	51
Total	83

Summary of feedback

51. Of those who responded with ‘strongly agree’ or ‘agree’ to this question, eleven were from authorised persons, two were from a government body, one was from an Independent Commissioner, one was from a legal professional body, one was from a member of the public and seven did not state where they were from.

52. Of those who responded with ‘strongly disagree’ or ‘disagree’ to this question, one was from a third sector/non-governmental organisation, and one did not state where they were from.

53. An authorised person suggested that this section of the code was effective in setting out the rights confirmed to individuals by the listed legislation and regimes but recommended that further guidance is provided on how Article 6 of the HRA interacts with the code of practice. A member of the public and a police force commented that this section of the code was straightforward and clear. An anonymous respondent raised concern that they believed the emphasis on protecting the privacy rights of device users was a fairness risk to the defendant. An Independent Commissioner recommended that the code emphasises that authorised persons must still meet the requirements of data protection legislation where a deceased person’s device is likely to contain personal information relating to identifiable living persons.

Government response

54. Following a review of the comments received the following changes were made to the code of practice:

• further guidance has been added to Part 2: Human Rights and Data Protection section, emphasising the need to balance the Article 8 right ECHR to private and family life with the right to a fair trial under Article 6 ECHR

• further detail has been provided to make it clear in the code that all legislative requirements, including disclosure rules, must be met, and followed, when using the section 37 or 41 extraction powers

• emphasis has been made on the need for authorised persons to consider data protection legislation even when examining a deceased person’s device because of the likelihood that it contains personal information relating to identifiable living persons.

Q3. (a) To what extent do you agree or disagree with the guidance offered in the code on assessing necessity, proportionality, relevance to reasonable line of enquiry or reasonable belief when determining when the powers in sections 37 and 41 should be used for section 37?

Response to Q3 a	Overall response
Strongly agree	5
Agree	19
Neither agree nor disagree	3
Disagree	4
Strongly disagree	2
Blank (no response)	50
Total	83

Summary of feedback

55. Of those who responded that they ‘strongly agree’ or ‘agree’, sixteen were authorised persons, four did not state where they were from, one was an Independent Commissioner, one was a government body, one was a member of the public, one was from a legal professional body and four did not state where they were from.

56. Of those who responded that they ‘strongly disagree’, or ‘disagree’ two were Independent Commissioners, one was an authorised person, one was from a third sector/non-governmental organisation and two did not state where they were from.

57. Some of the blank responses are those where an email return was submitted with a thematic response to the survey that did not offer responses to specific questions. Any relevant information in those responses has been considered in this section. Feedback in this section included that there should be time limits on extraction, storage and retention.

58. Respondents who agreed with this section said that it was well thought out, clear and one added that they were pleased to see references to the Bater-James judgment^{[footnote 2]}. Respondents also commented that the code should highlight other relevant training or guidance that authorised persons should follow when making decisions about necessity and proportionality. Another asked that the guidance regarding the sanctioning officer be expanded to ensure that those bodies with an existing position on the grade or rank of person who can perform this role are not in conflict with the guidance in the code.

59. Those who disagreed with the guidance in this section referenced their support for the comments of one of the Independent Commissioners which sought further and more detailed guidance on less intrusive means and how to meet the test of ‘reasonably practicable’ as well as seeking scenarios to better explain the use of the powers. This Independent Commissioner also stated that the code did not accurately state the position in the Data Protection Act 2018 that data extraction must be minimised, and further that the code should set the expectation that police forces in England and Wales use the Digital Processing Notice (DPN) created by the NPCC as the written notice. Another Independent Commissioner, supporting the first also responded that the code should be clarified on the position regarding multiple users, what undue pressure is, how to assess the value of the information that is sought. Both these Independent Commissioners called for the code to contain an instruction to offer victims free legal advice.

60. A further respondent was specifically concerned with the application of these powers to different types of CCTV.

Government response

61. The following changes have been made to the code of practice following the feedback to this question:

• a section has been included in the code of practice on the retention and deletion of extracted information

• updated guidance on the rank or grade or the sanctioning officer

• updated guidance on the ways in which an authorised person can be satisfied that there are no other means of obtaining the information that is sought and how to assess whether it would be reasonably practicable to use other means

• updated wording around the data minimisation obligations in the Data Protection Act 2018

• updated the position regarding the use of the NPCC DPN by police forces in England and Wales

• guidance has been added on how an authorised person is to proceed if a device has multiple users

• an example has been added of what may constitute undue pressure to ensure that this is avoided when information from a device is sought by an authorised person

• further guidance has been included regarding the appropriate application of the powers when extracting information from CCTV.

62. The request to include in the code that all victims should be offered free legal advice cannot be actioned at this time. The Ministry of Justice has consulted on options to enhance legal support or advice for victims of rape or serious sexual assault regarding personal information requests, including police requests for mobile phone downloads and social media records. The results of this consultation are being reviewed and next steps will be announced in due course.

63. Additionally, the request to include time limits on the extraction process has not been included in the code of practice due to the range of technical capabilities available within different forces and device types and models that would affect how long the extraction process takes. We have however stated that authorised persons must choose the most selective extraction method available to them when undertaking this process and ensure devices are returned to the device user as quickly as possible.

Q3. (b) To what extent do you agree or disagree with the guidance offered in the code on assessing necessity, proportionality, relevance to reasonable line of enquiry or reasonable belief when determining when the powers in sections 37 and 41 should be used for section 41?

Response to Q3 b	Overall response
Strongly agree	4
Agree	14
Neither agree nor disagree	5
Disagree	1
Strongly disagree	1
Blank (no response)	58
Total	83

Summary of feedback

64. Of those who responded that they ‘strongly agree’ or ‘agree’ with the guidance in this section twelve represented authorised persons, three didn’t state their organisation, one represented a government body, one a legal professional body and one was a member of the public.

65. Of the remaining respondents who indicated a response, four authorised persons and one respondent who did not state their organisation responded that they ‘neither agree nor disagree’. One third sector/non-government organisation responded that they ‘disagree’ and one responded that they ‘strongly disagree’, who did not state their organisation.

66. Overall respondents were supportive of the detail and guidance offered in this section, one respondent asked for further guidance on what ‘immediately before they died’ means and how to apply this. Another asked for further guidance on how to ensure all other methods of obtaining the information have been considered and another if the code could contain more information about powers available to a coroner. In addition, one respondent asked for similar clarification (as in Q3 a) on the grade or rank of the sanctioning officer.

Government response

67. We have taken the follow action in response to the feedback received on this question:

• updated the code with additional explanations for how to interpret ‘immediately before they died’

• updated guidance on the rank or grade of the sanctioning officer

• updated guidance on the ways in which an authorised person can be satisfied that there are no other means of obtaining the information that is sought

68. The code does not contain further guidance on the powers of a coroner as this does not fall within the remit of this code.

Q4. To what extent do you agree or disagree with the guidance the code of practice provides on how authorities meet the requirements stated in section 37(1) in the Act, to ensure a person has voluntarily provided their device and agreed to the extraction of information from it?

Response to Q4	Overall response
Strongly agree	3
Agree	17
Neither agree nor disagree	3
Disagree	6
Strongly disagree	1
Blank (no response)	53
Total	83

Summary of feedback

69. Of those who responded that they ‘strongly agree’ or ‘agree’ to this question, fourteen were from authorised persons, two were from a government body, one from an Independent Commissioner, one from a legal professional body and two did not state where they were from.

70. Of those who responded that they ‘strongly disagree’ or ‘disagree’ to this question, three were from authorised persons, two were from Independent Commissioners, one was from a third sector/non-governmental organisation, and one did not state where they were from.

71. Of those that responded ‘strongly agree’, ‘agree’, or ‘neither agree nor disagree’, one authorised person remarked that they found the draft code provided clear and useful guidance on how to ensure that a person had voluntarily provided a device and that there was agreement as to what information could be extracted from it. Another authorised person stated that they were confident that the guidance would aid them in complying with duties regarding data extraction. Other feedback included comments that they found it helpful that the code required the police to use data processing notices (DPN). One authorised person suggested that the guidance on the DPNs and the forms themselves should be more streamlined. One professional body was supportive of the requirement to provide a written notice and to obtain agreement in writing.

72. Of those that responded ‘disagree’ or ‘strongly disagree’, one anonymous respondent ‘strongly disagreed’ with the requirement for device users to freely volunteer their device as they believed this could result in miscarriages of justice where a complainant could make a false accusation and then not provide agreement for information to be extracted from their device. Several police respondents requested further guidance on how to avoid undue pressure when seeking agreement and engaging with device users. One Independent Commissioner recommended that victims of domestic abuse should be offered the support of an organisation which can provide the support of an independent domestic violence advocate (IDVA) or other advocacy support. They also recommended that where a victim is from a minority community, they should be offered the option to be referred to a specialist organisation run by, or for, that minority community, and that that the written notice should be provided in a range of languages, including braille, sign language and in an easy read format. This Independent Commissioner wholly supported the recommendation made by the Joint NGO Response to the consultation that where language is a barrier to an individual understanding any aspect of the request, an interpreter or other communication support must be made available, otherwise the person cannot be deemed to have given agreement. A police force requested further guidance on the application of the extraction powers in urgent cases and where there were multiple devices belonging to the same complainant or witness requiring examination.

Government response

73. In response to the feedback received to this question we have:

• updated the code with further clarity on what information is required to be provided to a device user in writing and the written notice and agreement section of the code has been improved to make it even clearer what information must be provided to the device user.

• added an example of what may constitute undue pressure to ensure that this is avoided when information from a device is sought by an authorised person.

• included a recommendation to refer a device user to, or seek the support of, a number of different professionals during the process, to Parts 4 and 5 of the code. This includes for example, a language interpreter, an intermediary, an Independent Domestic Violence Advocate (IDVA), or an Independent Sexual Violence Advisor (ISVA). Additionally, where the victim is from a minority community, the code now states the victim should be offered the option of being referred to a specialist organisation run by, or for that minority community.

• made it explicit within the code that where the person does not speak English or is deaf, the services of an interpreter must be provided.

• added additional clarity to the code to confirm the requirements for when a sanctioning officer can provide urgent oral authority to examine a device.

• updated guidance on the process for obtaining agreement where there is more than one relevant device with information that supports the reasonable line of enquiry.

Q5. To what extent do you agree or disagree with the guidance that the code of practice provides on how to recognise when a person is vulnerable?

Response to Q5	Overall response
Strongly agree	5
Agree	15
Neither agree nor disagree	2
Disagree	3
Strongly disagree	2
Blank (no response)	56
Total	83

Summary of feedback

74. Of those who responded ‘strongly agree’ or ‘agree’ with the guidance in this section, thirteen were from authorised persons, one was from a third sector/non-governmental organisation, two were from a government body, one was from a member of the public, one was from a legal professional body and two did not state where they were from.

75. Of those who responded either ‘strongly disagree’ or ‘disagree’ to this question, two were from authorised persons, two were from Independent Commissioners and one did not state where they were from.

76. One of those respondents who ‘strongly agreed’ said ‘It is very clear from the guidance on how to recognise a vulnerable person’ another who ‘agreed’ with the guidance in this part of the code said, ‘we agree with this guidance, and believe that it provides a clear framework for assessing whether a person is vulnerable.’ Another ‘agreed’ but was concerned that the draft suggested that all these people are vulnerable rather than that they may be vulnerable. Another who ‘agreed’ felt that this was a complex area and more could be done to call out the breadth of the definition of who might be vulnerable.

77. Those who ‘disagreed’ with the guidance in this section felt that the guidance did not sufficiently set out how trauma may impact a victim or survivor and that this section should be given further consultation with domestic abuse organisations. Another felt that the guidance did not explain how vulnerabilities may overlap, commenting ‘the approach an authorised person may need to take with someone who is vulnerable due to trauma may be different to the approach they take with someone who is vulnerable because of a learning disability, which depending on the severity may mean they also fall into the category of being an adult without capacity’.

Government response

78. In response to the feedback received for this question we have:

• updated the code to offer further guidance on the impact of trauma and overlapping trauma

• provided detailed and specific guidance on the use of the powers where the device user is an adult without capacity is contained in Part 6 of the code but where relevant has been highlighted again here

• updated the code with the guidance on the importance of ensuring the device user has access to independent support from a professional service, such as an Independent Domestic Violence Advisor (IDVA)

79. We have updated the code of practice with suggested changes to ensure there is support in place for victims of domestic abuse. For this reason and due to a lack of additional time in the consultation period, it was not possible to take action in response to the suggestion to consult further with those representing victims of domestic abuse.

Q6. To what extent do you agree or disagree with the guidance that the code of practice provides on how a vulnerable person should be supported?

Response to Q6	Overall response
Strongly agree	4
Agree	15
Neither agree nor disagree	4
Disagree	1
Strongly disagree	1
Blank (no response)	58
Total	83

Summary of feedback

80. Of those who selected ‘strongly agree’, or ‘agree’ in response to this question, fourteen were authorised persons, two were from a government body, one from a legal professional body, one from a member of the public and one did not state their organisation.

81. Of those who responded that they ‘strongly disagree’ or ‘disagree’ with the guidance, one was from an Independent Commissioner, and one did not state where they were from.

82. Of those who ‘agree’, one respondent commented ‘We agree with the guidance, which will assist us in supporting and safeguarding vulnerable people’. Another respondent who selected ‘neither agree nor disagree’ stated that ‘the Victims’ Code and our responsibilities to vulnerable victims should be mentioned in this section’.

83. The Independent Commissioner who responded that they ‘disagree’ with the guidance in this section stated that where possible, the support offered should be specialised and again called for all victims to be offered free independent legal advice. This comment was supported by other victim focused groups.

Government response

84. The code has been updated to reflect that vulnerable people should be offered specialist support and that a family member may not be able to help in the same way. The code has also been updated with specific references to Independent Domestic Violence Advisors (IDVA) and when support from an IDVA should be offered.

85. We have updated the code with further detail to make explicit that where the individual is a victim and survivor of domestic abuse, they should be offered a referral to an organisation which can provide the support of an independent domestic violence advocate or other advocacy support. We have also made clear that where a victim is also from a minority community, they should be offered to be referred to a specialist organisation run by, or for that minority community.

86. As previously noted, the request for all victims to be offered free independent legal advice cannot be included in this code of practice. The Ministry of Justice has consulted on options to enhance legal support or advice for victims of rape or serious sexual assault regarding personal information requests, including police requests for mobile phone downloads and social media records. The results of this consultation are being reviewed and next steps will be announced in due course.

Q7. To what extent do you agree or disagree with the guidance the code of practice provides on who is considered a child, how authorities must where possible involve and support them, and who can make decisions on their behalf?

Response to Q7	Overall response
Strongly agree	5
Agree	13
Neither agree nor disagree	6
Disagree	1
Strongly disagree	1
Blank (no response)	57
Total	83

Summary of feedback

87. Of those who responded to this question ‘strongly agree’ or ‘agree’, thirteen were from authorised persons, one was from a government body, one was from an Independent Commissioner, one was from a member of the public and two did not state where they were from.

88. Of those who responded ‘strongly disagree’ or ‘disagree’, one was from a government body, and one did not state where they were from.

89. Of those that responded ‘strongly agree’ or ‘agree’, a police force commented that “This section clearly identifies who is deemed to be a child; this enables the appropriate assessment of individual needs, the creation of a bespoke support package and the definition of who the responsible person should be in specific circumstances”. Another police force recommended that the code expands the definition of harm to include coercive control and financial abuse. An Independent Commissioner recommended that the code should emphasise that whilst for these powers anyone under 18 is classed as a child, under data protection law for general processing activities, excluding information society services, there is no defined age for a child, and they have the same rights as adults over their personal data. Even with the appointment of an ‘alternative individual’, children with capacity should have the ability to exercise their rights under Data Protection law.

90. Of those that responded ‘disagree’, one Government body asked why Independent Guardians weren’t referenced under the section of who can make decisions on behalf of a child because there are specific roles set out in statute in the Human Trafficking and Exploitation (Criminal Justice and Support for Victims) Act (Northern Ireland) 2015.

91. An Independent Commissioner who responded that they ‘neither agree nor disagree’ with the guidance in this section suggested that the code would benefit from guidance for when a child makes an allegation against someone in the organisation that is caring for them or representing their interests.

92. A Government body, who did not indicate a response to this section and left their response blank, commented that the code should include specific wording to ensure that those representing a child act in their best interest and for their benefit.

Government response

93. The following changes have been made following the feedback received to this question:

• definition of harm within the code has been expanded to include coercive control and financial abuse

• emphasis that children have the same rights as adults over their personal data under data protection legislation has been added

• ‘Part 5: Use of the Section 37 power with vulnerable people’ has been updated to include reference to Independent Guardians

• guidance for when a child makes an allegation against someone in the organisation that is caring for them has been added to Part 6

• the suggested wording requested by the Government body to ensure that those representing a child act in their best interest and for their benefit has been amended

• the section ‘A responsible persons (Children)’ has been improved to make it explicit that where the decisions have been made on behalf of the child by a responsible person, the authorised person must, unless they consider it is inappropriate to do so, notify a parent or guardian that the power has been used and for what purpose and as soon as possible

• this section has also been updated to make clear that where it is not appropriate to notify a parent or guardian because they are a suspect in the investigation, or where the authorised person believes that revealing that information has been extracted will put the child at risk, the authorised person should consider notifying another parent or guardian.

Q8. To what extent do you agree or disagree with the guidance the code of practice provides on who is considered an adult without capacity, how authorities must where possible involve and support them, and who can make decisions on their behalf?

Response to Q8	Overall response
Strongly agree	6
Agree	8
Neither agree nor disagree	7
Disagree	2
Strongly disagree	0
Blank (no response)	60
Total	83

Summary of feedback

94. Of those who responded ‘strongly agree’ or ‘agree’ to this question, ten were from authorised persons, one was from a government body, one from a member of the public and two did not state where they were from.

95. No one responded ‘strongly disagree’ to this question, but of those that responded ‘disagree’ one was from a government body, and one was an Independent Commissioner.

96. Of those that responded ‘agree’ or ‘strongly agree’, one police force commented that “This section clearly identifies who is deemed to be an adult without capacity; this enables the appropriate assessment of individual needs, the creation of a bespoke support package and the definition of who the responsible person should be in specific circumstances”. Another stated that the section was very clear.

97. Of those that selected ‘neither agree nor disagree’, one response from an authorised person suggested that this section of the code could be clearer as capacity has the potential to be both a short- and long-term issue. A recommendation was made to reference the role of the Independent Guardian and to ensure that where appointed, they must be contacted in all decisions regarding the agreement.

98. An Independent Commissioner recommended that specialist services who work closely with disabled victims and survivors of domestic abuse should be able to provide support to the device user in making an informed decision and that the code of practice should be comprehensively clear for them to also follow.

Government response

99. We have made the following changes to the code of practice in response to the feedback received to this question:

• the role of the Independent Guardian has been referenced in ‘Part 5: Use of the Section 37 power with vulnerable people’

• we have amended and improved the code to better explain the many ways in which a person could be vulnerable and the potential ways in which it can affect capacity in both the short and long-term

• we have also included reference to the specialist support services that victims should be signposted to for additional support and agree that it is vitally important that the code is comprehensively clear to all those who will be following it, including these services.

Q9. To what extent do you agree or disagree with the guidance the code of practice provides on applicable devices for extraction, and the recommendation that selective extraction should be used where possible to minimise intrusion into the device user’s privacy?

Response to Q9	Overall response
Strongly agree	1
Agree	16
Neither agree nor disagree	1
Disagree	5
Strongly disagree	3
Blank (no response)	57
Total	83

Summary of feedback

100. Of those who responded ‘strongly agree’ or ‘agree’ to this question, eleven were from authorised persons, one was from a government body, one from an Independent Commissioner, one was from a member of the public, one from a legal professional body and two did not state where they were from.

101. Of those who responded ‘strongly disagree’ or ‘disagree’ to this question, six were from authorised persons and two did not state where they were from.

102. Several respondents sought clarity as to what electronic devices fall within the remit of the Section 37 and Section 41 extraction powers and questioned whether the code would govern the extraction of CCTV material.

103. Questions were asked as to whether the PCSC Act powers and code of practice were intended to assist in the recovery of electronic material from dash cams, body worn video or other personal electronic devices.

104. Some law enforcement respondents suggested that CCTV should be specifically excluded from the code on the basis that to include it would require significant changes to current police CCTV recovery practice.

105. Clarity was sought as to whether the code of practice was intended to be used in circumstances where the information being extracted from a device did not amount to personal information.

Government response

106. The section entitled: Part 3: Exercise of these powers has been updated to include an expanded definition of what is an applicable device for the purposes of the Section 37 and Section 41 powers, and specific guidance for the recovery of CCTV.

107. The code has been strengthened to make it clear that the powers can be used to obtain information from any electronic device or its component part, where information is stored electronically on it, and not merely accessible via it, making it explicitly clear that the powers do not allow for the extraction of information stored other than on a device.

108. The code provides guidance on the appropriate application of the powers for CCTV and suggests that it may be more appropriate for authorised persons to use alternative and existing powers to obtain and process CCTV material because of the often-speculative nature of CCTV lines of enquiry which may make it difficult to meet the requirements of the Section 37 and Section 41 powers.

109. The ‘Extracting information’ section of the code has been updated to make it clear that the authorised person must consider the power used to obtain the device and the powers used to extract the information, and where personal information is extracted and processed, that all the requirements of data protection legislation must be met.

110. The code has also been updated to include the recommendation from an Independent Commissioner that the code should be explicit in stating that information extracted should not exceed what is relevant and the speed of the extraction should not be prioritised over the ability to carry out selective extraction.

Q10. To what extent do you agree or disagree that with the approach the code of practice provides on how to assess and manage the risk of obtaining confidential material, and how to proceed when it is unintentionally obtained?

Response to Q10	Overall response
Strongly agree	1
Agree	14
Neither agree nor disagree	5
Disagree	4
Strongly disagree	0
Blank (no response)	59
Total	83

Summary of feedback

111. Of responses to the approach the code of practice provides on how to assess and manage the risk of obtaining confidential material and how to proceed when it is unintentionally obtained, one was ‘strongly agree’, and fourteen respondents were ‘agree’. These responses were from twelve authorised persons and two were from respondents who did not state where they were from.

112. These respondents commented that the code defines what confidential information is clearly and welcomed the inclusion of this section and how comprehensive it was. Some respondents felt more definitive detail needed to be included on what action should be taken when confidential information is unintentionally obtained, including whether the device user, or anyone else, should be made aware of this and if so, how they should be informed. Similarly, some commented on what should be done with data that is obtained in the extraction that is not relevant to the investigation. The majority of these respondents were from the police or were types of authorised persons.

113. Of the ‘blank’ responses to this question, a comment was made on the consistency of language used in this section of the code of practice as the guidance referred to both confidential information and confidential material. Comments have also been made that further guidance on how to reduce the risk of obtaining confidential information in the first place should be included and what action can be taken by an individual against an authorised person when their confidential information is extracted. Feedback also included requests for the authorised persons to be more explicit in asking the device user whether there is confidential information or privileged material on their device as it would be too difficult for the authorised person to determine this following extraction.

114. The respondents who selected ‘disagree’ were three authorised persons and one legal professional body who provided additional feedback for their reasoning for this, which included comments around clarifying who the code refers to when mentioning an authorised person, as multiple individuals are likely to be involved in the extraction of information from a device. Comments also included feedback on the guidance provided in the code regarding information protected by legal professional privilege and the definition that was included on this.

115. Respondents who selected ‘neither agree nor disagree’ made comments that mostly referred to the fact that the structure of the document had changed and the section on confidential information had moved from Part 8 of the code of practice to Part 3 which confused some respondents. There was one comment which provided feedback on the guidance in the code which refers to redacting and deleting information, which is not relevant to the investigation. The feedback provided advice that this guidance conflicts with other legislation and so a suggestion was made to instead refer to internal policies and procedures when information is extracted which is not relevant.

Government response

116. The code of practice has been updated to include further guidance on the action to be taken if an authorised person unintentionally obtains confidential information. The references to confidential material have now been amended so there is consistency in the language used in this section of the code. Guidance has also been included to specify that the authorised person should ask device users whether there is likely to be confidential information on their device in order to reduce the risk of obtaining it in the first place.

117. The code of practice still refers to ‘authorised persons’ undertaking certain actions rather than specific job roles as although multiple people will likely be involved in processes of the extraction of information these roles may differ between organisations. There are however greater references to referring to local guidance, policies and practices. The code has also been updated to clarify the specific actions that should be taken when information is extracted that relates to legal professional privilege.

Q11. In your view is the suggested approach to use of the powers detailed in the code one that can be implemented operationally?

Response to Q11	Overall response
Yes	18
No	6
Blank (no response)	59
Total	83
Strongly disagree	0
Blank (no response)	59
Total	83

Summary of feedback

118. Of those who responded ‘yes’, fourteen were authorised persons, one was a government body, one an Independent Commissioner and two did not state where they were from. Authorised persons who agreed that the approach can be implemented commented that many aspects (such as the use of the digital processing notice) were already in use.

119. Of those who responded ‘no’, two were authorised persons, one was from an Independent Commissioner, one from a third sector/non-governmental body and two did not state where they were from.

120. Of those who responded that the approach in the code could not be implemented, one was concerned about the application of the powers to CCTV, another with the advice regarding devices with multiple users. Others commented that the approach was good, but felt it would not bring the desired cultural change and another was concerned with the use of the powers as part of stop and search.

Government response

121. We have addressed issues relating to the use of the powers with types of CCTV and the guidance on the use of the powers makes clear the circumstances where they can be used and how the use is sanctioned.

122. The code and the powers form part of a wider government response to improving policing practice in this area, including training, and we are confident that this will contribute to a change in culture in the approach to requesting information from victims and witnesses.

Q12. Are there any gaps in the guidance that should be addressed?

Response to Q12	Overall response
Yes	21
No	8
Blank (no response)	54
Total	83
Strongly disagree	0
Blank (no response)	59
Total	83

Summary of feedback

123. Of those who responded ‘yes’, fourteen were from authorised persons, three were from third sector/non-governmental organisations, two were Independent Commissioners, one was from a government body, and one did not state where they were from.

124. Of those who responded ‘no’, three were authorised persons, three did not state where they were from, one was an Independent Commissioner, and one was a government body.

125. Respondents who reported that there were gaps in the guidance introduced a number of areas to consider including:

• the process if further lines of enquiry are identified post-extraction

• whether another the code should include more about the range of electronic devices that the powers apply to

• whether the code should offer further guidance on use of the powers where a person is missing or deceased

• the process for considering confidential information

• more information about the retention and disposal of information

• the consequences of failing to adhere to the code

• how to ensure that authorised persons are clear that the device is likely to contain information relating to third parties who will not be asked for their agreement for their information to be extracted

• more information in the code about the withdrawal of agreement.

Government response

126. All elements raised in response to this question have been captured and amendments made to the relevant sections of the code. For example, Part 3 has been updated with guidance on the range of electronic devices that the powers could apply to and Part 1 has been updated with further detail about the consequences of failing to adhere to the code.

Q13. Does the code contain links to all relevant material that an authorised person would need in order to ensure lawful use of the powers?

Response to Q13	Overall response
Yes	13
No	9
Blank (no response)	61
Total	83
Strongly disagree	0
Blank (no response)	59
Total	83

Summary of feedback

127. Of those who responded ‘yes’, nine were from authorised persons, two were from a government body and two did not state where they were from.

128. Of those who responded ‘no’, six were from authorised persons, two were Independent Commissioners and one did not state where they were from.

129. A number of respondents recommended that the code provide some additional links to other guidance, approved practice, legislation, case law or other helpful documentation. All requests were carefully considered and where appropriate the additional links have been provided in the code.

Impact Assessment, Equalities and Welsh Language

Impact Assessment

130. An impact assessment for these measures, including the code of practice was published to support passage of the Police, Crime, Sentencing and Courts Act 2022. This can be found at: Police, Crime, Sentencing and Courts Act 2022: overarching documents

Equalities

131. An equalities Impact assessment was produced for the PCSC Act 2022 where we considered the impact of the powers on those with protected characteristics. This can be found at: https://www.gov.uk/government/publications/police-crime-sentencing-and-courts-bill-2021-equality-statements/home-office-measures-in-the-police-crime-sentencing-and-courts-bill-equalities-impact-assessment

132. Where respondents raised issues regarding the guidance and how it may impact on those with protected characteristics the code has been updated with any relevant changes or clarifications.

Welsh Language Impact Test

133. This response and the code of practice will be made available in Welsh language.

Conclusion and next steps

134. We would like to offer our thanks to all those who have participated in the public consultation and helped shape the Extraction of Information: code of practice.

135. The code has been updated and the final version will now be laid before Parliament for approval. The code will only come into operation once it has been debated in both Houses of Parliament and each House has expressly approved it.

Consultation principles

136. The principles that Government departments and other public bodies should adopt for engaging stakeholders when developing policy and legislation are set out in the Cabinet Office Consultation Principles 2018.

Annex A – List of respondents

Respondent type	Online	Email
Authorised person	14	11
Government bodies	1	5
Independent Commissioners	0	6
Professional bodies	0	3
Third sector/NGOs	1	4
Member of public	0	2
Not stated	36	0
Total	52	31

1. An authorised person is someone who is named under Schedule 3 of the Police, Crime, Sentencing and Courts Act 2022 who is permitted to exercise the extraction of information powers. ↩

2. Bater-James & Anor v R. [2020] EWCA Crim 790 (23 June 2020) (bailii.org) ↩