Correspondence

Circular 007/2022: Extraction of information from electronic devices

Published 17 October 2022

Introduction

1.   This circular is issued to inform the police and other relevant public authorities, that the remaining provisions of Chapter 3 of Part 2 of the Police, Crime, Sentencing and Courts Act 2022 (“the Act”), will come into force on 8 November 2022. This circular does not constitute legal advice. It is not a statement of law and is not intended to provide a comprehensive description or interpretation of the provisions. The circular should be read alongside the Act and the accompanying explanatory notes.

2.   The provisions discussed in this circular extend to the whole of the United Kingdom.

Background

3.   The Act received Royal Assent on 28 April 2022. The Act itself provided for certain provisions to come into force either on Royal Assent or two months after Royal Assent with the remaining provisions to be commenced by regulations in due course. The Minister for Crime, Policing and Probation made the Police, Crime, Sentencing and Courts Act (Commencement No. 1 and Transitional Provision) Regulations 2022 bringing certain provisions into force between 12 May and 1 August 2022.

4.   In the End-to-End Rape Review 2021, the Government committed to ensuring that any digital information requested from victims would be strictly limited to what is necessary and proportionate to allow reasonable lines of inquiry into an alleged offence.

5.   The provisions in Chapter 3 of Part 2 of the Act, which introduces a new statutory power for the extraction of information from electronic devices, support the delivery of those commitments.

6.   The provisions in Section 42, subsections (1)-(7), were commenced on the 12 May to allow for the launch of a consultation on the code of practice mandated by Section 42 of the Act.

7.   The public consultation was held between 12 May 2022 to 19 July 2022. A final draft of the code of practice was laid in parliament on 17 October 2022 and a copy was placed in the House library.

Chapter 3, Part 2: Extraction of Information from Electronic Devices (commencement date 08 November 2022)

Section 37: Extraction of information from electronic devices: investigations of crime etc.

8.   Subsection (1) provides that an authorised person can extract information stored on an “electronic device” if (i) the device has been provided voluntarily to an authorised person by a user of the device, and (ii) that user has given their agreement for the information stored on the device to be extracted by an authorised person.

9.   Subsection (2) sets out the purposes for which the power in subsection (1) can be used, namely the prevention, detection, investigation or prosecution of crime; helping to locate a missing person; or protecting a child or at-risk adult (as defined in subsection (4)) from neglect or harm.

10. Subsection (3), with reference to subsection (2) above, makes clear that ‘crime’ means conduct which amounts to one or more criminal offences in a part of the UK or conduct which, had it taken place in a part of the UK, would have amounted to a criminal offence there. This allows the power to be exercised further to the receipt of mutual legal assistance requests from overseas (provided the conduct in question would have constituted a criminal offence in the UK, had it taken place here).

11. Subsection (5) sets out conditions which must be satisfied for an authorised person to extract information from an electronic device under subsection (1).

12. Subsection (7) sets out the conditions which must be satisfied where, with reference to subsection (6), the authorised person thinks there is a risk of obtaining information other than that which is necessary for the purposes of subsection (2) or section 41(2).

13. Subsection (8) makes clear that subsection (9) applies where authorised persons considers that there is a risk of obtaining confidential information (that is, legally privileged information, journalistic material and other protected material, as defined in Section 43 of the Act) in the course of exercising the power in subsection (1). Confidential information includes categories of information that carry inherent sensitivity and so are subject to certain protections.

14. Subsection (9), similar to (7,) provides that the authorised person must be satisfied that the use of the power remains proportionate, having regard to matters in subsection (10), which includes considering the likely amount of confidential information stored on the device and the potential relevance of the confidential information for the purpose of subsection (2) and section 41(2) of the Act.

15. Subsection (11) requires authorised persons to have regard to the code of practice issued by the Secretary of State under section 42 when exercising, and when considering whether to exercise the power in subsection (1).

16. Subsection (12) provides that the power conferred by subsection (1) is without prejudice to other statutory or common law powers to extract information or to seize any item or information – for example, the general powers of seizure conferred by section 19 of the Police and Crime Evidence Act (PACE)1984.

17. Subsection (13) defines various terms used in this Chapter.

Section 38: Application of section 37 to children and adults without capacity

18. Subsections (1) and (6) set out that children and adults without capacity, respectively, are not capable of deciding whether to provide a device or agree to the extraction of information from it, for the purposes of the power in section 37.

19. A child is defined as a person aged under 18 (see section 37(13)). Section 38(10) defines ‘adult without capacity’ by reference to the Mental Capacity Act 2005 (for England and Wales), the Adults with Incapacity (Scotland) Act 2000 and the Mental Capacity Act (Northern Ireland) 2016.

20. Subsections (2) and (7) respectively explain that in circumstances where a user of an electronic device is a child or an adult without capacity, another specified person may provide the device and give their agreement to the extraction of information from it.

21. In the case of a child being the user of a device, subsection (3) sets out that the person(s) who may volunteer the device and give agreement to the extraction of information from it are a parent or guardian of the child (or, if the child is in care, a person representing the authority who has care of the child), or (if no such person is available) another responsible person aged 18 or over.

22. Subsection (4) states that an authorised person must, before exercising the power under section 37(1) and so far as it is reasonably practicable to do so, ascertain the views of the child and, taking into account the age and maturity of the child, have regard to those views.

23. Subsection (5) states that if an authorised person exercises the power in section 37(1) with the agreement of ‘another responsible person’ as detailed in subsection (3)(b) then they must, unless they consider it inappropriate to do so inform a person within subsection (3)(a) that they have exercised the power.

24. In the case of an adult without capacity, subsection (8) sets out that the persons who may volunteer the device and give agreement to the extraction of information from it. This includes a parent or guardian of the person (or, if the person is in care, a person representing the authority who has care of the person), a registered social worker, a person who has power of attorney which is wide enough to cover these matters, a person authorised under an intervention order whose authorisation covers such matters or (if none of those people is available) another responsible person aged 18 or over.

25. Subsection (11) defines terms relevant for the purposes (e.g. “registered social worker”) in this section.

Section 39: Requirements for voluntary provision and agreement

26. This subsection (1) defines the conditions that must be met for a person to be treated as having voluntarily provided a device and agreed to the extraction of information from it for the purposes of sections 37 and 38 of the Act.

27. Subsection (2) states that an authorised person must not have placed any undue pressure on a person to volunteer the device and agree to the extraction of information from it. This is a safeguard to ensure that no coercion is associated with the voluntary provision of the device and agreement for the extraction of information from it.

28. Subsection (3) provides that an authorised person must give written notice to the person volunteering the device and agreeing to the extraction of information. Subsection (3) further specifies what must be included in the written notice.

29. Subsection (4) confirms that a person volunteering the device and agreeing to the extraction of information from it should do so in writing.

30. Subsection (5) provides for alternative arrangements if a person is unable to confirm their agreement for volunteering a device and extraction of information from it in writing due to a physical impairment or lack of literacy skills. In these circumstances agreement should be given orally, and confirmation recorded in writing by an authorised person.

31. Subsection (6) provides that a person must get a copy of the agreement in writing, either in hard copy or electronically. This ensures that they have a record of their decision to agree to extraction of information from the device. If a person orally agreed (as per subsection (5) above), the authorised person must give the person a copy of the record of that confirmation in hard copy or electronic form (subsection (7)).

Section 40: Application of section 37 where user has died etc.

32. Subsection (1) sets out that in three special circumstances an authorised person may exercise the power in section 37(1) to extract information from a device even though a user has not voluntarily handed over the device or agreed to extraction.

33. The first instance is where a user is deceased, and they were a user of the device immediately prior to their death (subsection (2)).

34. The second instance is where a user of the device is a child or an adult without capacity, and the authorised person believes their life is at risk or there is a serious risk of harm to them (subsection (3)). The definitions of a child and an adult without capacity can be found respectively in section 37(13) and section 38(10) of the Act.

35. The third instance is where a user of the device is missing, and the authorised person believes their life is at risk or there is a serious risk of harm to them (subsection (4)).

36. In the above circumstances , there is no requirement on the police or other authorised person(s) to obtain the agreement of the deceased’s next of kin or user’s parent, guardian etc., albeit that the police or other authorised person(s) may inform the next of kin or parent, guardian etc… that they are in possession of the device and have extracted information from it for the purposes of a criminal investigation or another purpose specified in section 37(2).

Section 41: Extraction of information from electronic devices: investigations of death

37. Subsection (1) provides that an authorised person may extract information from an electronic device if a user of that device has died. Subsections (2) and (3) set out that this power may only be exercised for the purposes of an investigation or inquest into the person’s death or determining whether such an investigation or inquest should be held.

38. The police assist coroners and the Lord Advocate in gathering evidence to determine who has died and the circumstances surrounding their death. A device such as a mobile phone may contain information that assists in answering these questions., For example it may have relevant internet search history that assists in determining whether suicide was likely or may contain communication sent to another party such as a suicide note which narrows the time of death.

39. Subsection (4) sets out the conditions under which an authorised person may exercise the power under subsection (1) Subsection (4)(a) sets out the equivalent provisions to sections 37(5)(b) that the powers may only be exercised if an authorised person reasonably believes that information stored on the device will be relevant to the purpose of the investigation. Subsection (4)(b) sets out equivalent provisions to section 37(5)(c) that an authorised person be satisfied that extraction of that information is necessary and proportionate to achieve that purpose.

40. Subsection (6), with reference to subsection (5) sets out the conditions that must be satisfied where an authorised person thinks there is a risk of obtaining information in excess of that which is required for the purposes of subsection (2) or section 37(2) Subsection (6) sets out equivalent provisions to section 37(7) that in order to be satisfied that extraction of information is proportionate, the authorised person must be satisfied that there are no other ways of obtaining the required information which avoid that risk or, if there are other ways, that it is not reasonably practicable to rely on them.

41. Subsections (8) and (9) sets out the obligations to consider the risk of a device containing confidential information and the steps that must be taken to ensure that the use of the power is proportionate with regard to such information. These obligations are the same as those found in section 37(9) and (10), but here apply where the information is sought for the purpose of the investigation of death.

Section 42: Code of practice about the extraction of information

42. Subsection (1) imposes a requirement on the Secretary of State to prepare a code of practice which provides guidance on the exercise of the powers in sections 37(1) and 41(1). The code will give practical guidance to authorised persons on how and when it is appropriate to use the powers. This will ensure they exercise their functions in accordance with the law. The code will ensure a greater understanding on the use of the powers and their application in real life.

43. Subsection 9 explains that “A failure on the part of an authorised person to act in accordance with the code does not of itself render the person liable to any criminal or civil proceedings.”

44. Subsection 10 explains that the code of practice is admissible in criminal or civil proceedings.

Section 43: Confidential Information

45. Section 43 defines ‘confidential information’ for the purposes of Chapter 3 of Part 2.

Section 44 and Schedule 3: Authorised persons

46. Section 44 and Schedule 3 define “authorised persons” for the purposes of Chapter 3 of Part 2. The list of authorised persons set out in Schedule 3 covers law enforcement agencies and certain regulatory bodies. The Schedule recognises that an authorised person may contract with another person (for example, a forensic science provider) to extract information from an electronic device on their behalf. 

47. Schedule 3 is split into three parts, recognising the different responsibilities of the various bodies:

i. The persons listed in Part 1 of the Schedule may exercise the power under section 37(1) for all the purposes listed in subsection (2) of that section, and the power in section 41(1).

ii. The persons listed in Part 2 of the Schedule may exercise the power in section 37(1) for all the purposes listed in subsection (2) of that section. They may not exercise the power in section 41(1).

iii. Lastly, the persons listed in Part 3 of the Schedule may only exercise the power in section 37(1) for the purposes of preventing, detecting, investigating or prosecuting crime. They may not exercise that power for other purposes or the power in section 41(1)

48. Subsections (4) and (5) of section 44 confer a power on the Secretary of State to amend Schedule 3, by regulations including by adding or removing persons to/from the list. With subsections (6) and (7) including requirements to consult with devolved authorities before making regulations in certain circumstances.