ePrivacy (PECR and IPA)

Latest developments

• New technologies impacting communication services
• New use cases for communications data
• Review of the Investigatory Powers Act 2016 completed in June 2023
• Home Office has publishes additional guidance on the definition of communications data

Summary

Even though the Privacy and Electronic Communications Regulations (PECR) have not been amended to any significant degree recently, new technologies are having an impact on the ePrivacy space with communication providers offering new and innovative services and existing legislation falling behind these new capabilities.

In particular, artificial intelligence is prompting communication providers to examine how their services use communication data to provide and enhance their services. This can trigger the requirements of the PECR and could fall foul of the Investigatory Powers, which has recently been reviewed as part of a longer term strategy for reform.

The Home Office has also released new guidance on the definition of communication data under the Investigatory Powers Act extending the scope of its application, particularly for law enforcement requests for communications data.

How could it be relevant for you?

Communications providers should consider whether the services that they provide meet the requirements of the PECR and Investigatory Powers Act (and more broadly general data protection read in light of these requirements).

The updated guidance from the Home Office makes it clear that the scope of the terms telecommunications operator and telecommunications service is interpreted widely and includes operators of any website, whereas previously the Code of Practice from 2018 suggested that websites would only be caught where it provides a connection to an application/website or in so far as it provides a messaging service, with the potential for a complete overhaul for the 2030s.

Finally, the review of the Investigatory Powers Act suggests that the Act needs an update to reflect current technologies.

Next steps

The current ePrivacy regime in the UK demonstrates that it is not designed for current technologies, but for the foreseeable future we should expect the current rules to be applied , although it is possible that changes to the data protection rules could have an impact on ePrivacy given how closely linked they are.

The review of the Investigatory Powers Act 2016 is unlikely to lead to changes in the near future, but there may be further consultation on the recommendations made in the report.

*Information is accurate up to 27 November 2023