Feeds

RIPA to be changed to demand full consent to monitoring

UK drafts new amendments after accusations from EU of poor Phorm

Top 5 reasons to deploy VMware with Tegile

It will no longer be enough to have "reasonable grounds" to believe that someone had consented to monitoring of their communications under changes to the Regulation of Investigatory Powers Act (RIPA) proposed by the Government.

Putting notice of monitoring in terms and conditions will not be enough to count as consent to that monitoring, the Home Office said. Its plans to change RIPA will mean that it will only be legal to intrude on private communications if you have a warrant or both the sender and recipient of information agree that it is acceptable, even if it is done unintentionally.

RIPA previously stated that, without a warrant, you only needed to prove there was "reasonable grounds" to accept consent had been given to allow communications to be intercepted.

"The changes to 'consent' touch on interception that may be lawful without a warrant. Communication service providers may lawfully intercept in accordance with ... RIPA, for example to manage their networks... Where businesses choose to carry out interception to provide value added services, which are at the discretion of service providers ... RIPA requires the consent of both the sender and the intended recipient of the intercepted communication," the Home Office said in its consultation summary on the issue (three-page/17KB PDF).

New powers would also been given to the Interception of Communications Commissioner (IoCC) that grant the IoCC the authority to impose fines of up to £50,000 for unlawful interceptions, the draft Regulation of Investigatory Powers (Monetary Penalty Notice and Consents for Interceptions) Regulations said.

"The Interception of Communications Commissioner may serve a monetary penalty notice on a person if the Commissioner considers that a person has without lawful authority intercepted, at any place in the United Kingdom, any communication in the course of its transmission by means of a public telecommunications system and was not, at the time of the interception, making an attempt to act in accordance with an interception warrant which might, in the opinion of the Commissioner, explain the interception concerned," the draft regulations state (11-page/136KB PDF).

The penalty would be a marked increase on the £10,000 maximum fine that the Home Office suggested when it launched its consultation. It said that respondents had submitted concerns that a £10,000 fine would be inadequate.

"The scope of the sanction will not be limited to CSPs (Communication Service Providers). Any person undertaking unintentional unlawful interception will now be within scope of the offence," the Home Office said in its summary.

The stiffer wording and penalties in the document have been included in the hope that it will appease the European Commission that had previously stated that the UK had failed to properly implement the EU's Privacy and Electronic Communications Directive into national law.

Last year the Commission referred the UK to the European Court of Justice (ECJ) citing concerns that UK laws did not adequately protect against intrusion into personal privacy.

The Commission's decision was prompted by complaints it had received from BT customers after it conducted unannounced targeted advert trials through a software company, Phorm. Phorm used its technology to intercept and monitor the web activity of BT customers to help match adverts to the interests of users.

Earlier this month the Crown Prosecution Service said that it would not launch a case against BT and Phorm as there was not enough evidence to convict.

The UK Home Office proposed amendments to RIPA in November in an attempt to address the Commission's concerns. It has now published a summary of its responses along with the draft regulations.

There is "strong favour" within the 39 consultation respondents for the adoption of "unambiguous" measures for users to have to grant consent before companies can intrude on their communications, the Home Office consultation summary said.

"Many argued that including relevant information within general terms and conditions or privacy policies does not allow for a sufficient expression of consent," it said.

Members of Parliament will now discuss the draft regulations.

Copyright © 2011, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Intelligent flash storage arrays

More from The Register

next story
Ex-US Navy fighter pilot MIT prof: Drones beat humans - I should know
'Missy' Cummings on UAVs, smartcars and dying from boredom
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
The 'fun-nification' of computer education – good idea?
Compulsory code schools, luvvies love it, but what about Maths and Physics?
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.