United Kingdom: Home Office opened consultation on Code of Practice for handling bulk personal datasets with low or no reasonable expectation of privacy

On 8 October 2024, the UK Home Office opened a consultation on Code of Practice for handling bulk personal datasets with low or no reasonable expectation of privacy, until 6 January 2025. The Code sets out the procedures for UK intelligence agencies to collect, retain, and examine bulk personal datasets under Part 7A of the Investigatory Powers Act 2016. The Act defines a Bulk Personal Dataset (BPD) as a large set of personal data where most individuals are not, and are unlikely to become, subjects of intelligence interest. The Code of Practice applies to Part 7A datasets, for BPDs where individuals have a low or no reasonable expectation of privacy. Intelligence services may opt for Part 7A when dealing with publicly available datasets, including professionally published news articles. It sets out the requirements for authorisation, including approval from the Heads of Intelligence Agencies or Judicial Commissioners, and the factors that determine whether data is considered to have little or no reasonable expectation of privacy. The Code also contains provisions on record-keeping, oversight, and error reporting. It highlights that the Investigatory Powers Commissioner is responsible for monitoring compliance and conducting audits. Intelligence agencies must submit annual reports to the Secretary of State, who will inform Parliament's Intelligence and Security Committee.