Policy paper

Extraction of information: Police, Crime, Sentencing and Courts Act 2022 factsheet

Updated 20 August 2022

1. What has the Government done to improve practice around the extraction of information from electronic devices?

• We have strengthened the law to ensure that there is a consistent approach to requesting information from phones and other electronic devices, and that in all cases, requests to victims and witnesses (and others) are only made when necessary and proportionate.

• We have done this by introducing new statutory powers that ensure that the police can obtain digital evidence whilst providing additional safeguards so that only information that is relevant to the investigation is taken.

• We have also created a new statutory code of practice that will provide practical guidance to authorities on the use of the powers, including how to determine which power to use in the circumstances and how they should confirm that extraction of information from a device is necessary and proportionate. This is needed to ensure that authorities exercise their functions in accordance with the law and protect the privacy of victims and witnesses. The code will ensure a greater understanding on the use of the powers and their application.

• We have included a requirement to give the person providing agreement written notice of what information is needed from the device, why it is needed, how it will be used, and confirming that the person does not have to agree and that refusal to agree does not automatically result in the closure of the enquiry.

2. What do the powers in the Police, Crime, Sentencing and Courts Act do?

• The Act introduces two new powers in sections 37 and 41 of the Act. The power in section 37 allows authorities investigating a crime or safeguarding the public to extract information from electronic devices with the agreement of the user and the power in section 41 allows authorities to extract information from a device where the user has died, for the purpose of an investigation or inquest into the persons death.

• In the case of the section 37 power, this means that where a victim or a witness (or other person) has information on a device such as a mobile phone that they want to give to the police there will be an appropriate power and an agreed process for that to happen and in the case of the section 41 power that authorities can extract information where it is required to support coronial investigations.

• The section 37 power is non-coercive, and can only be used with the agreement of the user (other than in limited circumstances e.g. where the device user is missing) and are applicable to authorities, such as the police, who might use the information to support investigations, or to protect vulnerable people from harm.

How do the powers protect individuals’ privacy?

• The provisions and code ensure that authorities are acting with respect for individuals’ privacy and include a specific responsibility to ensure that other, less intrusive means of obtaining relevant information are considered before extracting information from individuals’ devices.

• They also confirm that information must only be taken where it is necessary to the investigation and not as a matter of course.

3. Background

With so much more of our lives being lived online, important information for the prevention, detection, investigation or prosecution of crime is now held on electronic devices and the use of this information is a routine part of many investigations.

Public confidence in making this type of information available is therefore critical to confidence in the criminal justice system and to the right to a fair trial.

The Attorney General’s review of disclosure, published in November 2018, recommended changes to guidance in order to respond to the increase of digital material in the criminal justice system, including evidence found on mobile phones. The review also identified the need for greater use of technology to ensure that digital material is properly considered at all stages in the criminal justice system. Extensive action has been underway to bring about the necessary change within the Crown Prosecution Service and policing and the updated Attorney General’s Guidelines on Disclosure, published in December 2022, included the recommended changes to guidance on digital material.

In 2020, the Court of Appeal judgment in R v. Bater-James [2020] EWCA Crim 790, set out when, and how, information belonging to an individual should be examined. The Court recognised the need to avoid undue invasion of the individual’s privacy, which is necessary if the individual is to have confidence in the process, while also achieving the overriding aims of the criminal justice system.

There is no presumption that a complainant’s mobile phone or other devices should be inspected, retained or downloaded, any more than there is a presumption that investigators will attempt to look through material held in hard copy. There must be a properly identifiable foundation for the inquiry, not mere conjecture or speculation. If there is a reasonable line of enquiry, the investigators should consider whether there are ways of readily accessing the information that do not involve looking at or taking possession of the complainant’s mobile phone or other digital device.

Concerns over the potential for excessive data processing have also been raised by victim support, privacy groups and by the Information Commissioner’s Office (ICO), which published a report on mobile phone data extraction in June 2020. The ICO’s report identified inconsistencies in the approach police take to the extraction of information from devices and the complex legal framework that governs this practice, especially where the device belongs to a victim or witness of crime. The ICO recommended clarifying the lawful basis for extraction of information and introducing a code of practice in order to increase consistency and ensure that any data taken is strictly necessary for the purpose of the investigation.

4. Frequently asked questions

4.1 Why is it necessary for these powers to be introduced?

Introducing these powers provides clarity, ensures consistency in processes and instils greater confidence in the criminal justice system.

4.2 What does the code of practice do?

The code provides guidance for authorities on how they exercise these powers, including obtaining agreement of the device user when using the section 37 power and the privacy safeguards that must be considered before use.

4.3 Why does this provision apply beyond police forces? 

The process of extraction of information from digital devices is currently undertaken by a range of authorities with investigatory functions, not just police forces. This provision ensures the legal basis for this practice to be undertaken is consistent across all authorities who use it.

4.4 What else is the Government doing to ensure that an individual’s right to privacy is respected and that excessive processing is limited?

Information will only be requested when it is necessary for the investigation and there is a reasonable belief that the device holds material that is relevant to an investigation. It should be handled and processed in line with privacy and data protection legislation. These powers will reinforce these requirements by including an additional privacy safeguarding requirement to consider, before use, if there are alternative means of getting the information that impact less on the privacy of the individual.

4.5 Will authorities force individuals to hand over their device for digital extraction?

No, victims will not be forced to hand over information. The National Police Chiefs’ Council has refined the digital processing notice (DPN) that they use to explain to victims what will happen to their data and how it will be used. Police forces in England and Wales will use a DPN when exercising these powers and this will ensure that victims know their rights, including their right to say no.

4.6 Will information ever be extracted without the agreement of the user?

In specific circumstances under section 37, such as where the user is vulnerable or missing and there is a risk to their life or of serious harm to them, information may be extracted without the agreement of the user. In all other circumstances where the section 37 power is used, agreement must be given before extraction takes place.

The power in section 41 can be used without agreement as the device user is deceased.

4.7 How do the new powers apply when extracting information from a device that belongs to a child?

These powers were drafted with children’s specific needs and priorities in mind, with ‘child’ being defined as an individual under 18 years. This is to offer extra protection to children where we recognise there is a greater imbalance of power between them and an authorised person and where it would not be appropriate for them to provide agreement to the extraction of their information themselves. In this circumstance, the provisions require a responsible adult to provide agreement on the child’s behalf. This ensures that authorised persons do not override children’s interests or unlawfully interfere with their privacy.

4.8 How do the powers relate to confidential information?

The provisions set out how authorised persons should consider confidential information in relation to the exercise of the new powers. These aim to ensure authorised persons meet legal obligations regarding accessing protected material and take into account individual’s privacy rights while still following reasonable lines of enquiry for investigations.

4.9 Will these powers be used across the UK?

Yes, however other legislation that is used in different parts of the country (England and Wales, Scotland, Northern Ireland) should be taken into consideration in some circumstances when exercising these new powers. For example, the Criminal Procedure and Investigations Act 1996 and its Code of Practice for England and Wales should be considered when exercising these powers for certain purposes.