Investigatory Powers Act or Data Protection Act (and other Powers) 

Briefly describe the initiative/ project/service; please include your aims and objectives

Investigatory Powers Act or Data Protection Act? Since the transition from the Regulation of Investigatory Powers Act (RIPA) to the Investigatory Powers Act (IPA), questions have consistently been raised as to whether the IPA is applicable to certain data types being requested using the Data Protection Act (DPA). In March 2022, following discussions between OCDA, IPCO and the Home Office, additional guidance was provided. It essentially provided their agreed interpretation of the definition of Communications Data, that the definition of telecommunications operators was broad and that this definition covered many companies where provision of a telecommunications service, is only a part of their activity.

NAFN Data and Intelligence Services counts 98% of all local authorities, over 70 housing associations and over 30 wider public authorities nationwide as members. We provide access to data and intelligence to support counter fraud investigations and share good practice to ensure compliance and reduce risk, error and corruption. Since launching the NAFN Academy in 2021, our role as guardian and gatekeeper of data and intelligence now goes much further than this! The development of content for a CPD Accredited e-learning course was a race against time. The updated guidance would be effective from 16th February 2023 and we needed to ensure organisations were prepared. The NAFN Academy liaised with key stakeholders; Alex Drummond at the Investigatory Powers Commissioner’s Office and Mark Johnson in the Knowledge Engagement Team (NCDS) who developed the national training to ensure their shared interpretation was reflected in the course. Our members are not only the Police, so it was also key to ensure examples provided, aligned to the kind of data organisations request regularly and would therefore deliver the most benefit.

By hosting the training on the NAFN Academy E-learning platform, we made it available to over 450 organisations, supporting
them to better understand which Act to use to acquire data. We focused on supporting learners to:
• Understand the definition of communications data and what a Telecommunications Operator is.
• Understand the criteria for acquiring data under the Investigatory Powers Act.
• Understand how to acquire communications data from a Telecommunications Operator.
• Understand how the Government and Public Sector differ from other Telecommunications Operators.
• Recognise the various types of data.
• Recognise Organisations that are both Telecommunications Operators and Postal Operators.
• Understand how to manage data.

While training our own officers, we swiftly developed expert knowledge to be in a position to train others. Our goal was to do this before 16 February 2023, so they would be fully aware of the changes and have an understanding in advance of the implementation date. Our negotiation with SCORM content developers and the CPD Accreditation Service, allowed us to ensure all key parties required to bring the initiative to a successful conclusion in good time were on board. This ensured not only the content was created but the quality and standard of the training had been objectively assessed. 

What are the key achievements?

We did it! The NAFN Academy launched the Investigatory Powers Act vs Data Protection Act e-learning course on 06 February 2023. The aim was to educate members in advance of the implementation date of the changes and enhance our communications advising that the change was indeed going to come. The impact of delivering this training and making it available to over 450 organisations is undeniably significant. From 16th February, acquisition of communications data, outside the agreed interpretation could be challenged as being unlawful. Our training has been completed by those striving to conduct robust investigations and ensure a lack of understanding regarding data acquisition does not compromise their case.

We did not underestimate the impact of the shared interpretation; however many people did not understand how it may affect their investigation processes and existing powers beyond the Data Protection Act. Our members using the Consumer Rights Act, Prevention of Social Housing Fraud Act and Council Tax Reduction Scheme, would all be impacted by the change and following our e-learning course, they understood going forward, they would need to use the IPA to acquire what would now be defined as CD. For example, we were notified of approaches to banks, such as Monzo for account holder information and transactions. Prior to 16th February both could have been obtained using legislative powers for prevention and detection of crime to compel provision.

Our training clearly defines that the account holder details are now defined as CD and the transaction information is therefore all Monzo could provide under other powers. This course therefore provided investigators with the knowledge and understanding of a route to legally compel telecommunications and partial telecommunications operators to provide data that was now CD, preventing delays in investigations due to refusal to provide.

We also monitored KHub forums where threads relating the implementation of the changes were a hot topic of discussion. One member of the group simply responds “Do the NAFN Training…” Following this, the thread identifies others followed his advice and there is a clear understanding of the changes, each person sharing their interpretation of the changes and how it will affect their activities. The NAFN Academy provides significant added value to being a member of NAFN Data and Intelligence Services. As it is included in membership, the delivery of our courses is fully funded and no more is asked of members than to engage, learn and apply their knowledge. Due to increasing financial burdens on the public sector, this is a sustainable way for organisations to receive CPD accredited training on key subject matters affecting their activities. The NAFN Academy does not mandate completion of courses; however to date almost 300 users have accessed our course.We have also been called upon to deliver seven live sessions to account for the multitude of scenarios investigators face.

We continue to engage IPCO, OCDA and KET to ensure all ongoing guidance remains aligned to the e-training and shared interpretation. NAFN Academy responded in record time to ensure all NAFN Data and Intelligence Services members had access to a new e-learning course, which prepared them for the changes implemented following the shared interpretation of the “Investigatory Powers Act vs Data Protection Act issue”. The course was designed to help investigators navigate the changes and clarify which Act to use to acquire data; supporting robust investigations, ensuring key evidence is obtained within the new interpretation and therefore can withstand challenge. 

How Innovative is your initiative?

NAFN is the only organisation legally allowed to submit requests for acquisition of communications data from local authorities. By reputation, the Single Point of Contact (SPoC) unit has attracted membership from wider public authorities for which is not cost effective to develop their own SPoC unit. The expertise of NAFN SPoCs was harnessed to develop the Investigatory Powers Act course from the ground up and so we have placed ourselves in a position where we must support people to lawfully acquire communications data. Not only does the course provide knowledge of the how the legal gateway has changed to acquire certain types of data, it also provides guidance and support to submit an effective application. Over 4,000 users can acquire communications data using NAFN and this initiative provides a way of effectively sharing this guidance, not in a single training session or live webinar but in a secure place where the learner can revisit the training at any time.

Traditionally, Investigatory Powers Act training and the acquisition of communications data is known to be delivered by the College of Policing or private training providers at an extra cost to local and wider public authorities. The NAFN Academy challenges this and provides an industry standard five module course aimed at local authorities and wider public authorities; organisations which often find barriers to accessing the training alternatives, particularly during this time of limited funding. NAFN is able to share the learning more effectively through this initiative, break down barriers and ensure investigations don’t fall down.

Understanding the member’s journey, NAFN hosts the e-learning on the NAFN Academy platform. A way for members to access their e-learning without logging in to a separate system or going through additional security measures. The development of the single sign on (SSO) took collaboration with the platform provider and further development to an existing platform in order to ensure the member journey was smooth. This facilitates swift and secure access without creating additional tasks for the user. Offering a free course is not enough. Making access easy and simple encourages learners to access the training. Public sector organisations are committed to continuous professional development. Whilst individual organisation may have their own learning platforms, the NAFN Academy has created a hub to store the learning and development of over 16,000 users nationwide and through developing the IPA vs DPA course, many more have been encouraged to access it. Our initiative will allow us to benchmark the learning of individuals in similar roles nationwide and support organisations, departments and teams to target learners to meet a national standard. indeed, we have been called upon by the Government Internal Audit Agency to detail the course content and it’s availability, as they were keen to ensure all government departments took the course.

NAFN seeks to host training packages from other reputable organisations, as this could only serve to further enrich the offer to members. This is also an effort to prevent duplication or course creation; therefore saving public funds. No one else has created an IPA vs DPA course, which outlines the changes and better prepares those seeking data to do so in a lawful and compliant way. The NAFN Academy achieved this in advance of the go live date for changes, using limited funding and the expertise of key parties. 

What are the key learning points?

Whilst the project has been a success, there were notable challenges to overcome. The greatest challenge was the underestimation of how the change would impact investigations. Many members were aware but did not understand that existing powers had already been removed. Our communications for those people needed to add clarity to this, such that they knew the importance of completing the e-learning. Encouraging, key organisations and people were aware and not only completed the training but also encouraged others to do so.

A huge plus for this project was our relationship with the content developer for our e-learning courses (SCORM files). Without this relationship, we would not have the ability to push for some of the deadlines and almost certainly would not have been able to launch the course before the changes became effective. Relationship building is essential. Our relationship with RedSnapper is forming a partnership basis and as such all parties see the benefit in each others success. NAFN has approached other organisations with the offer to host their training on our platform reaching over 16,000 public sector officers; however there remains a culture of silos which, although significantly improved, continues to hinder the opportunities that could be realised through collaborative working. NAFN aims to prevent duplication and save public sector funds, therefore collaboration, effective sharing of information and courses in this area would be beneficial to all parties