From today, the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 replace the Telecommunications (Lawful Business Practice) Regulations 2000.
The Regulations allow a system controller to monitor and record communications on its own systems without consent for specified purposes, including:
- establishing facts and compliance with regulatory practices;
- preventing or detecting crime and unauthorised use;
- ensuring the effective operation of the system (for example malware scanning);
- checking whether communications are business-related.
Conditions apply: monitoring must relate to the business, and you must make all reasonable efforts to inform users that communications may be intercepted. Data protection law still applies, so monitoring must have a lawful basis, be proportionate and, where appropriate, be supported by a data protection impact assessment.
Source: Investigatory Powers (Interception by Businesses etc.) Regulations 2018 (legislation.gov.uk)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
