united-kingdom privacy search-and-seizure
Is a warrant required to access your SMS activity in the UK?
<p>How long is it saved and under what circumstances can it be retrieved by the state?</p>

<p>This is mainly governed by the <em><a href="https://www.legislation.gov.uk/ukpga/2016/25/contents" rel="nofollow noreferrer">Investigatory Powers Act 2016</a></em>, a good summary of the state of things after the limiting <em><a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=186492&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=12734396" rel="nofollow noreferrer">Tele2/Watson</a></em> Court of Justice of the European Union (CJEU) ruling is available on <em><a href="https://www.technologylawdispatch.com/2018/12/regulatory/uk-government-introduces-data-retention-and-acquisition-regulations-2018/" rel="nofollow noreferrer">Technology Law Dispatch</a></em>. <a href="https://www.legislation.gov.uk/ukpga/2016/25/section/227" rel="nofollow noreferrer">Section 227</a> of the Act sets up a committee of Judicial Commissioners (JC) led by an Investigatory Powers Commissioner (IPC) who are empowered to make these data privacy decisions. These are judges or former judges appointed by the Prime Minister with approval of the Lord Chancellor and chief justices of the 3 main judiciaries (though strangely enough, it doesn't seem the President of the Supreme Court is required here).</p>
<p>In general, it is more difficult to obtain the contents of your SMS messages than the SMS metadata like sender, recipient, and time. The SMS message itself is referred to as <em>content</em> in the legal text while the metadata is <em>communications data</em> (<a href="https://www.legislation.gov.uk/ukpga/2016/25/section/261" rel="nofollow noreferrer">s. 261</a>).</p>
<p>In brief, for a set of various defined purposes, the Secretary of State with approval from a JC can issue a retention order to your provider which forces them to store the specified communications data for up to <strong>12 months</strong> (<a href="https://www.legislation.gov.uk/ukpga/2016/25/section/87" rel="nofollow noreferrer">s. 87</a>). Independently of whether a retention order was issued, communications data may be compelled by authorization of either the IPC or a designated senior officer for various purposes depending on the scenario (<a href="https://www.legislation.gov.uk/ukpga/2016/25/section/60A" rel="nofollow noreferrer">s. 60A</a>, <a href="https://www.legislation.gov.uk/ukpga/2016/25/section/61" rel="nofollow noreferrer">s. 61</a>, <a href="https://www.legislation.gov.uk/ukpga/2016/25/section/61A" rel="nofollow noreferrer">s. 61A</a>). While the <a href="https://www.legislation.gov.uk/ukpga/2016/25/schedule/4" rel="nofollow noreferrer">defined list of designated senior officers</a> is rather large, outside of emergencies they are restricted to compelling communications data for the purposes of investigating crime or national security (<a href="https://www.legislation.gov.uk/ukpga/2016/25/section/61" rel="nofollow noreferrer">s. 61(7)</a>).</p>
<p>Warrants provide more avenues for obtaining communications data and can reach into the contents as well. The act defines interception warrants, equipment interference (hacking) warrants, bulk versions of both in addition to bulk acquisition and bulk personal dataset warrants (that last one not entirely related to this question). These warrants generally require JC approval. Interception and hacking warrants can reach into the content, acquisition is restricted to communications data. Respecting the <em>Tele2/Watson</em> ruling, these warrants are generally restricted to investigating serious crime (possibility of 12 or more months of jail time) or national security. The bulk interception and bulk hacking warrants are also restricted to primarily targetting communication originating or terminating overseas.</p>
<p>I haven't read too much beyond this Act and I'm not too familiar with UK criminal law, but I imagine ordinary search warrants, production orders or something similar exist for scenarios that don't fall into serious crime or national security. However, while it's hard to prove a negative, I can't find any reference that the government can compel a service provider to specifically store SMS content (though I imagine temporary storage may be technically necessary to fulfil an interception warrant). Generally warrants are to obtain something rather immediately and in any case the content could be encrypted with the provider being unable to decrypt depending on their setup. I could be wrong though.</p>
<p>Finally, I'll note that this is an area of legislation that is not settled. The UK has traditionally legislated for greater surveillance powers, though has been limited in succession by the CJEU in <em><a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=150642&amp;pageIndex=0&amp;doclang=en&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=12734536" rel="nofollow noreferrer">Digital Rights Ireland</a></em>, <em><a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=186492&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=12734396" rel="nofollow noreferrer">Tele2/Watson</a></em> and potentially the upcoming <em><a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=222262&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=12733486" rel="nofollow noreferrer">Privacy International</a></em>, a case referred by the Investigatory Powers Tribunal where the non-binding AG opinion is that the bulk acquisition warrant does not comply with EU law in the context of <em>Tele2/Watson</em>. While Brexit has occurred, the UK is generally still required to follow EU law during the transition period and in any case the results of the CJEU rulings have largely been reflected in domestic law. However post-transition, it's very possible that the UK will re-legislate for this, though at the same time, the recent <em><a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9714625" rel="nofollow noreferrer">Schrems II</a></em> decision suggests that doing so will <a href="https://iapp.org/news/a/what-does-the-schrems-ii-judgement-mean-for-the-uk-and-eu-uk-data-flows/" rel="nofollow noreferrer">complicate future trade relations with the EU in light of the GDPR</a>.</p>

<p>Yes, they need a court order. The cellphone provider is obligated to keep your data for at least 6 months. Any circumstance that warrants a search warrant.</p>
