Written by: Zoe McDonald, PNLD Legal Adviser
Not reviewed after the date of publication - 25 February 2026
The Crime and Policing Bill 2024-26 introduces significant legislative reform across policing and criminal justice. In previous months PNLD Legal Advisers Ruth Owen and Zoe McDonald have published articles summarising some of the interesting changes and offences introduced under the Bill, relevant to a policing context.
One further change that is being introduced by the Bill has been a long time in the making and will have an incredibly important impact on police investigation powers. That is the extraction of online information following seizure of electronic devices. As a result, we have decided to produce a further article on this subject alone.
Legal Adviser Zoe McDonald provides an overview of the new powers which will be available (as at the time of writing) under clause 146 of the Bill.
Background to legislative changes
An increasing amount of data associated with an electronic device is now stored remotely to that device (referred to in this article as Remotely Stored Electronic Data (RSED)). With remote storage services like Office 365 or Google Drive offering a cheaper and more flexible approach to storing ever-increasing amount of data, it is now the case that most mobile handsets enable varying degrees of remote storage, and other devices, such as laptops, are progressively being created to have minimal on-board memory. This means that most subjects of interest will now have data stored ‘in the cloud’. This is sometimes by design in a deliberate attempt to hide material and as a result, frustrate a criminal investigation but, increasingly it is just a consequence of advancing technology. Either way, the powers available to officers investigating crime have not kept pace with this shift away from information being stored externally to devices that they have seized.
Although there are provisions for Targeted Equipment Interference (TEI) under Part 5 of the Investigatory Powers Act 2016 (IPA), accessing or searching digital content such as messages, photos, apps) via any means (for example, download or otherwise) is a separate action that currently requires additional legal authority.
The variance of routes and levels of authorisation required for the above methods has meant that extraction of information stored remotely has been reserved for more serious offences and is not practicable for use in volume crime. In volume crime cases, data stored on the mobile phones of suspects has most often been accessed by powers provided by sections 20-22 PACE 1984, but as less and less information becomes stored on devices legal opinion has been divided as to whether these are the most appropriate powers to access data.
With the majority of data being now stored in the cloud, the position regarding appropriate powers has remained unclear. Existing legislation allows for devices to be ‘seized and sifted’, but to put it bluntly - you can’t seize the internet.
Differing legal interpretation and local guidance has caused an inconsistency of approach across law enforcement bodies. The divergence of legal opinion on the matter has led on the one hand to evidence being missed and offenders ‘getting away with’ crimes, and on the other, to evidence admissibility being challenged at court due to claims that the police did not have the power to access the RSED in the way they did.
The absence of a unified legal approach, coupled with inconsistent practice, has left police lacking confidence in the legality of their actions, heightening the risk that evidence is not seized or subsequently be excluded at court.
The Law Commission’s 2020 Report into search powers found the current position ‘highly unsatisfactory’ and the Home Office Investigatory Powers Unit subsequently accepted that the legal position required urgent change. In response to this the NPCC Serious and Organised Crime provided a National Framework which gave an interim solution ahead of clause 146 getting onto the statute books.
New Legislation
Clause 146 puts the National Framework approach to accessing RSED specifically on a formal legislative footing by creating a distinct power to extract online information following seizure of electronic devices.
Subsection (1) provides the power for a senior officer to authorise an enforcement officer, defined in Clause 148, to extract information from one or more specified online accounts which have been accessed by a device before it was seized under an existing power. Such information can include, but is not limited to, messages, emails, files, photos, videos and other information. Extraction of information is limited to those online accounts that have been previously accessed on the seized device; it therefore does not allow extraction from any other online accounts that may be associated with a person under investigation. Importantly, the power to extract information is exercisable in relation to information whether it is stored within or outside the UK.
Subsection (2) sets out that authorisation can only be given by a senior officer if there are reasonable grounds to believe that certain conditions are met. Those conditions are that:
- the online material has to be “relevant” to a reasonable line of enquiry (what constitutes a reasonable line of enquiry is a matter to be determined by the investigator in each case), and
- it is not reasonably practical to obtain the online information by other means, for example by requesting such online information through international agreements.
Subsection (3) sets out limitations for what information may be extracted under subsection (1). Firstly, the condition for online information to be capable of being accessed by a device at the time the device was seized is intended to limit the examination of an online account or the extraction of online information to information that was accessible to a user at the time the device was seized. As a result, any additional online information that is created or otherwise accessed after this time may not be extracted. Online information within the meaning of this subsection was capable of being accessed if an individual would have been able to access, use, download or interact with this information in any form regardless of whether specific information was actually accessed.
The second limitation is that online information may only be extracted under subsection (1) if the enforcement officer considers it “necessary and proportionate” for the purpose of obtaining information that is “relevant” as defined in subsection (2)(a). What is necessary and proportionate will vary in each case and may comprise a wider set of online material in order to identify the relevant material or maintain the integrity of the evidential material.
Subsection (4) clarifies that an authorisation under subsection (1) also confers powers to access an online account, including using any information or other material on the lawfully seized device to enable such access, and examination of any information capable of being accessed by means of such an account. A single authorisation may cover access, examination and extraction.
Subsection (5) limits the examination of online information under subsection (4)(b) to what is necessary and proportionate for the purpose of determining whether information may be extracted under the authorisation. What is necessary and proportionate will vary in each case.
Subsection (6) enables an enforcement officer who has been authorised to exercise the power under subsection (1) to arrange for a different person to exercise the power on their behalf. This can include specialist technical staff, commercial providers providing specialist services or any other person an enforcement officer designates.
Subsection (7) sets out that the “relevant purposes” for which a senior officer may give authorisation to an enforcement officer to use the powers under subsection (1) and are in all cases, for the prevention, detection, investigation or prosecution of crime, regardless of the reason for, or the power under, which a device was seized.
Subsection (7)(b) to (d) lists specific counter-terrorism and national security seizure powers which the power in subsection (1) may also extend to for specific national security purposes.
Subsection (8) defines that “online account” means any account through which an individual may access or is capable of accessing online information by means of the internet. This may, by way of example, include online accounts with social media, messaging, cloud storage or other internet-enabled services.
Subsection (9) clarifies that “extraction” of information includes reproduction in any form, for example if a copy of such information is created.
Supplementary changes
Clause 149 applies where confidential information has been extracted under the power conferred by 146 above.
Clause 152 and schedule 16 the Bill amends Chapter 3 of Part 2 of the Police, Crime, Sentencing and Courts Act 2022 (extraction of information from electronic devices). The changes will allow extraction of information accessible by means of online accounts which are accessible by an electronic device as opposed to on the electronic device.
Furthermore, a new section 48A will be added to the Investigatory Powers Act 2016 for the interception of a communication for the purpose of enabling an authorised person to access one or more online accounts.
Conclusion
As the Bill is currently still in draft, it should be noted that the provisions discussed in this article may change, in content or placement, as the Bill moves through the House of Lords. The Bill is expected to receive Royal Assent in late Spring to Summer of 2026.
As for clause 146 specifically, Codes of Practice are currently being drafted. We have been informed that these intend to be ‘tech agnostic’ as we don’t know how technology will look in the future. It is hoped that the Code will future proof the legislation for as long as possible.
As the changes and offences are brought into force, relevant summaries will be added to PNLD. The progress of the Bill can be monitored via: Crime and Policing Bill - Parliamentary Bills - UK Parliament
The following factsheets may also be of interest: Crime and Policing Bill 2025: factsheets - GOV.UK
Want more of this type of content? Check out our range of legal articles here.
