UK-US Data Access Agreement (DAA)

The UK-US Data Access Agreement (DAA) allows UK and US law enforcement to directly request data held by telecommunications service providers in the other party's jurisdiction. The purpose of the request is solely to prevent, detect, investigate and prosecute serious crimes such as terrorism and child sexual abuse and exploitation.

What does DAA change?

The DAA will transform the ability of UK law enforcement to quickly and efficiently access data that is vital to keeping people safe.

Why is a UK-US Data Access Agreement needed?

When UK law enforcement is trying to prevent, detect, investigate or prosecute a serious crime, UK law allows them to request data relating to the specific crime. In the case of data stored by communication operators, this may include information such as images or messages.‍

Many popular telecommunications services, such as social networking platforms and messaging services, operate within US jurisdiction. Unfortunately, US law prohibits these companies from sharing certain data in response to a request made directly by a foreign government. This means that data that may be important to the investigation cannot be obtained.‍

While mechanisms such as "mutual legal assistance" do allow for government-to-government data requests, the process is typically very slow and often takes many months. This can complicate critical investigations and prevent the police or security services from building an investigative picture more quickly. Today, while the investigation is ongoing, insults and other illegal actions may continue, resulting in even more damage and more victims.‍

How will the UK-US data access agreement change this?

The DAA requires each party to ensure that their laws permit the carrier to lawfully respond to direct requests for DAA data made by the relevant government authority of the other party's jurisdiction. It does not create any new powers as it requires all DAA requests to comply with the existing internal obligations of the public authority.‍

The DAA will therefore provide relevant UK and US government authorities with timely, effective and lawful cross-border access to data for the prevention, detection, investigation and prosecution of the most serious crimes. This ensures that criminals cannot hide their data behind jurisdictional barriers to hide their criminal activities.

How is this process controlled?

As the DAA can only be used if domestic authorization has first been obtained, all existing oversight mechanisms for the UK's investigatory powers will continue to apply.

‍In addition, the UK has passed new legislation giving the UK's Investigatory Powers Commissioner's Office (IPCO) statutory powers to oversee the UK's use of DAAs.

When will the change take effect?

The agreement enters into force on October 3, 2022, which will allow law enforcement agencies in both countries to request key data for their investigations in real time.