Can a Journalist's Sources Survive an IPA Data Request?

Sometimes yes, but the protection is narrower than most people assume. The Investigatory Powers Act 2016 (IPA) gives journalistic sources one specific safeguard for communications data, and that safeguard depends on what the request is for, not on who the phone belongs to.

This is general information, not legal advice. Where I am giving my own reading rather than what the statute says, I will say so.

Communications data is the who, when and where

Communications data is not the content of a message. It is the metadata: who contacted whom, when, for how long, from roughly where, and which service was used. Part 3 of the IPA lets listed public authorities obtain it from telecoms operators.

That sounds harmless until you think about a reporter. A call log showing repeated short calls to one number, just before each story, does most of a source-identification job without a single word of content.

What the Act actually says about sources

The key provision is section 77, headed "Commissioner approval for authorisations to identify or confirm journalistic sources". Its mechanics, in order:

1. A designated senior officer (or a delegate under section 60A) authorises a public authority to obtain data.
2. If the purpose is to identify or confirm a journalistic source, that authorisation cannot take effect until a Judicial Commissioner approves it.
3. The Commissioner must weigh the public interest in protecting journalistic sources against any "other overriding public interest".
4. The authority can apply without telling the journalist or their lawyers.
5. If approval is refused, the Commissioner may quash the authorisation.

So a Judicial Commissioner has to sign off before a source-identifying request takes effect. That is a real step up from the old RIPA days, when a police officer of modest rank could do it internally.

Quick detour: why this exists at all

Hang on, why did Parliament bother? Because the previous regime was found wanting. The Investigatory Powers Tribunal looked at police use of RIPA to obtain a Sun journalist's call records during the "Plebgate" inquiry, and, as I recall it, found the acquisition breached Article 10 of the European Convention (freedom of expression). Section 77 is the legislative answer. I have not re-checked the judgment text for this post, so read it directly before quoting it.

Where the protection stops

Three gaps matter in practice.

• It is purpose-based. Section 77 applies when the aim is to identify or confirm a source. A request framed as investigating a suspected leaker, or a crime, may not be framed that way, even if a journalist's contact is swept up. My reading is that the Code of Practice expects collateral intrusion to be considered, but that is weaker than a mandatory approval step.
• Imminent threat to life. The approval requirement does not apply where the authorisation is needed because of an imminent threat to life.
• The test is balancing, not a bar. "Another overriding public interest" is a judgement call. The Act does not say sources are untouchable.

Also note that the Act is amended often, and legislation.gov.uk currently flags a pending change elsewhere in the Act. Check the live text before relying on any section number.

The journalist is often not the one holding the data

This is the part that changes how you think about it. The operator holds the call records, not the reporter. A retention notice under Part 4 can require operators to keep certain data for up to 12 months, so the records may exist whether or not the journalist ever knows about a request.

And because the application is made without notice, the journalist may never find out. The safeguard is the Commissioner's scrutiny, not the journalist's ability to object.

What a journalist can control

Legal safeguards are a backstop. The lasting protection is leaving less to find:

• Use messaging apps designed to minimise metadata, and understand what they still expose (a sealed-sender design hides less than people hope).
• Avoid contacting a source from a phone number or account tied to your real identity if the source's safety depends on it.
• Remember that TLS hides content, not the fact and timing of a connection.
• Keep contact patterns unremarkable; regular bursts before publication are what a metadata analysis looks for.
• Take legal advice early, including from your outlet's lawyers or a press-freedom organisation, if you think a source may be targeted.

The honest summary is that the IPA makes a source-identifying request harder to get and puts a judge-level reviewer in the way. It does not make the metadata disappear, and it does not help if nobody ever frames the request as being about a source.