Author: Mr Adrian Ramdat (Director of Training & Consultancy)
April 2026
Having recently seen commentary on LinkedIn suggesting that long-established Investigatory Powers Tribunal (IPT) case law permits the use of covert surveillance in disciplinary matters without the safeguards of RIPA, it is worth briefly correcting the position.
That interpretation overstates the effect of the case law and risks creating confusion around when RIPA applies, and more importantly, when it does not.
The Regulation of Investigatory Powers Act 2000 (RIPA), the Regulation of Investigatory Powers (Scotland) Act 2000 (RIP(S)A), and the Regulation of Investigatory Powers Law (RIPL) in the Channel Islands, strictly limit when public authorities may lawfully deploy covert techniques, including directed surveillance and the use of Covert Human Intelligence Sources (CHIS). (In this article, all references to RIPA equally mean RIPSA and RIPL).
A fundamental gateway issue, frequently misunderstood in practice, is whether the proposed activity is undertaken in support of the authority’s core functions. This is not a matter of discretion or interpretation. It determines whether RIPA applies at all.
RIPA only applies where covert activity supports those statutory or law-enforcement duties, not where it relates to ordinary internal or administrative business. This distinction is fundamental: it determines whether a RIPA/RIPSA authorisation is even available. The Investigatory Powers Tribunal (IPT) has dealt with cases where organisations blurred that line, with reputational and operational consequences.
What is a “Core Function”?
A core function is the public-law role conferred on an authority by Parliament. It encompasses the statutory powers and duties that justify the authority’s existence and its exercise of public power.
Examples include:
- the investigation and prevention of criminal offences,
- the enforcement of regulatory or public health regimes and
- the protection of national security.
The RIPA Codes of Practice are explicit: covert powers are intended solely to support these statutory purposes. Where an authority is exercising its public powers and pursuing a RIPA purpose (such as preventing or detecting crime), the use of a RIPA authorisation should be considered.
Conversely, where covert techniques are used for purposes falling outside those statutory responsibilities, including employment matters, contract management, or routine internal compliance, RIPA does not apply.
What Counts as an “Ordinary Function”?
Ordinary functions are activities that any organisation must undertake, regardless of its statutory status. These include:
- staff management and disciplinary processes,
- handling grievances and performance issues,
- internal misconduct investigations and
- contract and supplier management.
The Codes of Practice warn that RIPA/RIPSA cannot be used for these types of activity, even where covert monitoring or observation might take place.
That does not mean such activity is unregulated.
Surveillance in the workplace or other non-statutory contexts may still engage the Right to Respect to a Private & Family Life under Article 8 of the European Convention on Human Rights but it must instead be managed under employment law, data protection law, GDPR and workplace monitoring guidance, not RIPA.
The Approach of the Investigatory Powers Tribunal (IPT)
The leading authority remains C v Secretary of State for the Home Department and the Commissioner of Police for the Metropolis, whereby a police officer was suspected of not being as disabled as they suggested, in which to be able to claim their pension. As a result, they were covertly observed but not for a criminal investigation.
The IPT held that the covert monitoring under consideration did not arise from the Metropolitan Police’s core policing functions and that reliance on RIPA was therefore misplaced. The Tribunal confirmed that RIPA applies only to conduct undertaken in the exercise of a public authority’s core functions.
This principle was reaffirmed in Bartram and Howe v British Transport Police. British Transport Police authorised covert observation of two employees using an internal “tactical deployment” process rather than a RIPA authorisation.
The IPT found that the activity stemmed from BTP’s ordinary employment management functions, not its statutory policing role. As the conduct fell outside the scope of RIPA entirely, the Tribunal concluded it had no jurisdiction to determine the complaint.
The decision underscores a critical point: even where the organisation is a police force, internal management activity remains distinct from law-enforcement functions. Where the purpose is internal rather than statutory, RIPA does not apply and cannot be relied upon.
What This Means in Practice
- Threshold Test – Purpose and Function
Before RIPA is considered, decision-makers must establish:
- the purpose of the proposed activity,
- whether that purpose aligns with a statutory RIPA purpose and
- whether the activity is undertaken in the exercise of a core statutory or regulatory function.
If the activity does not satisfy the core function test, RIPA is unavailable. The matter must be managed through overt methods or appropriate internal governance, HR, or regulatory processes.
- Necessity and Proportionality
Even where an activity falls within a core function, it must still be necessary and proportionate. Proportionality requires showing why overt or less intrusive means would not achieve the same result. This reasoning should be explicitly recorded.
- Governance, Oversight, and Risk
Improper reliance on RIPA/RIPSA, particularly in relation to ordinary functions, exposes organisations to legal challenge, regulatory scrutiny, and reputational damage. In many cases, the risk arises not from deliberate misuse, but from a lack of clarity or confidence at the decision-making stage.
Training and Confidence in Decision-Making
Getting this right in practice depends on well-trained staff who understand both the law and the operational limits of their roles. When we deliver RIPA training we cover this distinction, including how to recognise when an activity falls outside RIPA and how to manage workplace monitoring lawfully under other frameworks.
Our programmes, from initial and refresher RIPA training to specialist Workplace Monitoring and Surveillance courses, are designed to give staff that use RIPA or staff involved in investigating non-criminal matters, such as HR Staff, the confidence to make defensible, well-documented decisions.
Conclusion
The distinction between core and ordinary functions under RIPA is not a technical nuance; it is a legal boundary that determines whether covert powers are available at all.
Where activity falls outside that boundary, the absence of RIPA does not create a gap in oversight, it simply shifts the legal framework. Article 8, data protection obligations, and employment law continue to apply in full.
For practitioners and decision-makers, the critical issue is not whether covert activity can be justified after the fact, but whether the correct legal regime has been identified at the outset. Getting that wrong carries legal, operational, and reputational consequences that are entirely avoidable with the right understanding and governance.
For organisations looking to strengthen that understanding in practice, whether through RIPA/RIPSA/RIPL training or workplace monitoring and investigation frameworks, the focus should always be the same: equipping staff to make clear, defensible decisions at the point they matter most.
If your organisation needs to strengthen its understanding of these boundaries, or ensure your staff can apply the core vs ordinary function test confidently, contact us today to discuss our tailored RIPA/RIPSA/RIPL training or workplace monitoring training options.
Call us on 0203 883 5843 or email us at info@thesignaturebrand.co.uk