Telecommunications (Security) Act 2021

Voir le document original Texte intégral du document
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:uk="https://www.legislation.gov.uk/namespaces/UK-AKN" name="crossheading" ukl:Name="Pblock" eId="crossheading-duties-of-providers-of-public-electronic-communications-networks-and-services"><heading>Duties of providers of public electronic communications networks and services</heading><section eId="section-1"><num>1</num><heading>Duty to take security measures</heading><subsection eId="section-1-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-1-2"><num>(2)</num><content><p><mod>For sections 105A to 105D substitute—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e108"><num>105A</num><heading>Duty to take security measures</heading><subsection><num>(1)</num><intro><p>The provider of a public electronic communications network or a public electronic communications service must take such measures as are appropriate and proportionate for the purposes of—</p></intro><level class="para1"><num>(a)</num><content><p>identifying the risks of security compromises occurring;</p></content></level><level class="para1"><num>(b)</num><content><p>reducing the risks of security compromises occurring; and</p></content></level><level class="para1"><num>(c)</num><content><p>preparing for the occurrence of security compromises.</p></content></level></subsection><subsection eId="d25e136"><num>(2)</num><intro><p>In this Chapter “<term refersTo="#term-security-compromise">security compromise</term>”, in relation to a public electronic communications network or a public electronic communications service, means—</p></intro><level class="para1"><num>(a)</num><content><p>anything that compromises the availability, performance or functionality of the network or service;</p></content></level><level class="para1"><num>(b)</num><content><p>any unauthorised access to, interference with or exploitation of the network or service or anything that enables such access, interference or exploitation;</p></content></level><level class="para1"><num>(c)</num><content><p>anything that compromises the confidentiality of signals conveyed by means of the network or service;</p></content></level><level class="para1"><num>(d)</num><intro><p>anything that causes signals conveyed by means of the network or service to be—</p></intro><level class="para2"><num>(i)</num><content><p>lost;</p></content></level><level class="para2"><num>(ii)</num><content><p>unintentionally altered; or</p></content></level><level class="para2"><num>(iii)</num><content><p>altered otherwise than by or with the permission of the provider of the network or service;</p></content></level></level><level class="para1"><num>(e)</num><content><p>anything that occurs in connection with the network or service and compromises the confidentiality of any data stored by electronic means;</p></content></level><level class="para1"><num>(f)</num><intro><p>anything that occurs in connection with the network or service and causes any data stored by electronic means to be—</p></intro><level class="para2"><num>(i)</num><content><p>lost;</p></content></level><level class="para2"><num>(ii)</num><content><p>unintentionally altered; or</p></content></level><level class="para2"><num>(iii)</num><content><p>altered otherwise than by or with the permission of the person holding the data; or</p></content></level></level><level class="para1"><num>(g)</num><content><p>anything that occurs in connection with the network or service and causes a connected security compromise.</p></content></level></subsection><subsection><num>(3)</num><intro><p>But in this Chapter “<term refersTo="#term-security-compromise">security compromise</term>” does not include anything that occurs as a result of conduct that—</p></intro><level class="para1"><num>(a)</num><content><p>is required or authorised by or under an enactment mentioned in subsection (4);</p></content></level><level class="para1"><num>(b)</num><content><p>is undertaken for the purpose of providing a person with assistance in giving effect to a warrant or authorisation that has been issued or given under an enactment mentioned in subsection (4);</p></content></level><level class="para1"><num>(c)</num><content><p>is undertaken for the purpose of providing a person with assistance in exercising any power conferred by or under prison rules; or</p></content></level><level class="para1"><num>(d)</num><content><p>is undertaken for the purpose of providing assistance to a constable or a member of a service police force (acting in either case in that capacity).</p></content></level></subsection><subsection><num>(4)</num><intro><p>The enactments are—</p></intro><level class="para1"><num>(a)</num><content><p>the Investigatory Powers Act 2016;</p></content></level><level class="para1"><num>(b)</num><content><p>Part 1 of the Crime and Courts Act 2013;</p></content></level><level class="para1"><num>(c)</num><content><p>the Prisons (Interference with Wireless Telegraphy) Act 2012;</p></content></level><level class="para1"><num>(d)</num><content><p>the Regulation of Investigatory Powers Act 2000;</p></content></level><level class="para1"><num>(e)</num><content><p>the Regulation of Investigatory Powers (Scotland) Act 2000;</p></content></level><level class="para1"><num>(f)</num><content><p>the Intelligence Services Act 1994;</p></content></level><level class="para1"><num>(g)</num><intro><p>any other enactment (whenever passed or made) so far as it—</p></intro><level class="para2"><num>(i)</num><content><p>makes provision which is in the interests of national security;</p></content></level><level class="para2"><num>(ii)</num><content><p>has effect for the purpose of preventing or detecting crime or of preventing disorder; or</p></content></level><level class="para2"><num>(iii)</num><content><p>makes provision which is in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security.</p></content></level></level></subsection><subsection><num>(5)</num><intro><p>In this section—</p></intro><hcontainer name="definition"><intro><p>“<term refersTo="#term-connected-security-compromise">connected security compromise</term>” means—</p></intro><level class="para1"><num>(a)</num><content><p>in relation to a public electronic communications network, a security compromise that occurs in relation to another public electronic communications network or a public electronic communications service;</p></content></level><level class="para1"><num>(b)</num><content><p>in relation to a public electronic communications service, a security compromise that occurs in relation to a public electronic communications network or another public electronic communications service;</p></content></level></hcontainer><hcontainer name="definition"><content><p>“<term refersTo="#term-crime">crime</term>” and “<term refersTo="#term-detecting-crime">detecting crime</term>” have the same meanings as in the Investigatory Powers Act 2016;</p></content></hcontainer><hcontainer name="definition"><intro><p>“<term refersTo="#term-prison-rules">prison rules</term>” means any rules made under—</p></intro><level class="para1"><num>(a)</num><content><p>section 47 of the Prison Act 1952;</p></content></level><level class="para1"><num>(b)</num><content><p>section 39 of the Prisons (Scotland) Act 1989; or</p></content></level><level class="para1"><num>(c)</num><content><p>section 13 of the Prison Act (Northern Ireland) 1953;</p></content></level></hcontainer><hcontainer name="definition"><intro><p>“<term refersTo="#term-service-police-force">service police force</term>” means—</p></intro><level class="para1"><num>(a)</num><content><p>the Royal Navy Police;</p></content></level><level class="para1"><num>(b)</num><content><p>the Royal Military Police; or</p></content></level><level class="para1"><num>(c)</num><content><p>the Royal Air Force Police;</p></content></level></hcontainer><hcontainer name="definition"><content><p>“<term refersTo="#term-signal">signal</term>” has the same meaning as in section 32.</p></content></hcontainer></subsection></section><section><num>105B</num><heading>Duty to take specified security measures</heading><subsection><num>(1)</num><content><p>The Secretary of State may by regulations provide that the provider of a public electronic communications network or a public electronic communications service must take specified measures or measures of a specified description.</p></content></subsection><subsection><num>(2)</num><content><p>A measure or description of measure may be specified only if the Secretary of State considers that taking that measure or a measure of that description would be appropriate and proportionate for a purpose mentioned in section <ref href="#d25e108">105A</ref>(1).</p></content></subsection><subsection><num>(3)</num><content><p>In this section “<term refersTo="#term-specified">specified</term>” means specified in the regulations.</p></content></subsection><subsection><num>(4)</num><content><p>Nothing in this section or regulations under it affects the duty imposed by section 105A.</p></content></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-1-3"><num>(3)</num><content><p><mod>In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="definition"><content><p>“<term refersTo="#term-security-compromise">security compromise</term>”, in relation to a public electronic communications network or a public electronic communications service, has the meaning given by section <ref href="#d25e108">105A</ref>;</p></content></hcontainer></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection></section><section eId="section-2"><num>2</num><heading>Duty to take measures in response to security compromises</heading><content><p><mod>After section 105B of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section><num>105C</num><heading>Duty to take measures in response to security compromises</heading><subsection><num>(1)</num><content><p>This section applies where a security compromise occurs in relation to a public electronic communications network or a public electronic communications service.</p></content></subsection><subsection><num>(2)</num><content><p>The provider of the network or service must take such measures as are appropriate and proportionate for the purpose of preventing adverse effects (on the network or service or otherwise) arising from the security compromise.</p></content></subsection><subsection><num>(3)</num><content><p>If the security compromise has an adverse effect on the network or service, the provider of the network or service must take such measures as are appropriate and proportionate for the purpose of remedying or mitigating that adverse effect.</p></content></subsection></section><section eId="d25e499"><num>105D</num><heading>Duty to take specified measures in response to security compromise</heading><subsection><num>(1)</num><content><p>The Secretary of State may by regulations provide that, where a security compromise of a specified description occurs in relation to a public electronic communications network or a public electronic communications service, the provider of the network or service must take specified measures or measures of a specified description.</p></content></subsection><subsection><num>(2)</num><content><p>A measure or description of measure may be specified under subsection (1) only if the Secretary of State considers that taking that measure or a measure of that description would be appropriate and proportionate for the purpose of preventing adverse effects (on the network or service or otherwise) arising from a security compromise of the specified description.</p></content></subsection><subsection><num>(3)</num><content><p>The Secretary of State may by regulations provide that, where a security compromise occurs in relation to a public electronic communications network or a public electronic communications service and has an adverse effect of a specified description on the network or service, the provider of the network or service must take specified measures or measures of a specified description.</p></content></subsection><subsection><num>(4)</num><content><p>A measure or description of measure may be specified under subsection (3) only if the Secretary of State considers that taking that measure or a measure of that description would be appropriate and proportionate for the purpose of remedying or mitigating an adverse effect of the specified description.</p></content></subsection><subsection><num>(5)</num><content><p>In this section “<term refersTo="#term-specified">specified</term>” means specified in the regulations.</p></content></subsection><subsection><num>(6)</num><content><p>Nothing in this section or regulations under it affects the duty imposed by section 105C.</p></content></subsection></section></quotedStructure></mod></p></content></section><section eId="section-3"><num>3</num><heading>Codes of practice about security measures etc</heading><content><p><mod>After section <ref href="#d25e499">105D</ref> of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e560"><num>105E</num><heading>Codes of practice about security measures etc</heading><intro><p>The Secretary of State may—</p></intro><level class="para1"><num>(a)</num><content><p>issue codes of practice giving guidance as to the measures to be taken under sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref> by the provider of a public electronic communications network or a public electronic communications service;</p></content></level><level class="para1"><num>(b)</num><content><p>revise a code of practice issued under this section and issue the code as revised;</p></content></level><level class="para1"><num>(c)</num><content><p>withdraw a code of practice issued under this section.</p></content></level></section><section><num>105F</num><heading>Issuing codes of practice about security measures</heading><subsection><num>(1)</num><intro><p>Before issuing a code of practice under section <ref href="#d25e560">105E</ref> the Secretary of State—</p></intro><level class="para1"><num>(a)</num><intro><p>must publish a draft of—</p></intro><level class="para2"><num>(i)</num><content><p>the code; or</p></content></level><level class="para2"><num>(ii)</num><content><p>where relevant, the revisions of the existing code;</p></content></level></level><level class="para1"><num>(b)</num><intro><p>must consult the following about the draft—</p></intro><level class="para2"><num>(i)</num><content><p>OFCOM;</p></content></level><level class="para2"><num>(ii)</num><content><p>providers of public electronic communications networks to whom the draft would apply;</p></content></level><level class="para2"><num>(iii)</num><content><p>providers of public electronic communications services to whom the draft would apply; and</p></content></level><level class="para2"><num>(iv)</num><content><p>such other persons as the Secretary of State considers appropriate; and</p></content></level></level><level class="para1"><num>(c)</num><content><p>may make such alterations to the draft as the Secretary of State considers appropriate following the consultation.</p></content></level></subsection><subsection><num>(2)</num><content><p>Before issuing a code of practice under section 105E the Secretary of State must also lay a draft of the code before Parliament.</p></content></subsection><subsection><num>(3)</num><content><p>If, within the 40-day period, either House of Parliament resolves not to approve the draft of the code, the code may not be issued.</p></content></subsection><subsection><num>(4)</num><content><p>If no such resolution is made within that period, the code may be issued.</p></content></subsection><subsection eId="d25e678"><num>(5)</num><content><p>If the code is issued, the Secretary of State must publish it.</p></content></subsection><subsection><num>(6)</num><content><p>A code of practice comes into force at the time of its publication under subsection <ref href="#d25e678">(5)</ref>, unless it specifies a different commencement time.</p></content></subsection><subsection><num>(7)</num><intro><p>A code of practice may—</p></intro><level class="para1"><num>(a)</num><content><p>specify different commencement times for different purposes;</p></content></level><level class="para1"><num>(b)</num><content><p>include transitional provisions and savings.</p></content></level></subsection><subsection><num>(8)</num><content><p>In this section, the “<term refersTo="#term-40-day-period">40-day period</term>”, in relation to a draft of a code, means the period of 40 days beginning with the day on which the draft is laid before Parliament (or, if it is not laid before each House of Parliament on the same day, the later of the 2 days on which it is laid).</p></content></subsection><subsection><num>(9)</num><intro><p>For the purposes of calculating the 40-day period, no account is to be taken of any period during which—</p></intro><level class="para1"><num>(a)</num><content><p>Parliament is dissolved or prorogued, or</p></content></level><level class="para1"><num>(b)</num><content><p>both Houses are adjourned for more than 4 days.</p></content></level></subsection></section><section><num>105G</num><heading>Withdrawing codes of practice about security measures</heading><subsection><num>(1)</num><intro><p>Before withdrawing a code of practice under section <ref href="#d25e560">105E</ref> the Secretary of State must—</p></intro><level class="para1"><num>(a)</num><content><p>publish notice of the proposal to withdraw the code; and</p></content></level><level class="para1"><num>(b)</num><intro><p>consult the following about the proposal—</p></intro><level class="para2"><num>(i)</num><content><p>OFCOM;</p></content></level><level class="para2"><num>(ii)</num><content><p>providers of public electronic communications networks to whom the code applies;</p></content></level><level class="para2"><num>(iii)</num><content><p>providers of public electronic communications services to whom the code applies; and</p></content></level><level class="para2"><num>(iv)</num><content><p>such other persons as the Secretary of State considers appropriate.</p></content></level></level></subsection><subsection><num>(2)</num><intro><p>Where the Secretary of State withdraws a code of practice under section <ref href="#d25e560">105E</ref> the Secretary of State must—</p></intro><level class="para1"><num>(a)</num><content><p>publish notice of the withdrawal of the code; and</p></content></level><level class="para1"><num>(b)</num><content><p>lay a copy of the notice before Parliament.</p></content></level></subsection><subsection><num>(3)</num><content><p>A withdrawal of a code of practice has effect at the time of the publication of the notice of withdrawal under subsection (2), unless the notice specifies a different withdrawal time.</p></content></subsection><subsection><num>(4)</num><intro><p>A notice of withdrawal may—</p></intro><level class="para1"><num>(a)</num><content><p>specify different withdrawal times for different purposes;</p></content></level><level class="para1"><num>(b)</num><content><p>include savings.</p></content></level></subsection></section><section><num>105H</num><heading>Effects of codes of practice about security measures</heading><subsection><num>(1)</num><content><p>A failure by the provider of a public electronic communications network or a public electronic communications service to act in accordance with a provision of a code of practice does not of itself make the provider liable to legal proceedings before a court or tribunal.</p></content></subsection><subsection><num>(2)</num><intro><p>In any legal proceedings before a court or tribunal, the court or tribunal must take into account a provision of a code of practice in determining any question arising in the proceedings if—</p></intro><level class="para1"><num>(a)</num><content><p>the question relates to a time when the provision was in force; and</p></content></level><level class="para1"><num>(b)</num><content><p>the provision appears to the court or tribunal to be relevant to the question.</p></content></level></subsection><subsection><num>(3)</num><intro><p>OFCOM must take into account a provision of a code of practice in determining any question arising in connection with the carrying out by them of a relevant function if—</p></intro><level class="para1"><num>(a)</num><content><p>the question relates to a time when the provision was in force; and</p></content></level><level class="para1"><num>(b)</num><content><p>the provision appears to OFCOM to be relevant to the question.</p></content></level></subsection><subsection><num>(4)</num><intro><p>In this section—</p></intro><hcontainer name="definition"><content><p>“<term refersTo="#term-code-of-practice">code of practice</term>” means a code of practice issued under section <ref href="#d25e560">105E</ref>;</p></content></hcontainer><hcontainer name="definition"><intro><p>“<term refersTo="#term-relevant-function">relevant function</term>” means a function conferred on OFCOM by any of the following provisions—</p></intro><level class="para1"><num>(a)</num><content><p>section <ref href="#d25e1376">105M</ref> (general duty of OFCOM to ensure compliance with security duties);</p></content></level><level class="para1"><num>(b)</num><content><p>section <ref href="#d25e1416">105N</ref> (power of OFCOM to assess compliance with security duties);</p></content></level><level class="para1"><num>(c)</num><content><p>section <ref href="#d25e1459">105O</ref> (power of OFCOM to give assessment notices);</p></content></level><level class="para1"><num>(d)</num><content><p>section <ref href="#d25e1874">105S</ref> (enforcement of security duties);</p></content></level><level class="para1"><num>(e)</num><content><p>section <ref href="#d25e1973">105U</ref> (enforcement of security duties: proposal for interim steps);</p></content></level><level class="para1"><num>(f)</num><content><p>section <ref href="#d25e2124">105V</ref> (enforcement of security duties: direction to take interim steps).</p></content></level></hcontainer></subsection></section><section eId="d25e954"><num>105I</num><heading>Duty to explain failure to act in accordance with code of practice</heading><subsection><num>(1)</num><content><p>This section applies where OFCOM have reasonable grounds for suspecting that the provider of a public electronic communications network or a public electronic communications service is failing, or has failed, to act in accordance with a provision of a code of practice issued under section <ref href="#d25e560">105E</ref>.</p></content></subsection><subsection><num>(2)</num><intro><p>OFCOM may give a notification to the provider that—</p></intro><level class="para1"><num>(a)</num><content><p>specifies the provision of the code of practice;</p></content></level><level class="para1"><num>(b)</num><content><p>specifies the respects in which the provider is suspected to be failing, or to have failed, to act in accordance with it; and</p></content></level><level class="para1"><num>(c)</num><content><p>directs the provider to give to OFCOM a statement under subsection (3) or (4).</p></content></level></subsection><subsection><num>(3)</num><intro><p>A statement under this subsection is a statement that—</p></intro><level class="para1"><num>(a)</num><content><p>confirms that the provider is failing, or has failed, in the respects specified in the notification to act in accordance with the provision of the code of practice; and</p></content></level><level class="para1"><num>(b)</num><content><p>explains the reasons for the failure.</p></content></level></subsection><subsection><num>(4)</num><intro><p>A statement under this subsection is a statement that—</p></intro><level class="para1"><num>(a)</num><content><p>states that the provider is not failing, or has not failed, in the respects specified in the notification to act in accordance with the provision of the code of practice; and</p></content></level><level class="para1"><num>(b)</num><content><p>explains the reasons for that statement.</p></content></level></subsection><subsection><num>(5)</num><content><p>The provider must comply with a direction given under subsection (2)(c) within such reasonable period as may be specified in the notification.</p></content></subsection></section></quotedStructure></mod></p></content></section></hcontainer>
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:uk="https://www.legislation.gov.uk/namespaces/UK-AKN" name="crossheading" ukl:Name="Pblock" eId="crossheading-informing-others-of-security-compromises"><heading>Informing others of security compromises</heading><section eId="section-4"><num>4</num><heading>Informing others of security compromises</heading><subsection eId="section-4-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-4-2"><num>(2)</num><content><p><mod>After section 105I insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e1061"><num>105J</num><heading>Duty to inform users of risk of security compromise</heading><subsection><num>(1)</num><content><p>This section applies where there is a significant risk of a security compromise occurring in relation to a public electronic communications network or a public electronic communications service.</p></content></subsection><subsection><num>(2)</num><content><p>The provider of the network or service must take such steps as are reasonable and proportionate for the purpose of bringing the relevant information, expressed in clear and plain language, to the attention of persons who use the network or service and may be adversely affected by the security compromise.</p></content></subsection><subsection><num>(3)</num><intro><p>The relevant information is—</p></intro><level class="para1"><num>(a)</num><content><p>the existence of the risk of the security compromise occurring;</p></content></level><level class="para1"><num>(b)</num><content><p>the nature of the security compromise;</p></content></level><level class="para1"><num>(c)</num><intro><p>the technical measures that it may be reasonably practicable for persons who use the network or service to take for the purposes of—</p></intro><level class="para2"><num>(i)</num><content><p>preventing the security compromise adversely affecting them;</p></content></level><level class="para2"><num>(ii)</num><content><p>remedying or mitigating the adverse effect that the security compromise has on them; and</p></content></level></level><level class="para1"><num>(d)</num><content><p>the name and contact details of a person from whom further information may be obtained about the security compromise.</p></content></level></subsection></section><section eId="d25e1122"><num>105K</num><heading>Duty to inform OFCOM of security compromise</heading><subsection><num>(1)</num><intro><p>The provider of a public electronic communications network or a public electronic communications service must inform OFCOM as soon as reasonably practicable of—</p></intro><level class="para1"><num>(a)</num><content><p>any security compromise that has a significant effect on the operation of the network or service;</p></content></level><level class="para1"><num>(b)</num><content><p>any security compromise within section <ref href="#d25e108">105A</ref>(2)(b) that puts any person in a position to be able to bring about a further security compromise that would have a significant effect on the operation of the network or service.</p></content></level></subsection><subsection><num>(2)</num><intro><p>In determining for the purposes of this section whether the effect that a security compromise has, or would have, on the operation of a network or service is significant, the following matters in particular are to be taken into account—</p></intro><level class="para1"><num>(a)</num><content><p>the length of the period during which the operation of the network or service is or would be affected;</p></content></level><level class="para1"><num>(b)</num><content><p>the number of persons who use the network or service that are or would be affected by the effect on the operation of the network or service;</p></content></level><level class="para1"><num>(c)</num><content><p>the size and location of the geographical area within which persons who use the network or service are or would be affected by the effect on the operation of the network or service;</p></content></level><level class="para1"><num>(d)</num><content><p>the extent to which activities of persons who use the network or service are or would be affected by the effect on the operation of the network or service.</p></content></level></subsection></section><section eId="d25e1180"><num>105L</num><heading>Powers of OFCOM to inform others of security compromise</heading><subsection><num>(1)</num><intro><p>This section applies where OFCOM consider that—</p></intro><level class="para1"><num>(a)</num><content><p>there is a risk of a security compromise occurring in relation to a public electronic communications network or public electronic communications service; or</p></content></level><level class="para1"><num>(b)</num><content><p>a security compromise has occurred in relation to a public electronic communications network or public electronic communications service.</p></content></level></subsection><subsection><num>(2)</num><intro><p>OFCOM must inform the Secretary of State of the risk of or (as the case may be) the occurrence of the security compromise if they consider that the security compromise could result in or has resulted in—</p></intro><level class="para1"><num>(a)</num><content><p>a serious threat to the safety of the public, to public health or to national security;</p></content></level><level class="para1"><num>(b)</num><content><p>serious economic or operational problems for persons who are communications providers or persons who make associated facilities available; or</p></content></level><level class="para1"><num>(c)</num><content><p>serious economic or operational problems for persons who use electronic communications networks, electronic communications services or associated facilities.</p></content></level></subsection><subsection><num>(3)</num><content><p>OFCOM may inform the Secretary of State of the risk of or (as the case may be) the occurrence of the security compromise in a case where the duty in subsection (2) does not arise.</p></content></subsection><subsection><num>(4)</num><intro><p>OFCOM may inform any of the following about the risk of or (as the case may be) the occurrence of the security compromise—</p></intro><level class="para1"><num>(a)</num><content><p>any person who uses or has used the network or service;</p></content></level><level class="para1"><num>(b)</num><content><p>any communications provider;</p></content></level><level class="para1"><num>(c)</num><content><p>any person who makes associated facilities available;</p></content></level><level class="para1"><num>(d)</num><content><p>any overseas regulator;</p></content></level><level class="para1"><num>(e)</num><content><p>the European Union Agency for Cybersecurity.</p></content></level></subsection><subsection><num>(5)</num><intro><p>OFCOM may inform any person who uses or has used the network or service of the technical measures that may be taken by the person for the purposes of—</p></intro><level class="para1"><num>(a)</num><content><p>preventing the security compromise adversely affecting them; or</p></content></level><level class="para1"><num>(b)</num><content><p>remedying or mitigating the adverse effect that the security compromise has on them.</p></content></level></subsection><subsection><num>(6)</num><intro><p>OFCOM may direct the provider of the network or service to take steps specified in the direction for the purposes of—</p></intro><level class="para1"><num>(a)</num><content><p>informing persons who use or have used the network or service of the risk of or (as the case may be) the occurrence of the security compromise;</p></content></level><level class="para1"><num>(b)</num><content><p>informing persons who use or have used the network or service of the technical measures that may be taken by them for a purpose mentioned in subsection (5)(a) or (b).</p></content></level></subsection><subsection><num>(7)</num><intro><p>OFCOM may if they consider it to be in the public interest—</p></intro><level class="para1"><num>(a)</num><content><p>inform the public of the risk of or (as the case may be) the occurrence of the security compromise;</p></content></level><level class="para1"><num>(b)</num><content><p>inform the public of the technical measures that may be taken by members of the public for a purpose mentioned in subsection (5)(a) or (b);</p></content></level><level class="para1"><num>(c)</num><content><p>direct the provider of the network or service to do anything that OFCOM could do under paragraph (a) or (b).</p></content></level></subsection><subsection><num>(8)</num><content><p>It is the duty of the provider of the network or service to comply with a direction given under this section within such reasonable period as may be specified in the direction.</p></content></subsection><subsection><num>(9)</num><content><p>In this section “<term refersTo="#term-overseas-regulator">overseas regulator</term>” means a person who, under the law of a country or territory outside the United Kingdom, has functions in relation to public electronic communications networks or public electronic communications services that correspond to functions that OFCOM have in relation to such networks or services.</p></content></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-4-3"><num>(3)</num><content><p><mod>In section 393 (general restrictions on disclosure of information) in subsection (6) (exceptions) in paragraph (aza) for “or 25” substitute <quotedText>“, 25 or <ref href="#d25e1180">105L</ref>”</quotedText>.</mod></p></content></subsection></section></hcontainer>
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:uk="https://www.legislation.gov.uk/namespaces/UK-AKN" name="crossheading" ukl:Name="Pblock" eId="crossheading-securing-compliance-with-security-duties"><heading>Securing compliance with security duties</heading><section eId="section-5"><num>5</num><heading>General duty of OFCOM to ensure compliance with security duties</heading><content><p><mod>After section <ref href="#d25e1180">105L</ref> of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e1376"><num>105M</num><heading>General duty of OFCOM to ensure compliance with security duties</heading><content><p>OFCOM must seek to ensure that providers of public electronic communications networks and public electronic communications services comply with the duties imposed on them by or under sections <ref href="#d25e108">105A</ref> to 105D, <ref href="#d25e1061">105J</ref> and <ref href="#d25e1122">105K</ref>.</p></content></section></quotedStructure></mod></p></content></section><section eId="section-6"><num>6</num><heading>Powers of OFCOM to assess compliance with security duties</heading><subsection eId="section-6-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-6-2"><num>(2)</num><content><p><mod>After section 105M insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e1416"><num>105N</num><heading>Power of OFCOM to assess compliance with security duties</heading><subsection><num>(1)</num><content><p>OFCOM may carry out, or arrange for another person to carry out, an assessment of whether the provider of a public electronic communications network or a public electronic communications service is complying or has complied with a duty imposed on the provider by or under any of sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref>, <ref href="#d25e1061">105J</ref> and <ref href="#d25e1122">105K</ref>.</p></content></subsection><subsection><num>(2)</num><intro><p>Where an assessment under this section is carried out, the provider of the network or service concerned must—</p></intro><level class="para1"><num>(a)</num><content><p>co-operate with the assessment; and</p></content></level><level class="para1"><num>(b)</num><content><p>pay the costs reasonably incurred by OFCOM in connection with the assessment.</p></content></level></subsection></section><section eId="d25e1459"><num>105O</num><heading>Power of OFCOM to give assessment notices</heading><subsection><num>(1)</num><content><p>This section applies for the purposes of an assessment under section 105N in respect of the provider of a public electronic communications network or a public electronic communications service.</p></content></subsection><subsection><num>(2)</num><intro><p>OFCOM may by notice (“an assessment notice”) impose on the provider a duty to do any of the following things—</p></intro><level class="para1"><num>(a)</num><content><p>carry out specified tests or tests of a specified description in relation to the network or service;</p></content></level><level class="para1"><num>(b)</num><content><p>make arrangements of a specified description for another person to carry out specified tests or tests of a specified description in relation to the network or service;</p></content></level><level class="para1"><num>(c)</num><content><p>make available for interview a specified number of persons of a specified description who are involved in the provision of the network or service (not exceeding the number who are willing to be interviewed);</p></content></level><level class="para1"><num>(d)</num><content><p>permit an authorised person to enter specified premises;</p></content></level><level class="para1"><num>(e)</num><content><p>permit an authorised person to observe any operation taking place on the premises that relates to the network or service;</p></content></level><level class="para1"><num>(f)</num><content><p>direct an authorised person to equipment or other material on the premises that is of a specified description;</p></content></level><level class="para1"><num>(g)</num><content><p>direct an authorised person to documents on the premises that are of a specified description;</p></content></level><level class="para1"><num>(h)</num><content><p>assist an authorised person to view information of a specified description that is capable of being viewed using equipment on the premises;</p></content></level><level class="para1"><num>(i)</num><content><p>comply with a request from an authorised person for a copy of the documents to which the person is directed and the information the person is assisted to view;</p></content></level><level class="para1"><num>(j)</num><content><p>permit an authorised person to inspect or examine the documents, information, equipment or material to which the person is directed or which the person is assisted to view;</p></content></level><level class="para1"><num>(k)</num><content><p>provide an authorised person with an explanation of such documents, information, equipment or material.</p></content></level></subsection><subsection><num>(3)</num><intro><p>The references in subsection (2)(a) and (b) to tests in relation to the network or service include references to—</p></intro><level class="para1"><num>(a)</num><content><p>tests in relation to premises used in connection with the provision of the network or service;</p></content></level><level class="para1"><num>(b)</num><content><p>tests in relation to persons involved in the provision of the network or service.</p></content></level></subsection><subsection><num>(4)</num><content><p>An assessment notice may impose on the provider a duty to carry out, or to make arrangements for another person to carry out, a test in relation to the network or service that risks causing a security compromise, loss to a person or damage to property only if the test consists of the use of techniques that might be expected to be used by a person seeking to cause a security compromise.</p></content></subsection><subsection><num>(5)</num><content><p>An assessment notice may not impose on the provider a duty to permit an authorised person to enter domestic premises.</p></content></subsection><subsection><num>(6)</num><content><p>An assessment notice may not impose on the provider a duty to do anything that would result in the disclosure of documents or information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings.</p></content></subsection><subsection><num>(7)</num><content><p>An assessment notice must, in relation to each duty imposed by the notice, specify the time or times at which, or period or periods within which, the duty must be complied with.</p></content></subsection><subsection><num>(8)</num><content><p>A time or period specified under subsection (7) must not be a time that falls or a period that begins before the end of the period within which an appeal under section 192 can be brought in respect of the assessment notice (ignoring any power to extend the period within which an appeal could be brought).</p></content></subsection><subsection><num>(9)</num><content><p>If an appeal under section 192 is brought in respect of an assessment notice or any provision of an assessment notice, the provider need not comply with any duty imposed by the notice or the provision pending the determination or withdrawal of the appeal.</p></content></subsection><subsection><num>(10)</num><intro><p>An assessment notice must provide information about—</p></intro><level class="para1"><num>(a)</num><content><p>the consequences of failing to comply with a duty imposed by the notice; and</p></content></level><level class="para1"><num>(b)</num><content><p>the right of appeal in respect of the notice under section 192.</p></content></level></subsection><subsection><num>(11)</num><intro><p>An assessment notice may by further notice—</p></intro><level class="para1"><num>(a)</num><content><p>be revoked by OFCOM;</p></content></level><level class="para1"><num>(b)</num><content><p>be varied by OFCOM so as to make it less onerous.</p></content></level></subsection><subsection><num>(12)</num><intro><p>In this section—</p></intro><hcontainer name="definition"><content><p>“<term refersTo="#term-authorised-person">authorised person</term>” means an employee of, or person authorised by, OFCOM;</p></content></hcontainer><hcontainer name="definition"><content><p>“<term refersTo="#term-domestic-premises">domestic premises</term>” means premises, or a part of premises, used as a dwelling;</p></content></hcontainer><hcontainer name="definition"><content><p>“<term refersTo="#term-specified">specified</term>” means specified in the assessment notice.</p></content></hcontainer></subsection></section><section><num>105P</num><heading>Assessment notices: urgency statements</heading><subsection><num>(1)</num><intro><p>This section applies where—</p></intro><level class="para1"><num>(a)</num><content><p>an assessment notice is given under section 105O to the provider of a public electronic communications network or a public electronic communications service;</p></content></level><level class="para1"><num>(b)</num><content><p>the notice states that, in OFCOM’s opinion, it is necessary for the provider to comply with a duty imposed by the notice urgently;</p></content></level><level class="para1"><num>(c)</num><content><p>the notice gives OFCOM’s reasons for reaching that opinion; and</p></content></level><level class="para1"><num>(d)</num><content><p>the notice provides information about the right of the provider to make an application under section 105Q.</p></content></level></subsection><subsection><num>(2)</num><content><p>Subsections (8) and (9) of section 105O do not apply in relation to the duty mentioned in subsection (1)(b).</p></content></subsection><subsection><num>(3)</num><content><p>A time or period specified under subsection (7) of section 105O in relation to the duty mentioned in subsection (1)(b) must not be a time that falls or a period that begins before the end of the period of 14 days beginning with the day the notice is given.</p></content></subsection><subsection><num>(4)</num><intro><p>In a case where—</p></intro><level class="para1"><num>(a)</num><content><p>the duty mentioned in subsection (1)(b) is a duty to do something mentioned in section 105O(2)(d) to (k), and</p></content></level><level class="para1"><num>(b)</num><content><p>within the period of 14 days beginning with the day the notice is given an appeal under section 192 is brought in respect of the notice or the provision of the notice that imposes the duty,</p></content></level><wrapUp><p>the provider of the network or service need not comply with the duty pending the determination or withdrawal of the appeal.</p></wrapUp></subsection></section><section><num>105Q</num><heading>Assessment notices: applications in respect of urgency statements</heading><subsection><num>(1)</num><content><p>This section applies where an assessment notice given under section 105O to a provider of a public electronic communications network or a public electronic communications service contains a statement under section 105P(1)(b).</p></content></subsection><subsection><num>(2)</num><intro><p>The provider may apply to the court for either or both of the following—</p></intro><level class="para1"><num>(a)</num><content><p>the disapplication of the statement in relation to some or all of the duties imposed by the notice;</p></content></level><level class="para1"><num>(b)</num><content><p>a change to the time at which, or period within which, a duty imposed by the notice must be complied with.</p></content></level></subsection><subsection><num>(3)</num><intro><p>On an application under this section, the court may do any of the following—</p></intro><level class="para1"><num>(a)</num><content><p>direct that the notice is to have effect as if it did not contain the statement;</p></content></level><level class="para1"><num>(b)</num><content><p>direct that the inclusion of the statement is not to have effect in relation to a duty imposed by the notice;</p></content></level><level class="para1"><num>(c)</num><content><p>vary the notice by changing the time at which, or the period within which, a duty imposed by the notice must be complied with;</p></content></level><level class="para1"><num>(d)</num><content><p>vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).</p></content></level></subsection><subsection><num>(4)</num><content><p>The decision of the court on an application under this section is final.</p></content></subsection><subsection><num>(5)</num><content><p>In this section “<term refersTo="#term-the-court">the court</term>” means the High Court or, in Scotland, the Court of Session.</p></content></subsection></section><section eId="d25e1809"><num>105R</num><heading>Assessment notices: information about entering premises</heading><content><p>Every report under paragraph 12 of the Schedule to the Office of Communications Act 2002 (OFCOM’s annual report) must include a statement of the number of occasions during the financial year to which the report relates on which premises have been entered in pursuance of a duty imposed under section 105O(2)(d).</p></content></section></quotedStructure></mod></p></content></subsection><subsection eId="section-6-3"><num>(3)</num><content><p><mod>In section 135 (information required for purposes of certain OFCOM functions) in subsection (3) (particular purposes for which information may be required) after paragraph (i) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para2"><num>(iza)</num><content><p>carrying out an assessment under section <ref href="#d25e1416">105N</ref>;</p></content></level></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection><subsection eId="section-6-4"><num>(4)</num><content><p><mod>In Schedule 8 (decisions not subject to appeal) after paragraph 7 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="schedule" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="schedule" ukl:Format="double"><paragraph class="schProv1"><num>7A</num><content><p>A decision to include a statement under section 105P(1)(b) in an assessment notice under section 105O.</p></content></paragraph></quotedStructure></mod></p></content></subsection></section><section eId="section-7"><num>7</num><heading>Powers of OFCOM to enforce compliance with security duties</heading><subsection eId="section-7-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-7-2"><num>(2)</num><content><p><mod>After section <ref href="#d25e1809">105R</ref> insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e1874"><num>105S</num><heading>Enforcement of security duties</heading><subsection><num>(1)</num><content><p>Sections 96A to 100, 102 and 103 apply in relation to a contravention of a security duty as they apply in relation to a contravention of a condition set under section 45, other than an SMP apparatus condition.</p></content></subsection><subsection><num>(2)</num><content><p>This section is subject to section <ref href="#d25e1924">105T</ref> (enforcement of security duties: amount of penalties).</p></content></subsection><subsection><num>(3)</num><content><p>In this section “<term refersTo="#term-security-duty">security duty</term>” means a duty imposed by or under any of sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref>, 105I to <ref href="#d25e1122">105K</ref>, <ref href="#d25e1180">105L</ref>(6), (7)(c) and (8), <ref href="#d25e1416">105N</ref>(2)(a) and <ref href="#d25e1459">105O</ref>.</p></content></subsection></section><section eId="d25e1924"><num>105T</num><heading>Enforcement of security duties: amount of penalties</heading><subsection><num>(1)</num><content><p>In its application in relation to a contravention of a security duty, other than a security duty imposed by section 105I, section 96B(5) has effect as if the maximum penalty specified were £100,000 per day.</p></content></subsection><subsection><num>(2)</num><content><p>In its application in relation to a contravention of a security duty imposed by section 105I, section 96B(5) has effect as if the maximum penalty specified were £50,000 per day.</p></content></subsection><subsection><num>(3)</num><content><p>In its application in relation to a contravention of a security duty imposed by section 105I, section 97(1) has effect as if the maximum penalty specified were £10 million.</p></content></subsection><subsection><num>(4)</num><content><p>The Secretary of State may by regulations amend this section so as to substitute a different amount for the amount for the time being specified in subsection (1), (2) or (3).</p></content></subsection><subsection><num>(5)</num><content><p>No regulations are to be made containing provision authorised by subsection (4) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.</p></content></subsection><subsection><num>(6)</num><content><p>In this section “<term refersTo="#term-security-duty">security duty</term>” has the same meaning as in section <ref href="#d25e1874">105S</ref>.</p></content></subsection></section><section eId="d25e1973"><num>105U</num><heading>Enforcement of security duties: proposal for interim steps</heading><subsection eId="d25e1977"><num>(1)</num><intro><p>This section applies where—</p></intro><level class="para1" eId="d25e1983"><num>(a)</num><content><p>OFCOM determine that there are reasonable grounds for believing that the provider of a public electronic communications network or a public electronic communications service is contravening or has contravened a duty imposed by or under any of sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref>;</p></content></level><level class="para1"><num>(b)</num><content><p>OFCOM either have not commenced, or have commenced but not completed, enforcement action in connection with the contravention;</p></content></level><level class="para1" eId="d25e2001"><num>(c)</num><intro><p>OFCOM determine that there are reasonable grounds for believing that either or both of the following conditions are met—</p></intro><level class="para2"><num>(i)</num><content><p>a security compromise has occurred as a result of the contravention;</p></content></level><level class="para2"><num>(ii)</num><content><p>there is an imminent risk of a security compromise or (as the case may be) a further security compromise occurring as a result of the contravention; and</p></content></level></level><level class="para1"><num>(d)</num><content><p>OFCOM determine that, having regard to the seriousness or likely seriousness of the security compromise or security compromises mentioned in paragraph (c), it is reasonable to require the provider to take interim steps pending the completion by OFCOM of enforcement action in connection with the contravention.</p></content></level></subsection><subsection><num>(2)</num><intro><p>OFCOM may give a notification to the provider that—</p></intro><level class="para1"><num>(a)</num><content><p>sets out the determinations mentioned in subsection (1);</p></content></level><level class="para1"><num>(b)</num><content><p>specifies the interim steps that OFCOM think the provider should be required to take pending the completion by OFCOM of enforcement action in connection with the contravention; and</p></content></level><level class="para1"><num>(c)</num><content><p>specifies the period during which the provider has an opportunity to make representations about the matters notified.</p></content></level></subsection><subsection><num>(3)</num><intro><p>In this section and section <ref href="#d25e2124">105V</ref>—</p></intro><level class="para1"><num>(a)</num><content><p>references to the commencement by OFCOM of enforcement action in connection with a contravention are to the giving of a notification under section 96A (as applied by section <ref href="#d25e1874">105S</ref>) in respect of the contravention; and</p></content></level><level class="para1"><num>(b)</num><content><p>references to the completion by OFCOM of enforcement action in connection with a contravention are to the taking of action under section 96C(2)(a) or (b) (as applied by section <ref href="#d25e1874">105S</ref>) in connection with the contravention.</p></content></level></subsection><subsection><num>(4)</num><intro><p>In this section “<term refersTo="#term-interim-steps">interim steps</term>” means—</p></intro><level class="para1"><num>(a)</num><intro><p>in a case where OFCOM determine that there are reasonable grounds for believing that the condition in subsection (1)(c)(i) is met, steps to—</p></intro><level class="para2"><num>(i)</num><content><p>prevent adverse effects (on the network or service or otherwise) arising from the security compromise;</p></content></level><level class="para2"><num>(ii)</num><content><p>remedy or mitigate any adverse effects on the network or service arising from the security compromise;</p></content></level></level><level class="para1"><num>(b)</num><intro><p>in a case where OFCOM determine that there are reasonable grounds for believing that the condition in subsection (1)(c)(ii) is met, steps to—</p></intro><level class="para2"><num>(i)</num><content><p>eliminate or reduce the risk of the security compromise or (as the case may be) the further security compromise occurring;</p></content></level><level class="para2"><num>(ii)</num><content><p>prevent adverse effects (on the network or service or otherwise) arising from the security compromise or (as the case may be) the further security compromise in the event it occurs.</p></content></level></level></subsection></section><section eId="d25e2124"><num>105V</num><heading>Enforcement of security duties: direction to take interim steps</heading><subsection><num>(1)</num><intro><p>This section applies where—</p></intro><level class="para1"><num>(a)</num><content><p>the provider of a public electronic communications network or a public electronic communications service has been given a notification under section <ref href="#d25e1973">105U</ref>;</p></content></level><level class="para1"><num>(b)</num><content><p>OFCOM have allowed the provider an opportunity to make representations about the matters notified; and</p></content></level><level class="para1"><num>(c)</num><content><p>the period allowed for the making of representations has expired.</p></content></level></subsection><subsection><num>(2)</num><intro><p>OFCOM may—</p></intro><level class="para1"><num>(a)</num><content><p>direct the provider to take the interim steps or any of the interim steps specified in the notification; or</p></content></level><level class="para1"><num>(b)</num><content><p>inform the provider that a direction under paragraph (a) will not be given.</p></content></level></subsection><subsection><num>(3)</num><intro><p>OFCOM may give a direction under subsection (2)(a) only if (after considering any representations) they are satisfied—</p></intro><level class="para1"><num>(a)</num><content><p>that there are reasonable grounds for believing that the contravention on the basis of which the notification was given occurred;</p></content></level><level class="para1"><num>(b)</num><intro><p>that there are reasonable grounds for believing that either or both of the following conditions are met—</p></intro><level class="para2"><num>(i)</num><content><p>a security compromise has occurred as a result of the contravention;</p></content></level><level class="para2"><num>(ii)</num><content><p>there is an imminent risk of a security compromise or (as the case may be) a further security compromise occurring as a result of the contravention; and</p></content></level></level><level class="para1"><num>(c)</num><content><p>that, having regard to the seriousness or likely seriousness of the security compromise or security compromises mentioned in paragraph (b), it is reasonable to give the direction.</p></content></level></subsection><subsection><num>(4)</num><content><p>A direction under subsection (2)(a) must include a statement of OFCOM’s reasons for giving the direction.</p></content></subsection><subsection><num>(5)</num><content><p>A direction under subsection (2)(a) must, in relation to each interim step, specify the period within which the step must be taken.</p></content></subsection><subsection><num>(6)</num><content><p>A direction under subsection (2)(a) is ineffective in so far as it would require interim steps to be taken after the completion by OFCOM of enforcement action in connection with the contravention concerned.</p></content></subsection><subsection><num>(7)</num><intro><p>Where a direction under subsection (2)(a) has been given and has not been revoked, OFCOM must as soon as reasonably practicable—</p></intro><level class="para1"><num>(a)</num><content><p>commence enforcement action in connection with the contravention concerned (unless enforcement action was commenced by OFCOM before the direction was given); and</p></content></level><level class="para1"><num>(b)</num><content><p>complete enforcement action in connection with the contravention concerned.</p></content></level></subsection><subsection><num>(8)</num><intro><p>A direction under subsection (2)(a) may at any time—</p></intro><level class="para1"><num>(a)</num><content><p>be revoked by OFCOM; or</p></content></level><level class="para1"><num>(b)</num><content><p>be varied by OFCOM so as to make it less onerous.</p></content></level></subsection><subsection><num>(9)</num><content><p>A provider of a public electronic communications network or a public electronic communications service who is given a direction under subsection (2)(a) must comply with it.</p></content></subsection><subsection><num>(10)</num><intro><p>That duty is enforceable in civil proceedings by OFCOM—</p></intro><level class="para1"><num>(a)</num><content><p>for an injunction;</p></content></level><level class="para1"><num>(b)</num><content><p>for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or</p></content></level><level class="para1"><num>(c)</num><content><p>for any other appropriate remedy or relief.</p></content></level></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-7-3"><num>(3)</num><content><p><mod>In section 113 (suspension of application of the electronic communications code) in subsection (2)(b) for “section 105D” substitute <quotedText>“section <ref href="#d25e1874">105S</ref>”</quotedText>.</mod></p></content></subsection></section><section eId="section-8"><num>8</num><heading>Civil liability for contravention of security duties</heading><content><p><mod>After section <ref href="#d25e2124">105V</ref> of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e2323"><num>105W</num><heading>Civil liability for breach of security duties</heading><subsection><num>(1)</num><content><p>A duty imposed by or under any of sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref> and <ref href="#d25e1061">105J</ref> on a provider of a public electronic communications network or a public electronic communications service is a duty owed to every person who may be affected by a contravention of the duty.</p></content></subsection><subsection><num>(2)</num><content><p>Subsections (3) and (4) apply where a duty is owed by virtue of subsection (1) to a person.</p></content></subsection><subsection><num>(3)</num><content><p>A breach of the duty that causes that person to sustain loss or damage is actionable at the suit or instance of that person.</p></content></subsection><subsection><num>(4)</num><intro><p>An act which—</p></intro><level class="para1"><num>(a)</num><content><p>by inducing a breach of the duty or interfering with its performance, causes that person to sustain loss or damage, and</p></content></level><level class="para1"><num>(b)</num><content><p>is done wholly or partly for achieving that result,</p></content></level><wrapUp><p>is actionable at the suit or instance of that person.</p></wrapUp></subsection><subsection><num>(5)</num><content><p>In proceedings brought against a provider of a public electronic communications network or a public electronic communications service by virtue of subsection (3), it is a defence for the provider to show that they took all reasonable steps and exercised all due diligence to avoid contravening the duty in question.</p></content></subsection><subsection><num>(6)</num><content><p>The consent of OFCOM is required for the bringing of proceedings by virtue of this section.</p></content></subsection><subsection><num>(7)</num><content><p>If OFCOM give their consent subject to conditions relating to the conduct of the proceedings, the proceedings are not to be carried on except in compliance with those conditions.</p></content></subsection></section></quotedStructure></mod></p></content></section><section eId="section-9"><num>9</num><heading>Relationship between security duties and certain other duties etc</heading><content><p><mod>After section 105W of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e2407"><num>105X</num><heading>Relationship between security duties and certain other duties etc</heading><subsection><num>(1)</num><intro><p>A security duty imposed on a provider of a public electronic communications network or a public electronic communications service does not apply in so far as compliance with the duty would—</p></intro><level class="para1"><num>(a)</num><content><p>result in a failure by the provider to comply with a duty or prohibition imposed by or under an enactment mentioned in section <ref href="#d25e108">105A</ref>(4);</p></content></level><level class="para1"><num>(b)</num><content><p>prevent the provider from giving effect to a warrant or authorisation that has been issued or given under an enactment mentioned in section 105A(4);</p></content></level><level class="para1"><num>(c)</num><content><p>prevent the provider from providing a person with assistance in giving effect to a warrant or authorisation that has been issued or given under an enactment mentioned in section <ref href="#d25e108">105A</ref>(4); or</p></content></level><level class="para1"><num>(d)</num><content><p>prevent the provider from providing a person with assistance in exercising any power conferred by or under prison rules.</p></content></level></subsection><subsection><num>(2)</num><intro><p>In this section—</p></intro><hcontainer name="definition"><content><p>“<term refersTo="#term-prison-rules">prison rules</term>” has the same meaning as in section 105A;</p></content></hcontainer><hcontainer name="definition"><intro><p>“<term refersTo="#term-security-duty">security duty</term>” means a duty imposed by or under—</p></intro><level class="para1"><num>(a)</num><content><p>section 96C as applied by section 105S; or</p></content></level><level class="para1"><num>(b)</num><content><p>any of sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref>, 105I to <ref href="#d25e1122">105K</ref>, <ref href="#d25e1180">105L</ref>(6), (7)(c) and (8), <ref href="#d25e1416">105N</ref>(2)(a), <ref href="#d25e1459">105O</ref> and <ref href="#d25e2124">105V</ref>.</p></content></level></hcontainer></subsection></section></quotedStructure></mod></p></content></section><section eId="section-10"><num>10</num><heading>Statement of policy on ensuring compliance with security duties</heading><subsection eId="section-10-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-10-2"><num>(2)</num><content><p><mod>After section <ref href="#d25e2407">105X</ref> insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e2527"><num>105Y</num><heading>Statement of policy on ensuring compliance with security duties</heading><subsection eId="d25e2531"><num>(1)</num><content><p>OFCOM must prepare and publish a statement of their general policy with respect to the exercise of their functions under sections <ref href="#d25e954">105I</ref> and <ref href="#d25e1376">105M</ref> to <ref href="#d25e2124">105V</ref>.</p></content></subsection><subsection><num>(2)</num><content><p>OFCOM may from time to time revise that statement as they think fit.</p></content></subsection><subsection><num>(3)</num><content><p>Where OFCOM make or revise their statement of policy under this section, they must publish that statement or (as the case may be) the revised statement in such manner as they consider appropriate for bringing it to the attention of the persons who, in their opinion, are likely to be affected by it.</p></content></subsection><subsection><num>(4)</num><content><p>In exercising their functions under sections <ref href="#d25e954">105I</ref> and <ref href="#d25e1376">105M</ref> to <ref href="#d25e2124">105V</ref> OFCOM must have regard to the statement for the time being in force under this section.</p></content></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-10-3"><num>(3)</num><content><p><mod>In Schedule 8 (decisions not subject to appeal) after paragraph 7A (inserted by section 6(4)) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="schedule" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="schedule" ukl:Format="double"><paragraph class="schProv1"><num>7B</num><content><p>A decision relating to the making or revision of a statement under section <ref href="#d25e2527">105Y</ref>.</p></content></paragraph></quotedStructure></mod></p></content></subsection></section></hcontainer>
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:uk="https://www.legislation.gov.uk/namespaces/UK-AKN" name="crossheading" ukl:Name="Pblock" eId="crossheading-reports-on-security-etc"><heading>Reports on security etc</heading><section eId="section-11"><num>11</num><heading>Reporting on matters related to security</heading><subsection eId="section-11-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-11-2"><num>(2)</num><content><p><mod>After section <ref href="#d25e2527">105Y</ref> insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e2620"><num>105Z</num><heading>OFCOM reports on security</heading><subsection><num>(1)</num><content><p>As soon as practicable after the end of each reporting period OFCOM must prepare and send to the Secretary of State a report for the period (a “security report”).</p></content></subsection><subsection><num>(2)</num><content><p>A security report must contain such information and advice as OFCOM consider may best serve the purpose mentioned in subsection (3).</p></content></subsection><subsection><num>(3)</num><content><p>The purpose is to assist the Secretary of State in the formulation of policy in relation to the security of public electronic communications networks and public electronic communications services.</p></content></subsection><subsection><num>(4)</num><intro><p>A security report must in particular include—</p></intro><level class="para1"><num>(a)</num><content><p>information about the extent to which providers of public electronic communications networks and public electronic communications services have complied during the reporting period with the duties imposed on them by or under sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref>, <ref href="#d25e954">105I</ref> to <ref href="#d25e1122">105K</ref>, <ref href="#d25e1416">105N</ref>(2)(a) and <ref href="#d25e1459">105O</ref>;</p></content></level><level class="para1"><num>(b)</num><content><p>information about the extent to which providers of public electronic communications networks and public electronic communications services have acted during the reporting period in accordance with codes of practice issued under section <ref href="#d25e560">105E</ref>;</p></content></level><level class="para1"><num>(c)</num><content><p>information about the security compromises that OFCOM have been informed of during the reporting period under section <ref href="#d25e1122">105K</ref>;</p></content></level><level class="para1"><num>(d)</num><content><p>information about the action taken by OFCOM during the reporting period in response to security compromises they have been informed of under section <ref href="#d25e1122">105K</ref>;</p></content></level><level class="para1"><num>(e)</num><content><p>information about the extent to which and manner in which OFCOM have exercised the functions conferred on them by sections <ref href="#d25e954">105I</ref> and <ref href="#d25e1180">105L</ref> to <ref href="#d25e2124">105V</ref> during the reporting period;</p></content></level><level class="para1"><num>(f)</num><content><p>information about any particular risks to the security of public electronic communications networks and public electronic communications services of which OFCOM have become aware during the reporting period;</p></content></level><level class="para1"><num>(g)</num><content><p>any other information of a kind specified in a direction given by the Secretary of State.</p></content></level></subsection><subsection><num>(5)</num><content><p>A security report must not include personal data (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).</p></content></subsection><subsection eId="d25e2733"><num>(6)</num><intro><p>The Secretary of State may—</p></intro><level class="para1"><num>(a)</num><content><p>publish a security report or any part of it; or</p></content></level><level class="para1"><num>(b)</num><content><p>disclose a security report or any part of it to any person or body performing functions of a public nature for the purpose of enabling or assisting the performance of those functions.</p></content></level></subsection><subsection><num>(7)</num><content><p>In publishing or disclosing a security report or any part of a security report, the Secretary of State must have regard to the need to exclude from publication or disclosure, so far as is practicable, the matters which are confidential in accordance with subsection (8).</p></content></subsection><subsection eId="d25e2757"><num>(8)</num><intro><p>A matter is confidential under this subsection if—</p></intro><level class="para1"><num>(a)</num><content><p>it relates to the affairs of a particular body; and</p></content></level><level class="para1"><num>(b)</num><content><p>publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that body.</p></content></level></subsection><subsection><num>(9)</num><intro><p>In this section “<term refersTo="#term-reporting-period">reporting period</term>” means—</p></intro><level class="para1"><num>(a)</num><content><p>the period of 2 years beginning with the day on which section 11 of the Telecommunications (Security) Act 2021 comes into force; and</p></content></level><level class="para1"><num>(b)</num><content><p>each successive period of 12 months.</p></content></level></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-11-3"><num>(3)</num><intro><p>In section 134B (matters to be dealt with by OFCOM reports on infrastructure)—</p></intro><level class="para1" eId="section-11-3-a"><num>(a)</num><content><p><mod>in subsection (1) (the electronic communications networks matters) after paragraph (h) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para1"><num>(ha)</num><content><p>the extent to which providers of public UK networks are complying with the duties imposed on them by or under sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref>,</p></content></level></quotedStructure><inline name="appendText">; and</inline></mod></p></content></level><level class="para1" eId="section-11-3-b"><num>(b)</num><content><p><mod>in subsection (2) (the electronic communications services matters) after paragraph (f) (but before the “and” after it) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para1"><num>(fa)</num><content><p>the extent to which providers of public UK services are complying with the duties imposed on them by or under sections <ref href="#d25e108">105A</ref> to <ref href="#d25e499">105D</ref>,</p></content></level></quotedStructure><inline name="appendText">.</inline></mod></p></content></level></subsection><subsection eId="section-11-4"><num>(4)</num><content><p><mod>In section 135 (information required for purposes of certain OFCOM functions) in subsection (3) (particular purposes for which information may be required) after paragraph (iza) (inserted by section 6(3)) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para2"><num>(izb)</num><content><p>preparing a report under section <ref href="#d25e2620">105Z</ref>;</p></content></level></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection><subsection eId="section-11-5"><num>(5)</num><content><p><mod>In section 393 (general restrictions on disclosure of information) in subsection (6) (exceptions) after paragraph (b) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para1"><num>(bza)</num><content><p>prevents the publication or disclosure of a report or part of a report under section <ref href="#d25e2620">105Z</ref>(6);</p></content></level></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection><subsection eId="section-11-6"><num>(6)</num><content><p><mod>In Schedule 8 (decisions not subject to appeal) after paragraph 7B (inserted by section 10(3)) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="schedule" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="schedule" ukl:Format="double"><paragraph class="schProv1"><num>7C</num><content><p>A decision relating to the making of a report under section <ref href="#d25e2620">105Z</ref>.</p></content></paragraph></quotedStructure></mod></p></content></subsection></section><section eId="section-12"><num>12</num><heading>Powers to require and share information related to security</heading><subsection eId="section-12-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-12-2"><num>(2)</num><content><p><mod>In section 24B (provision of information to assist in formulation of policy) after subsection (2) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><subsection><num>(3)</num><content><p>But subsection (2) does not prevent OFCOM providing the Secretary of State with any information that they consider may assist the Secretary of State in the formulation of policy in relation to the security of public electronic communications networks or public electronic communications services.</p></content></subsection></quotedStructure></mod></p></content></subsection><subsection eId="section-12-3"><num>(3)</num><intro><p>In section 135 (power of OFCOM to require information for the purposes of certain functions)—</p></intro><level class="para1" eId="section-12-3-a"><num>(a)</num><intro><p>in subsection (3) (particular purposes for which information may be required)—</p></intro><level class="para2" eId="section-12-3-a-i"><num>(i)</num><content><p><mod>after paragraph (izb) (inserted by section 11(4)) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para1"><num>(izc)</num><content><p>assessing the risk of a security compromise occurring in relation to a public electronic communications network or a public electronic communications service;</p></content></level></quotedStructure><inline name="appendText">;</inline></mod></p></content></level><level class="para2" eId="section-12-3-a-ii"><num>(ii)</num><content><p>omit paragraphs (ie) and (if);</p></content></level></level><level class="para1" eId="section-12-3-b"><num>(b)</num><content><p><mod>in subsection (3A) (particular descriptions of information that may be required) before paragraph (a) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para1"><num>(za)</num><content><p>information concerning future developments of a public electronic communications network or public electronic communications service that could have an impact on the security of the network or service,</p></content></level></quotedStructure><inline name="appendText">;</inline></mod></p></content></level><level class="para1" eId="section-12-3-c"><num>(c)</num><content><p><mod>after subsection (3B) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><subsection><num>(3C)</num><intro><p>OFCOM may require a person falling within subsection (2)—</p></intro><level class="para1"><num>(a)</num><content><p>to produce, generate or obtain security information for the purpose of providing it under subsection (1);</p></content></level><level class="para1"><num>(b)</num><content><p>to collect or retain security information that the person would not otherwise collect or retain for the purpose of providing it under subsection (1);</p></content></level><level class="para1"><num>(c)</num><content><p>to process, collate or analyse any information held by the person (including information the person has been required to collect or retain) for the purpose of producing or generating security information to be provided under subsection (1).</p></content></level></subsection><subsection><num>(3D)</num><content><p>In subsection (3C) “<term refersTo="#term-security-information">security information</term>” means information OFCOM consider necessary for the purpose of carrying out their functions under sections <ref href="#d25e1180">105L</ref> to <ref href="#d25e2620">105Z</ref>.</p></content></subsection></quotedStructure><inline name="appendText">; and</inline></mod></p></content></level><level class="para1" eId="section-12-3-d"><num>(d)</num><content><p><mod>in subsection (4) for the words from “required” to “it” substitute <quotedText>“must comply with a requirement imposed under this section”</quotedText>.</mod></p></content></level></subsection><subsection eId="section-12-4"><num>(4)</num><intro><p>In section 137 (restrictions on imposing information requirements)—</p></intro><level class="para1" eId="section-12-4-a"><num>(a)</num><content><p><mod>in subsection (1) for “information may be required” substitute <quotedText>“requirements may be imposed”</quotedText>;</mod></p></content></level><level class="para1" eId="section-12-4-b"><num>(b)</num><content><p>omit subsection (2A); and</p></content></level><level class="para1" eId="section-12-4-c"><num>(c)</num><content><p><mod>after subsection (6) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><subsection><num>(7)</num><content><p>OFCOM are not to impose a requirement on a person under section 135(3C) except by a notice served on the person that sets out the requirement and OFCOM’s reasons for imposing it.</p></content></subsection></quotedStructure></mod></p></content></level></subsection></section><section eId="section-13"><num>13</num><heading>Appeals against security decisions of OFCOM</heading><subsection eId="section-13-1"><num>(1)</num><content><p>Section 194A of the Communications Act 2003 (disposal of appeals against decisions of OFCOM etc) is amended as follows.</p></content></subsection><subsection eId="section-13-2"><num>(2)</num><content><p><mod>After subsection (2) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><subsection><num>(2A)</num><content><p>In a case where the appeal is against a relevant security decision of OFCOM, the Tribunal is to apply those principles without taking any special account of the merits of the case.</p></content></subsection><subsection><num>(2B)</num><content><p>Subsection (2A) has effect notwithstanding any retained case law or retained general principle of EU law.</p></content></subsection></quotedStructure></mod></p></content></subsection><subsection eId="section-13-3"><num>(3)</num><content><p><mod>In subsection (6) at the end insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="definition"><content><p>“<term refersTo="#term-relevant-security-decision">relevant security decision</term>” means a decision under any of sections 105I, <ref href="#d25e1180">105L</ref> to <ref href="#d25e1459">105O</ref> and <ref href="#d25e1973">105U</ref> to <ref href="#d25e2323">105W</ref>;</p></content></hcontainer><hcontainer name="definition"><content><p>“retained case law” and “retained general principle of EU law” have the meanings given by section 6(7) of the European Union (Withdrawal) Act 2018.</p></content></hcontainer></quotedStructure></mod></p></content></subsection></section><section eId="section-14"><num>14</num><heading>Reviews of sections 1 to 13</heading><subsection eId="section-14-1"><num>(1)</num><content><p>The Secretary of State must carry out reviews of the impact and effectiveness of sections 1 to 13.</p></content></subsection><subsection eId="section-14-2"><num>(2)</num><content><p>After each review the Secretary of State must publish a report of the review and lay a copy before Parliament.</p></content></subsection><subsection eId="section-14-3"><num>(3)</num><content><p>The reports must be published not more than 5 years apart.</p></content></subsection><subsection eId="section-14-4"><num>(4)</num><content><p>The first report must be published within the period of 5 years beginning with the day on which this Act is passed.</p></content></subsection></section></hcontainer>
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:uk="https://www.legislation.gov.uk/namespaces/UK-AKN" name="crossheading" ukl:Name="Pblock" eId="crossheading-designated-vendor-directions"><heading>Designated vendor directions</heading><section eId="section-15"><num>15</num><heading>Designated vendor directions</heading><subsection eId="section-15-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-15-2"><num>(2)</num><content><p><mod>After section <ref href="#d25e2620">105Z</ref> insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="crossheading" ukl:Name="Pblock"><heading>Security of public electronic communications networks and services: designated vendor directions</heading><section eId="d25e3193"><num>105Z1</num><heading>Designated vendor directions</heading><subsection eId="d25e3197"><num>(1)</num><content><p>The Secretary of State may give a direction under this section (“a designated vendor direction”) to a public communications provider.</p></content></subsection><subsection eId="d25e3203"><num>(2)</num><intro><p>The Secretary of State may give a designated vendor direction only if the Secretary of State considers that—</p></intro><level class="para1"><num>(a)</num><content><p>the direction is necessary in the interests of national security; and</p></content></level><level class="para1"><num>(b)</num><content><p>the requirements imposed by the direction are proportionate to what is sought to be achieved by the direction.</p></content></level></subsection><subsection eId="d25e3221"><num>(3)</num><content><p>A designated vendor direction may impose requirements on a public communications provider with respect to the use, in connection with a purpose mentioned in subsection <ref href="#d25e3230">(4)</ref>, of goods, services or facilities supplied, provided or made available by a designated vendor specified in the direction.</p></content></subsection><subsection eId="d25e3230"><num>(4)</num><intro><p>The purposes referred to in subsection <ref href="#d25e3221">(3)</ref> are—</p></intro><level class="para1"><num>(a)</num><content><p>in the case of a provider of a public electronic communications network, the provision of that network;</p></content></level><level class="para1"><num>(b)</num><content><p>in the case of a provider of a public electronic communications service, the provision of that service;</p></content></level><level class="para1"><num>(c)</num><content><p>in the case of a person who makes available facilities that are associated facilities by reference to a public electronic communications network or public electronic communications service, the making available of those facilities; or</p></content></level><level class="para1"><num>(d)</num><content><p>in the case of a provider of a public electronic communications network or public electronic communications service, enabling persons to make use of that network or service.</p></content></level></subsection><subsection eId="d25e3263"><num>(5)</num><intro><p>A designated vendor direction must specify—</p></intro><level class="para1"><num>(a)</num><content><p>the public communications provider or providers to which the direction is given;</p></content></level><level class="para1" eId="d25e3275"><num>(b)</num><content><p>the reasons for the direction;</p></content></level><level class="para1"><num>(c)</num><content><p>the time at which the direction comes into force.</p></content></level></subsection><subsection><num>(6)</num><content><p>The requirement in subsection <ref href="#d25e3263">(5)</ref><ref href="#d25e3275">(b)</ref> does not apply if or to the extent that the Secretary of State considers that specifying reasons in the direction would be contrary to the interests of national security.</p></content></subsection><subsection eId="d25e3298"><num>(7)</num><content><p>A public communications provider to which a designated vendor direction is given must comply with the direction.</p></content></subsection><subsection><num>(8)</num><content><p>A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility.</p></content></subsection></section><section><num>105Z2</num><heading>Further provision about requirements</heading><subsection><num>(1)</num><content><p>This section makes further provision about the requirements that may be imposed by a designated vendor direction on a public communications provider.</p></content></subsection><subsection><num>(2)</num><intro><p>The requirements may include, among other things—</p></intro><level class="para1"><num>(a)</num><content><p>requirements prohibiting or restricting the use of goods, services or facilities supplied, provided or made available by a designated vendor specified in the direction;</p></content></level><level class="para1"><num>(b)</num><content><p>requirements prohibiting the installation of such goods or the taking up of such services or facilities;</p></content></level><level class="para1"><num>(c)</num><content><p>requirements about removing, disabling or modifying such goods or facilities;</p></content></level><level class="para1"><num>(d)</num><content><p>requirements about modifying such services;</p></content></level><level class="para1"><num>(e)</num><content><p>requirements about the manner in which such goods, services or facilities may be used.</p></content></level></subsection><subsection><num>(3)</num><intro><p>A requirement in a designated vendor direction may, among other things—</p></intro><level class="para1"><num>(a)</num><intro><p>relate to the use of goods, services or facilities in connection with a specified function of—</p></intro><level class="para2"><num>(i)</num><content><p>the public electronic communications network provided by the provider;</p></content></level><level class="para2"><num>(ii)</num><content><p>the public electronic communications service provided by the provider; or</p></content></level><level class="para2"><num>(iii)</num><content><p>an associated facility made available by the provider that is an associated facility by reference to such a network or service (as the case may be);</p></content></level></level><level class="para1"><num>(b)</num><intro><p>relate to the use of goods, services or facilities in a specified part of—</p></intro><level class="para2"><num>(i)</num><content><p>the public electronic communications network provided by the provider;</p></content></level><level class="para2"><num>(ii)</num><content><p>the public electronic communications service provided by the provider; or</p></content></level><level class="para2"><num>(iii)</num><content><p>an associated facility made available by the provider that is an associated facility by reference to such a network or service (as the case may be).</p></content></level></level></subsection><subsection><num>(4)</num><intro><p>A requirement in a designated vendor direction may make provision by reference to, among other matters—</p></intro><level class="para1"><num>(a)</num><content><p>the source of goods, services or facilities that are supplied, provided or made available by a designated vendor specified in the direction;</p></content></level><level class="para1" eId="d25e3425"><num>(b)</num><content><p>the time at which goods, services or facilities were developed or produced (which may be a time before the passing of the Telecommunications (Security) Act 2021);</p></content></level><level class="para1" eId="d25e3431"><num>(c)</num><content><p>the time at which goods, services or facilities were procured by, or supplied, provided or made available to, the public communications provider (which may be a time before the passing of that Act).</p></content></level></subsection><subsection><num>(5)</num><content><p>A designated vendor direction may impose requirements that apply in specified circumstances (for example where the public communications provider is using goods, services or facilities supplied, provided or made available by one or more other specified persons).</p></content></subsection><subsection><num>(6)</num><content><p>A designated vendor direction may provide for exceptions to a requirement.</p></content></subsection><subsection eId="d25e3449"><num>(7)</num><content><p>A requirement to do a thing must specify the period within which the thing is to be done.</p></content></subsection><subsection><num>(8)</num><content><p>A period specified under subsection <ref href="#d25e3449">(7)</ref> must be such period as appears to the Secretary of State to be reasonable.</p></content></subsection><subsection><num>(9)</num><intro><p>In this section—</p></intro><level class="para1"><num>(a)</num><content><p>a reference to a facility includes a reference to a facility, element or service that is an associated facility;</p></content></level><level class="para1"><num>(b)</num><content><p>“<term refersTo="#term-specified">specified</term>” means specified in a designated vendor direction.</p></content></level></subsection></section><section eId="d25e3488"><num>105Z3</num><heading>Consultation about designated vendor directions</heading><subsection eId="d25e3492"><num>(1)</num><intro><p>Before giving a designated vendor direction, the Secretary of State must consult—</p></intro><level class="para1"><num>(a)</num><content><p>the public communications provider or providers which would be subject to the proposed direction, and</p></content></level><level class="para1"><num>(b)</num><content><p>the person or persons who would be specified as a designated vendor or vendors in the proposed direction in accordance with section <ref href="#d25e3193">105Z1</ref><ref href="#d25e3221">(3)</ref>,</p></content></level><wrapUp><p>so far as it is reasonably practicable to do so.</p></wrapUp></subsection><subsection><num>(2)</num><content><p>The requirement in subsection <ref href="#d25e3492">(1)</ref> does not apply if or to the extent that the Secretary of State considers that consultation would be contrary to the interests of national security.</p></content></subsection></section><section eId="d25e3529"><num>105Z4</num><heading>Notice of designated vendor directions</heading><subsection eId="d25e3533"><num>(1)</num><content><p>Where a designated vendor direction is given to a public communications provider, the Secretary of State must send a copy of the direction to the designated vendor or vendors specified in the direction, if or to the extent that it is reasonably practicable to do so.</p></content></subsection><subsection><num>(2)</num><content><p>The requirement in subsection <ref href="#d25e3533">(1)</ref> does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the direction to that designated vendor would be contrary to the interests of national security.</p></content></subsection><subsection><num>(3)</num><intro><p>The Secretary of State may exclude from the copy of the direction anything the disclosure of which the Secretary of State considers—</p></intro><level class="para1"><num>(a)</num><content><p>would, or would be likely to, prejudice to an unreasonable degree the commercial interests of any person; or</p></content></level><level class="para1"><num>(b)</num><content><p>would be contrary to the interests of national security.</p></content></level></subsection></section><section eId="d25e3569"><num>105Z5</num><heading>Variation and revocation of designated vendor directions</heading><subsection><num>(1)</num><content><p>The Secretary of State must review a designated vendor direction from time to time.</p></content></subsection><subsection><num>(2)</num><intro><p>The Secretary of State may—</p></intro><level class="para1"><num>(a)</num><content><p>vary a designated vendor direction;</p></content></level><level class="para1"><num>(b)</num><content><p>revoke a designated vendor direction (whether wholly or in part).</p></content></level></subsection><subsection><num>(3)</num><intro><p>The Secretary of State may vary a designated vendor direction only if—</p></intro><level class="para1"><num>(a)</num><content><p>the Secretary of State considers that the direction as varied is necessary in the interests of national security; and</p></content></level><level class="para1"><num>(b)</num><content><p>the Secretary of State considers that the requirements imposed by the direction as varied are proportionate to what is sought to be achieved by the direction.</p></content></level></subsection><subsection eId="d25e3615"><num>(4)</num><intro><p>Before varying a designated vendor direction, the Secretary of State must consult—</p></intro><level class="para1"><num>(a)</num><content><p>the public communications provider or providers which would be subject to the direction as proposed to be varied, and</p></content></level><level class="para1"><num>(b)</num><content><p>the person or persons who would be affected as a designated vendor or vendors by the direction as proposed to be varied,</p></content></level><wrapUp><p>so far as it is reasonably practicable to do so.</p></wrapUp></subsection><subsection><num>(5)</num><content><p>The requirement in subsection <ref href="#d25e3615">(4)</ref> does not apply if or to extent that the Secretary of State considers that consultation would be contrary to the interests of national security.</p></content></subsection></section><section><num>105Z6</num><heading>Notice of variation and revocation of designated vendor directions</heading><subsection><num>(1)</num><content><p>The Secretary of State must give notice of a variation of a designated vendor direction under section <ref href="#d25e3569">105Z5</ref> to the public communications provider or providers subject to the direction as varied.</p></content></subsection><subsection eId="d25e3660"><num>(2)</num><intro><p>The notice of variation must specify—</p></intro><level class="para1"><num>(a)</num><content><p>how the direction is varied;</p></content></level><level class="para1" eId="d25e3672"><num>(b)</num><content><p>the reasons for the variation;</p></content></level><level class="para1"><num>(c)</num><content><p>the time at which the variation, or each of them, comes into force.</p></content></level></subsection><subsection eId="d25e3684"><num>(3)</num><content><p>The requirement in subsection <ref href="#d25e3660">(2)</ref><ref href="#d25e3672">(b)</ref> does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.</p></content></subsection><subsection eId="d25e3695"><num>(4)</num><content><p>The Secretary of State must send a copy of the notice of variation to the designated vendor or vendors specified in the direction as varied, if or to the extent that it is reasonably practicable to do so.</p></content></subsection><subsection eId="d25e3701"><num>(5)</num><content><p>The requirement in subsection <ref href="#d25e3695">(4)</ref> does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the notice of variation to that designated vendor would be contrary to the interests of national security.</p></content></subsection><subsection><num>(6)</num><intro><p>The Secretary of State may exclude from the copy of the notice of variation anything the disclosure of which the Secretary of State considers—</p></intro><level class="para1"><num>(a)</num><content><p>would, or would be likely to, prejudice to an unreasonable degree the commercial interests of the public communications provider or providers subject to the direction as varied; or</p></content></level><level class="para1"><num>(b)</num><content><p>would be contrary to the interests of national security.</p></content></level></subsection><subsection><num>(7)</num><content><p>The Secretary of State must give notice of a revocation of a designated vendor direction under section <ref href="#d25e3569">105Z5</ref> to the public communications provider or providers subject to the direction as it had effect before the revocation.</p></content></subsection><subsection><num>(8)</num><intro><p>The notice of revocation must specify—</p></intro><level class="para1"><num>(a)</num><content><p>the time at which the revocation comes into force;</p></content></level><level class="para1"><num>(b)</num><content><p>if the direction is partly revoked, what part of the direction is revoked.</p></content></level></subsection><subsection eId="d25e3755"><num>(9)</num><content><p>The Secretary of State must send a copy of the notice of revocation to the designated vendor or vendors specified in the direction as it had effect before the revocation, if or to the extent that it is reasonably practicable to do so.</p></content></subsection><subsection><num>(10)</num><content><p>The requirement in subsection <ref href="#d25e3755">(9)</ref> does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the notice of revocation to that designated vendor would be contrary to the interests of national security.</p></content></subsection><subsection><num>(11)</num><intro><p>Where the direction is partly revoked, the Secretary of State may exclude from the copy of the notice of revocation anything the disclosure of which the Secretary of State considers—</p></intro><level class="para1"><num>(a)</num><content><p>would, or would be likely to, prejudice to an unreasonable degree the commercial interests of any person; or</p></content></level><level class="para1"><num>(b)</num><content><p>would be contrary to the interests of national security.</p></content></level></subsection></section><section eId="d25e3791"><num>105Z7</num><heading>Designated vendor directions: plans for compliance</heading><subsection><num>(1)</num><content><p>This section applies where a designated vendor direction has been given to a public communications provider (and has not been revoked).</p></content></subsection><subsection eId="d25e3801"><num>(2)</num><intro><p>The Secretary of State may from time to time require the public communications provider—</p></intro><level class="para1"><num>(a)</num><intro><p>to prepare a plan setting out—</p></intro><level class="para2"><num>(i)</num><content><p>the steps that the provider intends to take in order to comply with such requirements imposed by the direction as the Secretary of State may specify; and</p></content></level><level class="para2"><num>(ii)</num><content><p>the timing of those steps; and</p></content></level></level><level class="para1" eId="d25e3825"><num>(b)</num><content><p>to provide the plan to the Secretary of State.</p></content></level></subsection><subsection><num>(3)</num><content><p>The Secretary of State may also require that the plan be provided to OFCOM.</p></content></subsection><subsection eId="d25e3837"><num>(4)</num><content><p>The Secretary of State may specify the period within which a plan required under this section is to be provided to the Secretary of State or OFCOM.</p></content></subsection><subsection><num>(5)</num><content><p>A period specified under subsection <ref href="#d25e3837">(4)</ref> must be such period as appears to the Secretary of State to be reasonable.</p></content></subsection></section></hcontainer></quotedStructure></mod></p></content></subsection><subsection eId="section-15-3"><num>(3)</num><content><p><mod>In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="definition"><content><p>“<term refersTo="#term-designated-vendor">designated vendor</term>” means a person designated by a designation notice;</p></content></hcontainer></quotedStructure><inline name="appendText">;</inline></mod></p><p><mod><quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="definition"><content><p>“<term refersTo="#term-designated-vendor-direction">designated vendor direction</term>” has the meaning given by section <ref href="#d25e3193">105Z1</ref><ref href="#d25e3197">(1)</ref>;</p></content></hcontainer></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection></section><section eId="section-16"><num>16</num><heading>Designation notices</heading><subsection eId="section-16-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-16-2"><num>(2)</num><content><p><mod>After section <ref href="#d25e3791">105Z7</ref> insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e3912"><num>105Z8</num><heading>Designation notices</heading><subsection eId="d25e3916"><num>(1)</num><content><p>The Secretary of State may issue a notice (“a designation notice”) designating a person for the purposes of a designated vendor direction.</p></content></subsection><subsection><num>(2)</num><content><p>A designation notice may designate more than one person.</p></content></subsection><subsection eId="d25e3928"><num>(3)</num><content><p>The Secretary of State may issue a designation notice only if the Secretary of State considers that the notice is necessary in the interests of national security.</p></content></subsection><subsection eId="d25e3934"><num>(4)</num><intro><p>In considering whether to designate a person, the matters to which the Secretary of State may have regard include—</p></intro><level class="para1"><num>(a)</num><content><p>the nature of the goods, services or facilities that are or might be supplied, provided or made available by the person;</p></content></level><level class="para1"><num>(b)</num><content><p>the quality, reliability and security of those goods, services or facilities or any component of them (including the quality, reliability and security of their development or production or of the manner in which they are supplied, provided or made available);</p></content></level><level class="para1"><num>(c)</num><content><p>the reliability of the supply of those goods, services or facilities;</p></content></level><level class="para1"><num>(d)</num><content><p>the quality and reliability of the provision of maintenance or support for those goods, services or facilities;</p></content></level><level class="para1"><num>(e)</num><content><p>the extent to which and the manner in which goods, services or facilities supplied, provided or made available by the person are or might be used in the United Kingdom;</p></content></level><level class="para1"><num>(f)</num><content><p>the extent to which and the manner in which goods, services or facilities supplied, provided or made available by the person are or might be used in other countries or territories;</p></content></level><level class="para1" eId="d25e3976"><num>(g)</num><intro><p>the identity of the persons concerned in—</p></intro><level class="para2"><num>(i)</num><content><p>the development or production of goods, services or facilities supplied, provided or made available by the person or any component of them;</p></content></level><level class="para2"><num>(ii)</num><content><p>supplying or providing such goods or services or making such facilities available; or</p></content></level><level class="para2"><num>(iii)</num><content><p>providing maintenance or support for such goods, services or facilities;</p></content></level></level><level class="para1" eId="d25e4000"><num>(h)</num><intro><p>the identity of the persons who own or control, or are associated with—</p></intro><level class="para2" eId="d25e4006"><num>(i)</num><content><p>the person being considered for designation; or</p></content></level><level class="para2" eId="d25e4012"><num>(ii)</num><content><p>any person described in paragraph <ref href="#d25e3976">(g)</ref>;</p></content></level></level><level class="para1" eId="d25e4021"><num>(i)</num><intro><p>the country or territory in which the registered office or anything similar, or any place of business, of—</p></intro><level class="para2"><num>(i)</num><content><p>the person being considered for designation, or</p></content></level><level class="para2"><num>(ii)</num><content><p>any of the persons described in paragraph <ref href="#d25e3976">(g)</ref> or <ref href="#d25e4000">(h)</ref>,</p></content></level><wrapUp><p>is situated;</p></wrapUp></level><level class="para1"><num>(j)</num><content><p>the conduct of any of the persons described in paragraph <ref href="#d25e4021">(i)</ref> as it affects or might affect the national security of any country or territory;</p></content></level><level class="para1"><num>(k)</num><content><p>any other connection between a country or territory and any of those persons;</p></content></level><level class="para1"><num>(l)</num><content><p>the degree to which any of those persons might be susceptible to being influenced or required to act contrary to the interests of national security.</p></content></level></subsection><subsection eId="d25e4069"><num>(5)</num><content><p>A designation notice must specify the reasons for the designation.</p></content></subsection><subsection><num>(6)</num><content><p>The requirement in subsection <ref href="#d25e4069">(5)</ref> does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.</p></content></subsection><subsection><num>(7)</num><content><p>A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility.</p></content></subsection></section><section eId="d25e4093"><num>105Z9</num><heading>Further provision about designation notices</heading><subsection eId="d25e4097"><num>(1)</num><content><p>Before issuing a designation notice, the Secretary of State must consult the person or persons proposed to be designated in the notice, so far as it is reasonably practicable to do so.</p></content></subsection><subsection><num>(2)</num><content><p>The requirement in subsection <ref href="#d25e4097">(1)</ref> does not apply if or to the extent that the Secretary of State considers that consultation would be contrary to the interests of national security.</p></content></subsection><subsection><num>(3)</num><content><p>Where a designation notice is issued, the Secretary of State must send a copy to the person or persons designated in the notice, if or to the extent that it is reasonably practicable to do so.</p></content></subsection></section><section eId="d25e4121"><num>105Z10</num><heading>Variation and revocation of designation notices</heading><subsection><num>(1)</num><content><p>The Secretary of State must review a designation notice from time to time.</p></content></subsection><subsection><num>(2)</num><intro><p>The Secretary of State may—</p></intro><level class="para1"><num>(a)</num><content><p>vary a designation notice;</p></content></level><level class="para1"><num>(b)</num><content><p>revoke a designation notice (whether wholly or in part).</p></content></level></subsection><subsection><num>(3)</num><content><p>The Secretary of State may vary a designation notice only if the Secretary of State considers that the designation notice as varied is necessary in the interests of national security.</p></content></subsection><subsection eId="d25e4155"><num>(4)</num><content><p>Before varying a designation notice, the Secretary of State must consult the person, or each of the persons, proposed to be designated in the notice as varied, so far as it is reasonably practicable to do so.</p></content></subsection><subsection><num>(5)</num><content><p>The requirement in subsection <ref href="#d25e4155">(4)</ref> does not apply if or to the extent that the Secretary of State considers that consultation would be contrary to the interests of national security.</p></content></subsection><subsection><num>(6)</num><intro><p>The Secretary of State must give notice of a variation to—</p></intro><level class="para1"><num>(a)</num><content><p>any person designated by the designation notice as it had effect before the variation, and</p></content></level><level class="para1"><num>(b)</num><content><p>any person designated by the designation notice as varied,</p></content></level><wrapUp><p>if or to the extent that it is reasonably practicable to do so.</p></wrapUp></subsection><subsection eId="d25e4190"><num>(7)</num><intro><p>The notice of variation must specify—</p></intro><level class="para1"><num>(a)</num><content><p>how the designation notice is varied;</p></content></level><level class="para1" eId="d25e4202"><num>(b)</num><content><p>the reasons for the variation;</p></content></level><level class="para1"><num>(c)</num><content><p>the time at which the variation, or each of them, comes into force.</p></content></level></subsection><subsection><num>(8)</num><content><p>The requirement in subsection <ref href="#d25e4190">(7)</ref><ref href="#d25e4202">(b)</ref> does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.</p></content></subsection><subsection><num>(9)</num><content><p>The Secretary of State must give notice of a revocation to any person designated by the designation notice as it had effect before the revocation, if or to the extent that it is reasonably practicable to do so.</p></content></subsection><subsection><num>(10)</num><intro><p>The notice of revocation must specify—</p></intro><level class="para1"><num>(a)</num><content><p>the time at which the revocation comes into force;</p></content></level><level class="para1"><num>(b)</num><content><p>if the designation notice is partly revoked, what part of the notice is revoked.</p></content></level></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-16-3"><num>(3)</num><content><p><mod>In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="definition"><content><p>“<term refersTo="#term-designation-notice">designation notice</term>” has the meaning given by section <ref href="#d25e3912">105Z8</ref><ref href="#d25e3916">(1)</ref>;</p></content></hcontainer></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection></section><section eId="section-17"><num>17</num><heading>Laying before Parliament</heading><content><p><mod>After section <ref href="#d25e4121">105Z10</ref> of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e4288"><num>105Z11</num><heading>Laying before Parliament</heading><subsection eId="d25e4292"><num>(1)</num><intro><p>The Secretary of State must lay before Parliament a copy of—</p></intro><level class="para1"><num>(a)</num><content><p>a designated vendor direction;</p></content></level><level class="para1"><num>(b)</num><content><p>a designation notice;</p></content></level><level class="para1"><num>(c)</num><content><p>a notice of a variation or revocation of a designated vendor direction; and</p></content></level><level class="para1"><num>(d)</num><content><p>a notice of a variation or revocation of a designation notice.</p></content></level></subsection><subsection><num>(2)</num><content><p>The requirement in subsection <ref href="#d25e4292">(1)</ref> does not apply if the Secretary of State considers that laying a copy of the direction or notice (as the case may be) before Parliament would be contrary to the interests of national security.</p></content></subsection><subsection><num>(3)</num><intro><p>The Secretary of State may exclude from what is laid before Parliament anything the publication of which the Secretary of State considers—</p></intro><level class="para1"><num>(a)</num><content><p>would, or would be likely to, prejudice to an unreasonable degree the commercial interests of any person; or</p></content></level><level class="para1"><num>(b)</num><content><p>would be contrary to the interests of national security.</p></content></level></subsection></section></quotedStructure></mod></p></content></section></hcontainer>
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:uk="https://www.legislation.gov.uk/namespaces/UK-AKN" name="crossheading" ukl:Name="Pblock" eId="crossheading-monitoring-and-enforcement"><heading>Monitoring and enforcement</heading><section eId="section-18"><num>18</num><heading>Monitoring of designated vendor directions</heading><subsection eId="section-18-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-18-2"><num>(2)</num><content><p><mod>After section <ref href="#d25e4288">105Z11</ref> insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e4379"><num>105Z12</num><heading>Monitoring of designated vendor directions</heading><subsection eId="d25e4383"><num>(1)</num><intro><p>The Secretary of State may give OFCOM a direction (“a monitoring direction”) requiring them—</p></intro><level class="para1" eId="d25e4389"><num>(a)</num><content><p>to obtain information relating to a specified public communications provider’s compliance with a designated vendor direction;</p></content></level><level class="para1" eId="d25e4395"><num>(b)</num><content><p>to prepare and send a report to the Secretary of State based on that information; and</p></content></level><level class="para1"><num>(c)</num><content><p>to provide to the Secretary of State on request the information on which a report falling within paragraph <ref href="#d25e4395">(b)</ref> is based.</p></content></level></subsection><subsection eId="d25e4410"><num>(2)</num><intro><p>The information that OFCOM may be required to obtain under subsection <ref href="#d25e4383">(1)</ref><ref href="#d25e4389">(a)</ref> is—</p></intro><level class="para1"><num>(a)</num><intro><p>information that would assist the Secretary of State in determining whether the provider has complied, is complying or is preparing to comply with—</p></intro><level class="para2"><num>(i)</num><content><p>the designated vendor direction; or</p></content></level><level class="para2"><num>(ii)</num><content><p>a specified requirement imposed by the designated vendor direction;</p></content></level></level><level class="para1"><num>(b)</num><content><p>information about a specified matter which is relevant to compliance with a requirement imposed by the designated vendor direction;</p></content></level><level class="para1"><num>(c)</num><content><p>if the provider has been required to provide a plan under section <ref href="#d25e3791">105Z7</ref>, information about whether the provider is acting in accordance with the plan.</p></content></level></subsection><subsection><num>(3)</num><intro><p>A monitoring direction may make provision about—</p></intro><level class="para1"><num>(a)</num><content><p>the form of a report;</p></content></level><level class="para1"><num>(b)</num><content><p>the content of a report.</p></content></level></subsection><subsection><num>(4)</num><intro><p>A monitoring direction may, in particular, require a report to include—</p></intro><level class="para1"><num>(a)</num><content><p>OFCOM’s analysis of information gathered by them;</p></content></level><level class="para1"><num>(b)</num><content><p>an explanation of their analysis.</p></content></level></subsection><subsection><num>(5)</num><content><p>A monitoring direction may require OFCOM to give the Secretary of State separate reports on different matters.</p></content></subsection><subsection><num>(6)</num><content><p>A monitoring direction may make provision about the time or times at which OFCOM must report to the Secretary of State, including provision requiring OFCOM to give reports at specified intervals.</p></content></subsection><subsection><num>(7)</num><content><p>OFCOM must exercise their powers to obtain information in such manner as they consider appropriate for the purposes of preparing a report required by a monitoring direction.</p></content></subsection><subsection><num>(8)</num><content><p>The Secretary of State may give OFCOM more than one monitoring direction in relation to a designated vendor direction.</p></content></subsection><subsection><num>(9)</num><content><p>The Secretary of State may vary or revoke a monitoring direction.</p></content></subsection><subsection><num>(10)</num><content><p>The Secretary of State must consult OFCOM before giving or varying a monitoring direction.</p></content></subsection><subsection><num>(11)</num><content><p>In this section “<term refersTo="#term-specified">specified</term>” means specified in a monitoring direction.</p></content></subsection></section><section eId="d25e4538"><num>105Z13</num><heading>Reports made under monitoring directions</heading><subsection eId="d25e4542"><num>(1)</num><intro><p>The Secretary of State may—</p></intro><level class="para1"><num>(a)</num><content><p>publish a report made by OFCOM in accordance with a monitoring direction or part of it; or</p></content></level><level class="para1"><num>(b)</num><content><p>disclose such a report or part of it.</p></content></level></subsection><subsection><num>(2)</num><content><p>In publishing or disclosing a report made by OFCOM in accordance with a monitoring direction, the Secretary of State must have regard to the need to exclude from publication or disclosure, so far as is practicable, the matters which are confidential in accordance with subsections <ref href="#d25e4572">(3)</ref> and <ref href="#d25e4590">(4)</ref>.</p></content></subsection><subsection eId="d25e4572"><num>(3)</num><intro><p>A matter is confidential under this subsection if—</p></intro><level class="para1"><num>(a)</num><content><p>it relates to the affairs of a particular body; and</p></content></level><level class="para1"><num>(b)</num><content><p>publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that body.</p></content></level></subsection><subsection eId="d25e4590"><num>(4)</num><intro><p>A matter is confidential under this subsection if—</p></intro><level class="para1"><num>(a)</num><content><p>it relates to the private affairs of an individual; and</p></content></level><level class="para1"><num>(b)</num><content><p>publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that individual.</p></content></level></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-18-3"><num>(3)</num><content><p><mod>In section 135 (information required for purposes of certain OFCOM functions) in subsection (3) (particular purposes for which information may be required) before paragraph (ia) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para2" eId="d25e4615"><num>(izd)</num><content><p>preparing a report under section <ref href="#d25e4379">105Z12</ref>;</p></content></level></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection><subsection eId="section-18-4"><num>(4)</num><content><p><mod>In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="definition"><content><p>“<term refersTo="#term-monitoring-direction">monitoring direction</term>” has the meaning given by section <ref href="#d25e4379">105Z12</ref>;</p></content></hcontainer></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection><subsection eId="section-18-5"><num>(5)</num><content><p><mod>In section 393 (general restrictions on disclosure of information) in subsection (6) (exceptions) before paragraph (ba) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para1"><num>(bzb)</num><content><p>prevents the publication or disclosure of a report or part of a report under section <ref href="#d25e4538">105Z13</ref><ref href="#d25e4542">(1)</ref>;</p></content></level></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection><subsection eId="section-18-6"><num>(6)</num><content><p><mod>In Schedule 8 (decisions not subject to appeal) after paragraph 11 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="schedule" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="schedule" ukl:Format="double"><paragraph class="schProv1"><num>11A</num><content><p>A decision to require information under section 135, so far as the information is required for the purpose of preparing a report under section <ref href="#d25e4379">105Z12</ref>.</p></content></paragraph></quotedStructure></mod></p></content></subsection></section><section eId="section-19"><num>19</num><heading>Monitoring directions: inspection notices</heading><subsection eId="section-19-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-19-2"><num>(2)</num><content><p><mod>After section <ref href="#d25e4538">105Z13</ref> insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e4709"><num>105Z14</num><heading>Power of OFCOM to give inspection notices</heading><subsection><num>(1)</num><content><p>This section applies where the Secretary of State has given OFCOM a monitoring direction relating to a public communications provider (and the monitoring direction has not been revoked).</p></content></subsection><subsection eId="d25e4719"><num>(2)</num><content><p>OFCOM may by notice (“an inspection notice”) given to the provider impose on the provider a duty to take any of the actions mentioned in subsection <ref href="#d25e4761">(4)</ref>.</p></content></subsection><subsection><num>(3)</num><intro><p>OFCOM may exercise the power in subsection <ref href="#d25e4719">(2)</ref> for the purpose of obtaining—</p></intro><level class="para1"><num>(a)</num><intro><p>information (in any form) that would assist the Secretary of State in determining whether the provider has complied or is complying with—</p></intro><level class="para2"><num>(i)</num><content><p>the designated vendor direction; or</p></content></level><level class="para2"><num>(ii)</num><content><p>a specified requirement imposed by the designated vendor direction;</p></content></level></level><level class="para1"><num>(b)</num><content><p>information (in any form) about a specified matter which is relevant to whether the provider has complied or is complying with a requirement imposed by the designated vendor direction.</p></content></level></subsection><subsection eId="d25e4761"><num>(4)</num><intro><p>The actions are—</p></intro><level class="para1"><num>(a)</num><intro><p>to carry out surveys of a specified description of—</p></intro><level class="para2"><num>(i)</num><content><p>the public electronic communications network provided by the provider;</p></content></level><level class="para2"><num>(ii)</num><content><p>the public electronic communications service provided by the provider; or</p></content></level><level class="para2"><num>(iii)</num><content><p>the associated facilities made available by the provider that are associated facilities by reference to such a network or service (as the case may be);</p></content></level></level><level class="para1"><num>(b)</num><content><p>to make arrangements of a specified description for another person to carry out surveys of a specified description of the network, service or associated facilities;</p></content></level><level class="para1"><num>(c)</num><content><p>to make available for interview a specified number of persons of a specified description who are involved in the provision of the network or service or the making available of the associated facilities (not exceeding the number who are willing to be interviewed);</p></content></level><level class="para1" eId="d25e4803"><num>(d)</num><content><p>to permit an authorised person to enter specified premises;</p></content></level><level class="para1"><num>(e)</num><content><p>to permit an authorised person to observe any operation taking place on the premises that relates to the network, service or associated facilities;</p></content></level><level class="para1"><num>(f)</num><content><p>to direct an authorised person to equipment or other material on the premises that is of a specified description;</p></content></level><level class="para1"><num>(g)</num><content><p>to direct an authorised person to documents on the premises that are of a specified description;</p></content></level><level class="para1"><num>(h)</num><content><p>to assist an authorised person to view information of a specified description that is capable of being viewed using equipment on the premises;</p></content></level><level class="para1"><num>(i)</num><content><p>to comply with a request from an authorised person for a copy of the documents to which the person is directed and the information the person is assisted to view;</p></content></level><level class="para1"><num>(j)</num><content><p>to permit an authorised person to inspect or examine the documents, information, equipment or material to which the person is directed or which the person is assisted to view;</p></content></level><level class="para1" eId="d25e4846"><num>(k)</num><content><p>to provide an authorised person with an explanation of such documents, information, equipment or material.</p></content></level></subsection><subsection><num>(5)</num><content><p>An inspection notice may not impose on the provider a duty to permit an authorised person to enter domestic premises.</p></content></subsection><subsection><num>(6)</num><intro><p>An inspection notice may not impose on the provider a duty to do anything that would result in—</p></intro><level class="para1"><num>(a)</num><content><p>the disclosure of documents or information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings; or</p></content></level><level class="para1"><num>(b)</num><content><p>a disclosure of documents or information that is prohibited by or under an enactment mentioned in section 105A(4).</p></content></level></subsection><subsection eId="d25e4876"><num>(7)</num><content><p>An inspection notice must, in relation to each duty imposed by the notice, specify the time or times at which, or period or periods within which, the duty must be complied with.</p></content></subsection><subsection eId="d25e4882"><num>(8)</num><content><p>A time or period specified under subsection <ref href="#d25e4876">(7)</ref> must not be a time that falls or a period that begins before the end of the period of 28 days beginning with the day on which the inspection notice is given.</p></content></subsection><subsection><num>(9)</num><intro><p>In this section—</p></intro><hcontainer name="definition"><content><p>“<term refersTo="#term-authorised-person">authorised person</term>” means an employee of, or person authorised by, OFCOM;</p></content></hcontainer><hcontainer name="definition"><content><p>“<term refersTo="#term-domestic-premises">domestic premises</term>” means premises, or a part of premises, used as a dwelling;</p></content></hcontainer><hcontainer name="definition"><content><p>“<term refersTo="#term-specified">specified</term>” means specified in an inspection notice.</p></content></hcontainer></subsection></section><section eId="d25e4922"><num>105Z15</num><heading>Inspection notices: further provision</heading><subsection><num>(1)</num><content><p>An inspection notice must provide information about the consequences of failing to comply with a duty imposed by the notice.</p></content></subsection><subsection><num>(2)</num><intro><p>An inspection notice may by further notice—</p></intro><level class="para1"><num>(a)</num><content><p>be revoked by OFCOM;</p></content></level><level class="para1"><num>(b)</num><content><p>be varied by OFCOM so as to make it less onerous.</p></content></level></subsection><subsection eId="d25e4950"><num>(3)</num><content><p>Where an inspection notice is given to a public communications provider, the provider may not act in such a way as to defeat the purpose of the inspection notice.</p></content></subsection><subsection><num>(4)</num><content><p>Where an inspection notice is given to a public communications provider, the provider must pay the costs reasonably incurred by OFCOM in connection with obtaining information by means of the inspection notice.</p></content></subsection></section><section><num>105Z16</num><heading>Inspection notices: information about entering premises</heading><content><p>Every report under paragraph 12 of the Schedule to the Office of Communications Act 2002 (OFCOM’s annual report) must include a statement of the number of occasions during the financial year to which the report relates on which premises have been entered in pursuance of a duty imposed under section <ref href="#d25e4709">105Z14</ref><ref href="#d25e4761">(4)</ref><ref href="#d25e4803">(d)</ref>.</p></content></section><section eId="d25e4981"><num>105Z17</num><heading>Inspection notices: enforcement of compliance</heading><subsection eId="d25e4985"><num>(1)</num><intro><p>Sections 96A to 100, 102 and 103 apply in relation to—</p></intro><level class="para1"><num>(a)</num><content><p>a contravention of a duty imposed by an inspection notice, or</p></content></level><level class="para1"><num>(b)</num><content><p>a contravention of the duty imposed by section <ref href="#d25e4922">105Z15</ref><ref href="#d25e4950">(3)</ref>,</p></content></level><wrapUp><p>as they apply in relation to a contravention of a condition set under section 45, other than an SMP apparatus condition.</p></wrapUp></subsection><subsection><num>(2)</num><content><p>Subsection <ref href="#d25e4985">(1)</ref> is subject to subsections <ref href="#d25e5025">(3)</ref> and <ref href="#d25e5034">(4)</ref>.</p></content></subsection><subsection eId="d25e5025"><num>(3)</num><content><p>In its application in relation to a contravention referred to in subsection <ref href="#d25e4985">(1)</ref>, section 96B(5) has effect as if the maximum penalty specified were £50,000 per day.</p></content></subsection><subsection eId="d25e5034"><num>(4)</num><content><p>In its application in relation to a contravention referred to in subsection <ref href="#d25e4985">(1)</ref>, section 97(1) has effect as if the maximum penalty specified were £10 million.</p></content></subsection><subsection eId="d25e5043"><num>(5)</num><content><p>The Secretary of State may by regulations amend this section so as to substitute a different amount for the amount for the time being specified in subsection <ref href="#d25e5025">(3)</ref> or <ref href="#d25e5034">(4)</ref>.</p></content></subsection><subsection><num>(6)</num><content><p>No regulations are to be made containing provision authorised by subsection <ref href="#d25e5043">(5)</ref> unless a draft of the instrument has been laid before Parliament and approved by a resolution of each House.</p></content></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-19-3"><num>(3)</num><content><p><mod>In section 113 (suspension of application of the electronic communications code) in subsection (2)(b) (a condition for suspension) at the end of the words in parentheses insert <quotedText>“or <ref href="#d25e4981">105Z17</ref>”</quotedText>.</mod></p></content></subsection><subsection eId="section-19-4"><num>(4)</num><content><p><mod>In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="definition"><content><p>“<term refersTo="#term-inspection-notice">inspection notice</term>” has the meaning given by section <ref href="#d25e4709">105Z14</ref>;</p></content></hcontainer></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection><subsection eId="section-19-5"><num>(5)</num><content><p><mod>In Schedule 8 (decisions not subject to appeal) before paragraph 8 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="schedule" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="schedule" ukl:Format="double"><paragraph class="schProv1"><num>7D</num><content><p>A decision to impose a duty under section <ref href="#d25e4709">105Z14</ref>.</p></content></paragraph></quotedStructure></mod></p></content></subsection></section><section eId="section-20"><num>20</num><heading>Power of Secretary of State to enforce compliance with designated vendor directions etc</heading><content><p><mod>After section <ref href="#d25e4981">105Z17</ref> of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e5129"><num>105Z18</num><heading>Notification of contravention</heading><subsection><num>(1)</num><intro><p>Where the Secretary of State determines that there are reasonable grounds for believing that a public communications provider is contravening, or has contravened—</p></intro><level class="para1"><num>(a)</num><content><p>a requirement imposed by a designated vendor direction, or</p></content></level><level class="para1"><num>(b)</num><content><p>a requirement under section <ref href="#d25e3791">105Z7</ref>,</p></content></level><wrapUp><p>the Secretary of State may give the provider a notification under this section.</p></wrapUp></subsection><subsection eId="d25e5156"><num>(2)</num><intro><p>A notification under this section is one which—</p></intro><level class="para1"><num>(a)</num><content><p>sets out the Secretary of State’s determination;</p></content></level><level class="para1"><num>(b)</num><content><p>specifies the requirement and contravention in respect of which the determination is made;</p></content></level><level class="para1"><num>(c)</num><content><p>specifies the period during which the provider has an opportunity to make representations;</p></content></level><level class="para1" eId="d25e5180"><num>(d)</num><intro><p>specifies the steps that the Secretary of State thinks should be taken by the provider in order to—</p></intro><level class="para2" eId="d25e5186"><num>(i)</num><content><p>comply with the requirement;</p></content></level><level class="para2" eId="d25e5192"><num>(ii)</num><content><p>remedy the consequences of the contravention;</p></content></level></level><level class="para1" eId="d25e5198"><num>(e)</num><content><p>specifies the penalty which the Secretary of State is minded to impose.</p></content></level></subsection><subsection><num>(3)</num><content><p>A notification under this section may be given in respect of more than one contravention.</p></content></subsection><subsection><num>(4)</num><content><p>If a notification under this section relates to more than one contravention, a separate penalty may be specified under subsection <ref href="#d25e5156">(2)</ref><ref href="#d25e5198">(e)</ref> in respect of each contravention.</p></content></subsection><subsection><num>(5)</num><content><p>If a notification under this section is given in respect of a continuing contravention, it may be given in respect of any period during which the contravention has continued.</p></content></subsection><subsection eId="d25e5227"><num>(6)</num><content><p>If a notification under this section relates to a continuing contravention, no more than one penalty may be specified under subsection <ref href="#d25e5156">(2)</ref><ref href="#d25e5198">(e)</ref> in respect of the period of contravention specified in the notification.</p></content></subsection><subsection eId="d25e5238"><num>(7)</num><intro><p>Notwithstanding subsection <ref href="#d25e5227">(6)</ref>, in relation to a continuing contravention, a penalty may be specified in respect of each day on which the contravention continues after—</p></intro><level class="para1"><num>(a)</num><content><p>the giving of a confirmation decision under section <ref href="#d25e5471">105Z20</ref> which requires immediate action in respect of that contravention (see section <ref href="#d25e5471">105Z20</ref><ref href="#d25e5564">(6)</ref><ref href="#d25e5570">(a)</ref>); or</p></content></level><level class="para1"><num>(b)</num><content><p>the expiry of any period specified in the confirmation decision for complying with the requirement being contravened.</p></content></level></subsection><subsection><num>(8)</num><intro><p>Where a notification under this section has been given to a public communications provider in respect of a contravention of a requirement, the Secretary of State may give a further notification in respect of the same contravention of that requirement if, and only if—</p></intro><level class="para1"><num>(a)</num><content><p>the contravention is one occurring after the time of the giving of the earlier notification;</p></content></level><level class="para1"><num>(b)</num><content><p>the contravention is a continuing contravention and the subsequent notification is in respect of so much of a period as falls after a period to which the earlier notification relates; or</p></content></level><level class="para1"><num>(c)</num><content><p>the earlier notification has been withdrawn without a penalty having been imposed in respect of the notified contravention.</p></content></level></subsection></section><section eId="d25e5296"><num>105Z19</num><heading>Amount of penalty</heading><subsection eId="d25e5300"><num>(1)</num><intro><p>The amount of a penalty that may be specified in a notification under section <ref href="#d25e5129">105Z18</ref> is such amount as the Secretary of State determines to be—</p></intro><level class="para1"><num>(a)</num><content><p>appropriate; and</p></content></level><level class="para1"><num>(b)</num><content><p>proportionate to the contravention in respect of which it is imposed.</p></content></level></subsection><subsection eId="d25e5321"><num>(2)</num><content><p>The amount may not exceed 10 per cent of the turnover of the public communications provider’s relevant business for the relevant period, subject to subsection <ref href="#d25e5330">(3)</ref>.</p></content></subsection><subsection eId="d25e5330"><num>(3)</num><content><p>In the case of a penalty specified under section <ref href="#d25e5129">105Z18</ref><ref href="#d25e5238">(7)</ref>, the amount may not exceed £100,000 per day.</p></content></subsection><subsection eId="d25e5341"><num>(4)</num><intro><p>Where the notification relates to a contravention of a requirement under section <ref href="#d25e3791">105Z7</ref>—</p></intro><level class="para1" eId="d25e5350"><num>(a)</num><content><p>subsection <ref href="#d25e5321">(2)</ref> has effect as if the maximum amount specified were £10 million; and</p></content></level><level class="para1" eId="d25e5359"><num>(b)</num><content><p>subsection <ref href="#d25e5330">(3)</ref> has effect as if the maximum amount specified were £50,000 per day.</p></content></level></subsection><subsection eId="d25e5368"><num>(5)</num><content><p>The Secretary of State may by regulations amend this section so as to substitute a different maximum penalty for the maximum penalty for the time being specified in subsection <ref href="#d25e5330">(3)</ref> or <ref href="#d25e5341">(4)</ref><ref href="#d25e5350">(a)</ref> or <ref href="#d25e5359">(b)</ref>.</p></content></subsection><subsection><num>(6)</num><content><p>No regulations are to be made containing provision authorised by subsection <ref href="#d25e5368">(5)</ref> unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.</p></content></subsection><subsection eId="d25e5394"><num>(7)</num><intro><p>For the purposes of this section—</p></intro><level class="para1" eId="d25e5400"><num>(a)</num><content><p>the turnover of a person’s relevant business for a period is to be calculated in accordance with such rules as may be set out in an order under section 97(3)(a); and</p></content></level><level class="para1"><num>(b)</num><content><p>what is to be treated as the network, service, facility or business by reference to which the calculation of that turnover falls to be made is to be determined in accordance with such provision as may be made by an order under section 97(3)(a).</p></content></level></subsection><subsection eId="d25e5412"><num>(8)</num><intro><p>In this section—</p></intro><hcontainer name="definition"><intro><p>“<term refersTo="#term-relevant-business">relevant business</term>”, in relation to a person, means (subject to the provisions of an order under section 97(3)(a)) so much of any business carried on by the person as consists in any one or more of the following—</p></intro><level class="para1"><num>(a)</num><content><p>the provision of a public electronic communications network;</p></content></level><level class="para1"><num>(b)</num><content><p>the provision of a public electronic communications service;</p></content></level><level class="para1"><num>(c)</num><content><p>the making available of facilities that are associated facilities by reference to such a network or service;</p></content></level></hcontainer><hcontainer name="definition"><intro><p>“<term refersTo="#term-relevant-period">relevant period</term>”, in relation to a contravention by a person of a requirement imposed by a designated vendor direction, means—</p></intro><level class="para1"><num>(a)</num><content><p>except in a case falling within paragraph <ref href="#d25e5461">(b)</ref> or <ref href="#d25e5465">(c)</ref>, the period of one year ending with the 31st March next before the time when notification of the contravention was given under section <ref href="#d25e5129">105Z18</ref>;</p></content></level><level class="para1"><num>(b)</num><content><p>in the case of a person who at that time has been carrying on that business for a period of less than a year, the period, ending with that time, during which the person has been carrying it on; and</p></content></level><level class="para1"><num>(c)</num><content><p>in the case of a person who at that time has ceased to carry on that business, the period of one year ending with the time when the person ceased to carry it on.</p></content></level></hcontainer></subsection></section><section eId="d25e5471"><num>105Z20</num><heading>Enforcement of notification</heading><subsection><num>(1)</num><intro><p>This section applies where—</p></intro><level class="para1"><num>(a)</num><content><p>a public communications provider has been given a notification under section <ref href="#d25e5129">105Z18</ref>;</p></content></level><level class="para1"><num>(b)</num><content><p>the Secretary of State has allowed the provider an opportunity to make representations about the matters notified; and</p></content></level><level class="para1"><num>(c)</num><content><p>the period allowed for the making of representations has expired.</p></content></level></subsection><subsection><num>(2)</num><intro><p>The Secretary of State may—</p></intro><level class="para1"><num>(a)</num><content><p>give the provider a decision (“a confirmation decision”) confirming the imposition of requirements on the provider in accordance with the notification under section <ref href="#d25e5129">105Z18</ref>; or</p></content></level><level class="para1"><num>(b)</num><content><p>inform the provider that no further action will be taken.</p></content></level></subsection><subsection><num>(3)</num><intro><p>The Secretary of State may not give the provider a confirmation decision unless, after considering any representations, the Secretary of State is satisfied that the provider has, in one or more of the ways specified in the notification under section <ref href="#d25e5129">105Z18</ref>, contravened—</p></intro><level class="para1"><num>(a)</num><content><p>a requirement imposed by a designated vendor direction, or</p></content></level><level class="para1"><num>(b)</num><content><p>a requirement imposed under section <ref href="#d25e3791">105Z7</ref>,</p></content></level><wrapUp><p>specified in the notification under section <ref href="#d25e5129">105Z18</ref>.</p></wrapUp></subsection><subsection><num>(4)</num><content><p>A confirmation decision must be given to the provider without delay.</p></content></subsection><subsection><num>(5)</num><content><p>A confirmation decision must include reasons for the decision.</p></content></subsection><subsection eId="d25e5564"><num>(6)</num><intro><p>A confirmation decision may—</p></intro><level class="para1" eId="d25e5570"><num>(a)</num><intro><p>require immediate action by the provider—</p></intro><level class="para2" eId="d25e5576"><num>(i)</num><content><p>to comply with the requirement specified in the notification under section <ref href="#d25e5129">105Z18</ref>, and</p></content></level><level class="para2" eId="d25e5585"><num>(ii)</num><content><p>to remedy the consequences of the contravention, or</p></content></level></level><level class="para1"><num>(b)</num><content><p>specify a period within which the provider must comply with that requirement and remedy those consequences,</p></content></level><wrapUp><p>and may specify the steps to be taken by the provider in order to comply with that requirement or remedy those consequences.</p></wrapUp></subsection><subsection eId="d25e5599"><num>(7)</num><intro><p>A confirmation decision may require the provider to pay—</p></intro><level class="para1"><num>(a)</num><content><p>the penalty specified in the notification under section <ref href="#d25e5129">105Z18</ref>, or</p></content></level><level class="para1" eId="d25e5614"><num>(b)</num><intro><p>such lesser penalty as the Secretary of State considers appropriate in the light of—</p></intro><level class="para2" eId="d25e5620"><num>(i)</num><content><p>any representations made by the provider, and</p></content></level><level class="para2" eId="d25e5626"><num>(ii)</num><content><p>any steps taken by the provider to comply with the requirement specified in the notification under section <ref href="#d25e5129">105Z18</ref> or to remedy the consequences of the contravention,</p></content></level></level><wrapUp><p>and may specify the period within which the penalty is to be paid.</p></wrapUp></subsection><subsection><num>(8)</num><content><p>It is the duty of the provider to comply with any requirement imposed by a confirmation decision.</p></content></subsection><subsection><num>(9)</num><intro><p>The Secretary of State may enforce the provider’s duty in civil proceedings—</p></intro><level class="para1"><num>(a)</num><content><p>for an injunction;</p></content></level><level class="para1"><num>(b)</num><content><p>for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or</p></content></level><level class="para1"><num>(c)</num><content><p>for any other appropriate remedy or relief.</p></content></level></subsection></section><section eId="d25e5670"><num>105Z21</num><heading>Enforcement of penalty</heading><subsection><num>(1)</num><content><p>This section applies where a sum is payable to the Secretary of State as a penalty under section <ref href="#d25e5471">105Z20</ref>.</p></content></subsection><subsection><num>(2)</num><content><p>In England and Wales, the penalty is recoverable as if it were payable under an order of the county court.</p></content></subsection><subsection><num>(3)</num><content><p>In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.</p></content></subsection><subsection><num>(4)</num><content><p>In Northern Ireland, the penalty is recoverable as if it were payable under an order of a county court in Northern Ireland.</p></content></subsection><subsection><num>(5)</num><intro><p>Where action is taken under this section for the recovery of a sum payable as a penalty under section <ref href="#d25e5471">105Z20</ref>, the penalty is—</p></intro><level class="para1"><num>(a)</num><content><p>in relation to England and Wales, to be treated for the purposes of section 98 of the Courts Act 2003 (register of judgments and orders etc) as if it were a judgment entered in the county court;</p></content></level><level class="para1"><num>(b)</num><content><p>in relation to Northern Ireland, to be treated for the purposes of Article 116 of the <ref eId="c00001" href="http://www.legislation.gov.uk/id/nisi/1981/226">Judgments Enforcement (Northern Ireland) Order 1981 (S.I. 1981/226 (N.I. 6))</ref> (register of judgments) as if it were a judgment in respect of which an application has been accepted under Article 22 or 23(1) of that Order.</p></content></level></subsection></section></quotedStructure></mod></p></content></section><section eId="section-21"><num>21</num><heading>Urgent enforcement directions</heading><subsection eId="section-21-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-21-2"><num>(2)</num><content><p><mod>After section <ref href="#d25e5670">105Z21</ref> insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e5752"><num>105Z22</num><heading>Urgent enforcement direction</heading><subsection><num>(1)</num><intro><p>The Secretary of State may give a direction under this section (“an urgent enforcement direction”) to a person if the Secretary of State determines that—</p></intro><level class="para1"><num>(a)</num><intro><p>there are reasonable grounds for believing that the person is contravening, or has contravened—</p></intro><level class="para2"><num>(i)</num><content><p>a requirement imposed by a designated vendor direction; or</p></content></level><level class="para2"><num>(ii)</num><content><p>a requirement not to disclose imposed under section <ref href="#d25e6115">105Z25</ref>;</p></content></level></level><level class="para1"><num>(b)</num><content><p>there are reasonable grounds for suspecting that the case is an urgent case; and</p></content></level><level class="para1"><num>(c)</num><content><p>the urgency of the case makes it appropriate for the Secretary of State to take action under this section.</p></content></level></subsection><subsection eId="d25e5795"><num>(2)</num><intro><p>A case is an urgent case for the purposes of this section if the contravention has resulted in, or creates an immediate risk of—</p></intro><level class="para1" eId="d25e5801"><num>(a)</num><content><p>a serious threat to national security; or</p></content></level><level class="para1" eId="d25e5807"><num>(b)</num><content><p>significant harm to the security of a public electronic communications network, a public electronic communications service or a facility that is an associated facility by reference to such a network or service.</p></content></level></subsection><subsection eId="d25e5813"><num>(3)</num><intro><p>An urgent enforcement direction must—</p></intro><level class="para1"><num>(a)</num><content><p>specify the requirement and contravention in respect of which it is given;</p></content></level><level class="para1"><num>(b)</num><content><p>require the person to take such steps falling within subsection <ref href="#d25e5846">(4)</ref> as are specified in the direction;</p></content></level><level class="para1"><num>(c)</num><content><p>specify a period within which those steps must be taken; and</p></content></level><level class="para1" eId="d25e5840"><num>(d)</num><content><p>specify the Secretary of State’s reasons for giving the direction.</p></content></level></subsection><subsection eId="d25e5846"><num>(4)</num><intro><p>The steps falling within this subsection are the steps that the Secretary of State has determined are appropriate—</p></intro><level class="para1"><num>(a)</num><content><p>for complying with the requirement; or</p></content></level><level class="para1"><num>(b)</num><content><p>for remedying the consequences of the contravention.</p></content></level></subsection><subsection><num>(5)</num><content><p>The requirement in subsection <ref href="#d25e5813">(3)</ref><ref href="#d25e5840">(d)</ref> does not apply if or to the extent that the Secretary of State considers that specifying reasons in the direction would be contrary to the interests of national security.</p></content></subsection></section><section eId="d25e5878"><num>105Z23</num><heading>Urgent enforcement direction: confirmation</heading><subsection><num>(1)</num><intro><p>As soon as reasonably practicable after giving an urgent enforcement direction, the Secretary of State must—</p></intro><level class="para1"><num>(a)</num><content><p>confirm the direction; or</p></content></level><level class="para1"><num>(b)</num><content><p>revoke the direction (see section <ref href="#d25e6043">105Z24</ref>).</p></content></level></subsection><subsection><num>(2)</num><content><p>The Secretary of State may confirm an urgent enforcement direction with or without modifications.</p></content></subsection><subsection><num>(3)</num><intro><p>The Secretary of State may confirm an urgent enforcement direction only if the Secretary of State has determined that—</p></intro><level class="para1"><num>(a)</num><intro><p>the person is contravening, or has contravened—</p></intro><level class="para2"><num>(i)</num><content><p>a requirement imposed by a designated vendor direction; or</p></content></level><level class="para2"><num>(ii)</num><content><p>a requirement not to disclose imposed under section <ref href="#d25e6115">105Z25</ref>;</p></content></level></level><level class="para1"><num>(b)</num><content><p>the contravention has resulted in, or creates an immediate risk of, a threat or harm described in section <ref href="#d25e5752">105Z22</ref><ref href="#d25e5795">(2)</ref><ref href="#d25e5801">(a)</ref> or <ref href="#d25e5807">(b)</ref>; and</p></content></level><level class="para1"><num>(c)</num><content><p>it is appropriate to confirm the urgent enforcement direction, with any modifications, to prevent, reduce or remove that threat or harm or immediate risk.</p></content></level></subsection><subsection eId="d25e5958"><num>(4)</num><intro><p>Before confirming an urgent enforcement direction, the Secretary of State must—</p></intro><level class="para1" eId="d25e5964"><num>(a)</num><content><p>give notice to the person to whom the direction was given that the Secretary of State proposes to confirm the direction; and</p></content></level><level class="para1"><num>(b)</num><intro><p>give the person—</p></intro><level class="para2"><num>(i)</num><content><p>an opportunity of making representations about the grounds on which it was given and its effect; and</p></content></level><level class="para2"><num>(ii)</num><content><p>an opportunity of proposing steps to remedy the situation.</p></content></level></level></subsection><subsection eId="d25e5988"><num>(5)</num><intro><p>The notice under subsection <ref href="#d25e5958">(4)</ref><ref href="#d25e5964">(a)</ref> must—</p></intro><level class="para1"><num>(a)</num><content><p>state that the Secretary of State proposes to confirm the direction;</p></content></level><level class="para1"><num>(b)</num><content><p>specify any proposed modifications of the direction;</p></content></level><level class="para1" eId="d25e6011"><num>(c)</num><content><p>specify the Secretary of State’s reasons for confirming the direction and for any modifications; and</p></content></level><level class="para1"><num>(d)</num><content><p>specify a reasonable period for making representations.</p></content></level></subsection><subsection><num>(6)</num><content><p>The requirement in subsection <ref href="#d25e5988">(5)</ref><ref href="#d25e6011">(c)</ref> does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.</p></content></subsection><subsection eId="d25e6034"><num>(7)</num><content><p>As soon as reasonably practicable after determining whether to confirm the direction, the Secretary of State must by notice inform the person to whom it was given of the determination.</p></content></subsection></section><section eId="d25e6043"><num>105Z24</num><heading>Urgent enforcement direction: enforcement</heading><subsection><num>(1)</num><content><p>A person who is given an urgent enforcement direction must comply with it, whether or not it has been confirmed (unless it is revoked).</p></content></subsection><subsection><num>(2)</num><intro><p>The duty is enforceable in civil proceedings by the Secretary of State—</p></intro><level class="para1"><num>(a)</num><content><p>for an injunction;</p></content></level><level class="para1"><num>(b)</num><content><p>for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or</p></content></level><level class="para1"><num>(c)</num><content><p>for any other appropriate remedy or relief.</p></content></level></subsection></section></quotedStructure></mod></p></content></subsection><subsection eId="section-21-3"><num>(3)</num><content><p><mod>In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><hcontainer name="definition"><content><p>“<term refersTo="#term-urgent-enforcement-direction">urgent enforcement direction</term>” has the meaning given by section <ref href="#d25e5752">105Z22</ref>.</p></content></hcontainer></quotedStructure></mod></p></content></subsection></section></hcontainer>
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:uk="https://www.legislation.gov.uk/namespaces/UK-AKN" name="crossheading" ukl:Name="Pblock" eId="crossheading-designated-vendor-directions-further-provision"><heading>Designated vendor directions: further provision</heading><section eId="section-22"><num>22</num><heading>Requirement not to disclose</heading><content><p><mod>After section <ref href="#d25e6043">105Z24</ref> of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e6115"><num>105Z25</num><heading>Requirement not to disclose</heading><subsection eId="d25e6119"><num>(1)</num><intro><p>The Secretary of State may require a public communications provider which has been given a designated vendor direction or a designated vendor who has been sent a copy under section <ref href="#d25e3529">105Z4</ref> not to disclose to any other person the contents of—</p></intro><level class="para1"><num>(a)</num><content><p>the designated vendor direction, or</p></content></level><level class="para1"><num>(b)</num><content><p>a part of the designated vendor direction specified by the Secretary of State,</p></content></level><wrapUp><p>without the permission of the Secretary of State.</p></wrapUp></subsection><subsection eId="d25e6142"><num>(2)</num><intro><p>The Secretary of State may require a designated vendor not to disclose to any other person the contents of—</p></intro><level class="para1"><num>(a)</num><content><p>the designation notice, or</p></content></level><level class="para1"><num>(b)</num><content><p>a part of the designation notice specified by the Secretary of State,</p></content></level><wrapUp><p>without the permission of the Secretary of State.</p></wrapUp></subsection><subsection eId="d25e6162"><num>(3)</num><intro><p>The Secretary of State may require a public communications provider which has been given a notification under section <ref href="#d25e5129">105Z18</ref> (notification of contravention of designated vendor direction etc) not to disclose to any other person the existence or contents of—</p></intro><level class="para1"><num>(a)</num><content><p>the notification, or</p></content></level><level class="para1"><num>(b)</num><content><p>a part of the notification specified by the Secretary of State,</p></content></level><wrapUp><p>without the permission of the Secretary of State.</p></wrapUp></subsection><subsection eId="d25e6185"><num>(4)</num><intro><p>The Secretary of State may require a public communications provider which has been given a confirmation decision under section <ref href="#d25e5471">105Z20</ref> (enforcement of notification under section <ref href="#d25e5129">105Z18</ref>) not to disclose to any other person the existence or contents of—</p></intro><level class="para1"><num>(a)</num><content><p>the confirmation decision, or</p></content></level><level class="para1"><num>(b)</num><content><p>a part of the confirmation decision specified by the Secretary of State,</p></content></level><wrapUp><p>without the permission of the Secretary of State.</p></wrapUp></subsection><subsection eId="d25e6211"><num>(5)</num><intro><p>The Secretary of State may require a person who has been given an urgent enforcement direction not to disclose to any other person the existence or contents of—</p></intro><level class="para1"><num>(a)</num><content><p>the urgent enforcement direction, or</p></content></level><level class="para1"><num>(b)</num><content><p>a part of the urgent enforcement direction specified by the Secretary of State,</p></content></level><wrapUp><p>without the permission of the Secretary of State.</p></wrapUp></subsection><subsection eId="d25e6231"><num>(6)</num><intro><p>The Secretary of State may require a person who has been given a notice under section <ref href="#d25e5878">105Z23</ref><ref href="#d25e5958">(4)</ref><ref href="#d25e5964">(a)</ref> or <ref href="#d25e6034">(7)</ref> (notices relating to confirmation of an urgent enforcement direction) not to disclose to any other person the existence or contents of—</p></intro><level class="para1"><num>(a)</num><content><p>the notice, or</p></content></level><level class="para1"><num>(b)</num><content><p>a part of the notice specified by the Secretary of State,</p></content></level><wrapUp><p>without the permission of the Secretary of State.</p></wrapUp></subsection><subsection><num>(7)</num><content><p>The Secretary of State may not impose a requirement on a person under subsection <ref href="#d25e6119">(1)</ref>, <ref href="#d25e6142">(2)</ref>, <ref href="#d25e6162">(3)</ref>, <ref href="#d25e6185">(4)</ref>, <ref href="#d25e6211">(5)</ref> or <ref href="#d25e6231">(6)</ref> unless the condition in subsection <ref href="#d25e6289">(8)</ref> is satisfied.</p></content></subsection><subsection eId="d25e6289"><num>(8)</num><intro><p>The condition in this subsection is that the Secretary of State considers that it would be contrary to the interests of national security for—</p></intro><level class="para1"><num>(a)</num><content><p>the contents of the designated vendor direction or the part specified under subsection <ref href="#d25e6119">(1)</ref>,</p></content></level><level class="para1"><num>(b)</num><content><p>the contents of the designation notice or the part specified under subsection <ref href="#d25e6142">(2)</ref>,</p></content></level><level class="para1"><num>(c)</num><content><p>the existence or contents of the notification under section <ref href="#d25e5129">105Z18</ref> or the part specified under subsection <ref href="#d25e6162">(3)</ref>,</p></content></level><level class="para1"><num>(d)</num><content><p>the existence or contents of the confirmation decision under section <ref href="#d25e5471">105Z20</ref> or the part specified under subsection <ref href="#d25e6185">(4)</ref>,</p></content></level><level class="para1"><num>(e)</num><content><p>the existence or contents of the urgent enforcement direction or the part specified under subsection <ref href="#d25e6211">(5)</ref>, or</p></content></level><level class="para1"><num>(f)</num><content><p>the existence or contents of the notice under section <ref href="#d25e5878">105Z23</ref><ref href="#d25e5958">(4)</ref><ref href="#d25e5964">(a)</ref> or <ref href="#d25e6034">(7)</ref> or the part specified under subsection <ref href="#d25e6231">(6)</ref>,</p></content></level><wrapUp><p>(as the case may be) to be disclosed, except as permitted by the Secretary of State.</p></wrapUp></subsection><subsection eId="d25e6367"><num>(9)</num><intro><p>If the condition in subsection <ref href="#d25e6411">(10)</ref> is satisfied, the Secretary of State may require a person consulted under section <ref href="#d25e3488">105Z3</ref><ref href="#d25e3492">(1)</ref>, <ref href="#d25e3569">105Z5</ref><ref href="#d25e3615">(4)</ref>, <ref href="#d25e4093">105Z9</ref><ref href="#d25e4097">(1)</ref> or <ref href="#d25e4121">105Z10</ref><ref href="#d25e4155">(4)</ref> not to disclose to any other person—</p></intro><level class="para1" eId="d25e6397"><num>(a)</num><content><p>the existence of the consultation and any information disclosed to the person in the consultation, or</p></content></level><level class="para1" eId="d25e6403"><num>(b)</num><content><p>the existence of a part of the consultation specified by the Secretary of State and any information disclosed to the person in that part of the consultation,</p></content></level><wrapUp><p>without the permission of the Secretary of State.</p></wrapUp></subsection><subsection eId="d25e6411"><num>(10)</num><content><p>The condition in this subsection is that the Secretary of State considers that it would be contrary to the interests of national security for the matters described in subsection <ref href="#d25e6367">(9)</ref><ref href="#d25e6397">(a)</ref> or (as the case may be) subsection <ref href="#d25e6367">(9)</ref><ref href="#d25e6403">(b)</ref> to be disclosed, except as permitted by the Secretary of State.</p></content></subsection><subsection><num>(11)</num><content><p>Where a person is subject to a requirement under this section not to disclose a matter, disclosure of that matter by an employee of the person or a person engaged in the person’s business is to be regarded as a disclosure by the person, unless the person can show that the person took all reasonable steps to prevent such a disclosure.</p></content></subsection></section><section eId="d25e6436"><num>105Z26</num><heading>Enforcement of requirement not to disclose</heading><subsection><num>(1)</num><content><p>Sections <ref href="#d25e5129">105Z18</ref>, <ref href="#d25e5296">105Z19</ref><ref href="#d25e5300">(1)</ref> to <ref href="#d25e5330">(3)</ref>, <ref href="#d25e5471">105Z20</ref> and <ref href="#d25e5670">105Z21</ref> apply in relation to a contravention by a person of a requirement not to disclose imposed under section <ref href="#d25e6115">105Z25</ref> as they apply in relation to a contravention by a public communications provider of a requirement imposed by a designated vendor direction, subject to subsections <ref href="#d25e6473">(2)</ref> to <ref href="#d25e6561">(6)</ref>.</p></content></subsection><subsection eId="d25e6473"><num>(2)</num><content><p><mod>Section <ref href="#d25e5129">105Z18</ref> (as applied by this section) has effect as if, in subsection <ref href="#d25e5156">(2)</ref><ref href="#d25e5180">(d)</ref>, for sub-paragraphs <ref href="#d25e5186">(i)</ref> and <ref href="#d25e5192">(ii)</ref> there were substituted—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para2"><num>(i)</num><content><p>bring the contravention to an end;</p></content></level><level class="para2"><num>(ii)</num><content><p>limit the consequences of the contravention;</p></content></level></quotedStructure><inline name="appendText">.</inline></mod></p></content></subsection><subsection eId="d25e6508"><num>(3)</num><intro><p>Section <ref href="#d25e5296">105Z19</ref> (as applied by this section) has effect as if—</p></intro><level class="para1" eId="d25e6517"><num>(a)</num><content><p>in subsection <ref href="#d25e5321">(2)</ref>, the maximum penalty specified were £10 million;</p></content></level><level class="para1" eId="d25e6526"><num>(b)</num><content><p>in subsection <ref href="#d25e5330">(3)</ref>, the maximum penalty specified were £50,000 per day.</p></content></level></subsection><subsection eId="d25e6535"><num>(4)</num><content><p>The Secretary of State may by regulations amend subsection <ref href="#d25e6508">(3)</ref> so as to substitute a different amount for the amount for the time being specified in subsection <ref href="#d25e6508">(3)</ref><ref href="#d25e6517">(a)</ref> or <ref href="#d25e6526">(b)</ref>.</p></content></subsection><subsection><num>(5)</num><content><p>No regulations are to be made containing provision authorised by subsection <ref href="#d25e6535">(4)</ref> unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.</p></content></subsection><subsection eId="d25e6561"><num>(6)</num><intro><p>Section <ref href="#d25e5471">105Z20</ref> (as applied by this section) has effect as if—</p></intro><level class="para1"><num>(a)</num><intro><p>in subsection <ref href="#d25e5564">(6)</ref>—</p></intro><level class="para2"><num>(i)</num><content><p><mod>in paragraph <ref href="#d25e5570">(a)</ref>, for sub-paragraphs <ref href="#d25e5576">(i)</ref> and <ref href="#d25e5585">(ii)</ref> there were substituted—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para2"><num>(i)</num><content><p>to bring the contravention to an end, and</p></content></level><level class="para2"><num>(ii)</num><content><p>to limit the consequences of the contravention,</p></content></level></quotedStructure><inline name="appendText">;</inline></mod></p></content></level><level class="para2"><num>(ii)</num><content><p><mod>in paragraph <ref href="#d25e5614">(b)</ref>, for “comply with that requirement and remedy” there were substituted <quotedText>“bring that contravention to an end and limit”</quotedText>;</mod></p></content></level><level class="para2"><num>(iii)</num><content><p><mod>in the words following paragraph <ref href="#d25e5614">(b)</ref>, for “comply with that requirement or remedy” there were substituted <quotedText>“bring that contravention to an end or limit”</quotedText>;</mod></p></content></level></level><level class="para1"><num>(b)</num><content><p><mod>in subsection <ref href="#d25e5599">(7)</ref><ref href="#d25e5614">(b)</ref><ref href="#d25e5626">(ii)</ref>, for the words from “comply” to “remedy” there were substituted <quotedText>“bring the contravention to an end or to limit”</quotedText>.</mod></p></content></level></subsection></section></quotedStructure></mod></p></content></section><section eId="section-23"><num>23</num><heading>Power of Secretary of State to require information etc</heading><content><p><mod>After section <ref href="#d25e6436">105Z26</ref> of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section eId="d25e6666"><num>105Z27</num><heading>Power of Secretary of State to require information etc</heading><subsection eId="d25e6670"><num>(1)</num><content><p>The Secretary of State may require a person falling within subsection <ref href="#d25e6685">(2)</ref> to provide the Secretary of State with such information as the Secretary of State may reasonably require for the purpose of exercising the Secretary of State’s functions under sections <ref href="#d25e3193">105Z1</ref> to <ref href="#d25e6436">105Z26</ref>.</p></content></subsection><subsection eId="d25e6685"><num>(2)</num><intro><p>The persons falling within this subsection are—</p></intro><level class="para1" eId="d25e6691"><num>(a)</num><content><p>a person who is or has been a public communications provider;</p></content></level><level class="para1"><num>(b)</num><content><p>a person not falling within paragraph <ref href="#d25e6691">(a)</ref> who appears to the Secretary of State to have information relevant to the exercise of the Secretary of State’s functions under sections <ref href="#d25e3193">105Z1</ref> to <ref href="#d25e6436">105Z26</ref>.</p></content></level></subsection><subsection eId="d25e6712"><num>(3)</num><intro><p>The Secretary of State may require a person falling within subsection <ref href="#d25e6685">(2)</ref>—</p></intro><level class="para1"><num>(a)</num><content><p>to produce, generate or obtain information for the purpose of providing it under subsection <ref href="#d25e6670">(1)</ref>;</p></content></level><level class="para1"><num>(b)</num><content><p>to collect or retain information that the person would not otherwise collect or retain for the purpose of providing it under subsection <ref href="#d25e6670">(1)</ref>;</p></content></level><level class="para1"><num>(c)</num><content><p>to process, collate or analyse any information held by the person (including information the person has been required to collect or retain) for the purpose of producing or generating information to be provided under subsection <ref href="#d25e6670">(1)</ref>.</p></content></level></subsection><subsection eId="d25e6748"><num>(4)</num><intro><p>The information that may be required under subsection <ref href="#d25e6670">(1)</ref> includes, in particular, information about—</p></intro><level class="para1"><num>(a)</num><content><p>the use, or proposed use, of goods, services or facilities supplied, provided or made available by a particular person or a particular description of person;</p></content></level><level class="para1"><num>(b)</num><content><p>goods, services or facilities proposed to be supplied, provided or made available by a particular person or a particular description of person;</p></content></level><level class="para1"><num>(c)</num><intro><p>goods, services or facilities proposed to be supplied, provided or made available by a person who has not, or has not recently, supplied, provided or made available for use in the United Kingdom—</p></intro><level class="para2"><num>(i)</num><content><p>goods, services or facilities of that description; or</p></content></level><level class="para2"><num>(ii)</num><content><p>any goods, services or facilities;</p></content></level></level><level class="para1"><num>(d)</num><content><p>the manner in which a public electronic communications network or a public electronic communications service is, or is proposed to be, provided or facilities that are associated facilities by reference to such a network or service are, or are proposed to be, made available;</p></content></level><level class="para1"><num>(e)</num><content><p>future developments of such a network or service or such associated facilities.</p></content></level></subsection><subsection><num>(5)</num><content><p>The Secretary of State may require a person to provide information under this section at such times or in such circumstances as may be specified by the Secretary of State.</p></content></subsection><subsection><num>(6)</num><content><p>A person must comply with a requirement imposed under this section in such manner and within such reasonable period as may be specified by the Secretary of State.</p></content></subsection><subsection><num>(7)</num><content><p>The powers in this section are subject to the limitations in section <ref href="#d25e6829">105Z28</ref>.</p></content></subsection><subsection><num>(8)</num><content><p>A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility.</p></content></subsection></section><section eId="d25e6829"><num>105Z28</num><heading>Restrictions on imposing information requirements</heading><subsection><num>(1)</num><content><p>This section limits the purposes for which, and manner in which, requirements may be imposed under section <ref href="#d25e6666">105Z27</ref>.</p></content></subsection><subsection eId="d25e6842"><num>(2)</num><intro><p>The Secretary of State is not to require a person to provide information under section <ref href="#d25e6666">105Z27</ref> except by a notice served on the person that—</p></intro><level class="para1"><num>(a)</num><content><p>describes the required information; and</p></content></level><level class="para1" eId="d25e6857"><num>(b)</num><content><p>sets out the Secretary of State’s reasons for requiring it.</p></content></level></subsection><subsection eId="d25e6863"><num>(3)</num><content><p>The Secretary of State is not to impose a requirement on a person under section <ref href="#d25e6666">105Z27</ref><ref href="#d25e6712">(3)</ref> except by a notice served on the person that sets out the requirement and the Secretary of State’s reasons for imposing it.</p></content></subsection><subsection><num>(4)</num><content><p>The requirements in subsections <ref href="#d25e6842">(2)</ref><ref href="#d25e6857">(b)</ref> and <ref href="#d25e6863">(3)</ref> do not apply if or to the extent that the Secretary of State considers that setting out reasons in the notice would be contrary to the interests of national security.</p></content></subsection><subsection><num>(5)</num><content><p>The Secretary of State is not to require the provision of information under section <ref href="#d25e6666">105Z27</ref> except where the making of a demand for the information is proportionate to the use to which the information is to be put in the carrying out of the Secretary of State’s functions.</p></content></subsection><subsection><num>(6)</num><content><p>The Secretary of State is not to impose a requirement on a person under section <ref href="#d25e6666">105Z27</ref><ref href="#d25e6712">(3)</ref> except where the imposition of the requirement is proportionate to the use to which the information required to be produced, generated, obtained, collected or retained (including information required to be produced or generated by processing, collating or analysing) is to be put in the carrying out of the Secretary of State’s functions.</p></content></subsection><subsection><num>(7)</num><content><p>A requirement to provide information under section <ref href="#d25e6666">105Z27</ref> does not require a person to disclose information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings.</p></content></subsection></section><section><num>105Z29</num><heading>Enforcement of information requirements etc</heading><subsection><num>(1)</num><content><p>Sections <ref href="#d25e5129">105Z18</ref>, <ref href="#d25e5296">105Z19</ref><ref href="#d25e5300">(1)</ref> to <ref href="#d25e5330">(3)</ref>, <ref href="#d25e5471">105Z20</ref> and <ref href="#d25e5670">105Z21</ref> apply in relation to a contravention by a person of a requirement under section <ref href="#d25e6666">105Z27</ref> as they apply in relation to a contravention by a public communications provider of a requirement imposed by a designated vendor direction, subject to subsection <ref href="#d25e6954">(2)</ref>.</p></content></subsection><subsection eId="d25e6954"><num>(2)</num><intro><p>Section <ref href="#d25e5296">105Z19</ref> (as applied by this section) has effect as if—</p></intro><level class="para1" eId="d25e6963"><num>(a)</num><content><p>in subsection <ref href="#d25e5321">(2)</ref>, the maximum penalty specified were £10 million;</p></content></level><level class="para1" eId="d25e6972"><num>(b)</num><content><p>in subsection <ref href="#d25e5330">(3)</ref>, the maximum penalty specified were £50,000 per day.</p></content></level></subsection><subsection eId="d25e6981"><num>(3)</num><content><p>The Secretary of State may by regulations amend subsection <ref href="#d25e6954">(2)</ref> so as to substitute a different amount for the amount for the time being specified in subsection <ref href="#d25e6954">(2)</ref><ref href="#d25e6963">(a)</ref> or <ref href="#d25e6972">(b)</ref>.</p></content></subsection><subsection eId="d25e6998"><num>(4)</num><content><p>No regulations are to be made containing provision authorised by subsection <ref href="#d25e6981">(3)</ref> unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.</p></content></subsection></section></quotedStructure></mod></p></content></section></hcontainer>
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" xmlns:uk="https://www.legislation.gov.uk/namespaces/UK-AKN" name="crossheading" ukl:Name="Pblock" eId="crossheading-further-amendments"><heading>Further amendments</heading><section eId="section-24"><num>24</num><heading>Further amendment concerning penalties</heading><content><p><mod>After section 139 of the Communications Act 2003 insert—<quotedStructure startQuote="&#x201C;" endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><section><num>139ZA</num><heading>Higher penalties for certain contraventions</heading><subsection><num>(1)</num><intro><p>This section applies where—</p></intro><level class="para1"><num>(a)</num><content><p>a person is given a notification under section 138 which specifies a proposed penalty; and</p></content></level><level class="para1"><num>(b)</num><content><p>the condition in subsection <ref href="#d25e7053">(2)</ref> or <ref href="#d25e7092">(3)</ref> is met.</p></content></level></subsection><subsection eId="d25e7053"><num>(2)</num><intro><p>The condition in this subsection is that—</p></intro><level class="para1"><num>(a)</num><content><p>the proposed penalty is in respect of a contravention of a requirement to provide information under section 135; and</p></content></level><level class="para1"><num>(b)</num><intro><p>the demand for the information contains a statement that OFCOM consider the information to be necessary for the purpose of—</p></intro><level class="para2"><num>(i)</num><content><p>carrying out any of their functions under sections <ref href="#d25e1180">105L</ref> to <ref href="#d25e2620">105Z</ref>;</p></content></level><level class="para2"><num>(ii)</num><content><p>preparing a report under section <ref href="#d25e4379">105Z12</ref>.</p></content></level></level></subsection><subsection eId="d25e7092"><num>(3)</num><content><p>The condition in this subsection is that the proposed penalty is in respect of a contravention of a requirement imposed under subsection (3C) of section 135.</p></content></subsection><subsection eId="d25e7098"><num>(4)</num><intro><p>Section 139 applies in relation to the proposed penalty as if—</p></intro><level class="para1" eId="d25e7104"><num>(a)</num><content><p>in subsection (4B), the maximum penalty specified were £50,000 per day;</p></content></level><level class="para1" eId="d25e7110"><num>(b)</num><content><p>in subsection (5), the maximum penalty specified were £10 million.</p></content></level></subsection><subsection eId="d25e7116"><num>(5)</num><content><p>The Secretary of State may by regulations amend this section so as to make different provision as to the maximum penalty applying under section 139(4B) or (5).</p></content></subsection><subsection><num>(6)</num><content><p>No regulations are to be made containing provision authorised by subsection <ref href="#d25e7116">(5)</ref> unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.</p></content></subsection></section></quotedStructure></mod></p></content></section><section eId="section-25"><num>25</num><heading>Further consequential amendments</heading><subsection eId="section-25-1"><num>(1)</num><content><p>The Communications Act 2003 is amended as follows.</p></content></subsection><subsection eId="section-25-2"><num>(2)</num><content><p>In section 38 (fixing of charges) in subsection (6) (list of functions by reference to which charges are to be fixed) omit paragraph (ec).</p></content></subsection><subsection eId="section-25-3"><num>(3)</num><intro><p>In section 402 (power of Secretary of State to make orders and regulations) in subsection (2) (orders and regulations subject to negative procedure)—</p></intro><level class="para1" eId="section-25-3-a"><num>(a)</num><content><p>omit the “or” before paragraph (c);</p></content></level><level class="para1" eId="section-25-3-b"><num>(b)</num><content><p><mod>after paragraph (c) insert <quotedText startQuote="&#x201C;">or</quotedText><quotedStructure endQuote="&#x201D;" uk:context="body" uk:docName="ukpga" ukl:TargetClass="primary" ukl:TargetSubClass="unknown" ukl:Context="main" ukl:Format="double"><level class="para1"><num>(d)</num><content><p>any regulations that are required, by any provision of this Act, to be laid before Parliament and approved in draft,</p></content></level></quotedStructure><inline name="appendText">.</inline></mod></p></content></level></subsection></section></hcontainer>
<hcontainer xmlns="http://docs.oasis-open.org/legaldocml/ns/akn/3.0" xmlns:ukl="http://www.legislation.gov.uk/namespaces/legislation" name="crossheading" ukl:Name="Pblock" eId="crossheading-final"><heading>Final</heading><section eId="section-26"><num>26</num><heading>Financial provision</heading><content><p>There is to be paid out of money provided by Parliament any increase attributable to this Act in the sums payable under any other Act out of money so provided.</p></content></section><section eId="section-27"><num>27</num><heading>Extent</heading><content><p>This Act extends to England and Wales, Scotland and Northern Ireland.</p></content></section><section eId="section-28"><num>28</num><heading>Commencement</heading><subsection eId="section-28-1"><num>(1)</num><intro><p>The following provisions come into force on the day on which this Act is passed—</p></intro><level class="para1" eId="section-28-1-a"><num>(a)</num><content><p>sections 1 and 2, so far as they confer power to make regulations;</p></content></level><level class="para1" eId="section-28-1-b"><num>(b)</num><content><p>section 3, so far as it confers power to issue codes of practice;</p></content></level><level class="para1" eId="section-28-1-c"><num>(c)</num><content><p>sections 14 to 23;</p></content></level><level class="para1" eId="section-28-1-d"><num>(d)</num><content><p>section 24, so far as it relates to section 18;</p></content></level><level class="para1" eId="section-28-1-e"><num>(e)</num><content><p>section 25<ref href="#section-25-1">(1)</ref> and <ref href="#section-25-3">(3)</ref>;</p></content></level><level class="para1" eId="section-28-1-f"><num>(f)</num><content><p>section 26;</p></content></level><level class="para1" eId="section-28-1-g"><num>(g)</num><content><p>section 27;</p></content></level><level class="para1" eId="section-28-1-h"><num>(h)</num><content><p>this section;</p></content></level><level class="para1" eId="section-28-1-i"><num>(i)</num><content><p>section 29.</p></content></level></subsection><subsection eId="section-28-2"><num>(2)</num><intro><p>The following provisions come into force on such day as the Secretary of State may by regulations made by statutory instrument appoint—</p></intro><level class="para1" eId="section-28-2-a"><num>(a)</num><content><p>sections 1 to 3 (so far as not already in force by virtue of subsection <ref href="#section-28-1">(1)</ref>);</p></content></level><level class="para1" eId="section-28-2-b"><num>(b)</num><content><p>sections 4 to 13;</p></content></level><level class="para1" eId="section-28-2-c"><num>(c)</num><content><p>section 24 (so far as not already in force by virtue of subsection (1));</p></content></level><level class="para1" eId="section-28-2-d"><num>(d)</num><content><p>section 25<ref href="#section-25-2">(2)</ref>.</p></content></level></subsection><subsection eId="section-28-3"><num>(3)</num><content><p>Different days may be appointed for different purposes.</p></content></subsection><subsection eId="section-28-4"><num>(4)</num><content><p>The Secretary of State may by regulations made by statutory instrument make transitional, transitory or saving provision in connection with the coming into force of any provision of this Act.</p></content></subsection></section><section eId="section-29"><num>29</num><heading>Short title</heading><content><p>This Act may be cited as the Telecommunications (Security) Act 2021.</p></content></section></hcontainer>