(1) The provider of a public electronic communications network or a public electronic communications service must inform OFCOM as soon as reasonably practicable of—
(a) any security compromise that has a significant effect on the operation of the network or service;
(b) any security compromise within section 105A(2)(b) that puts any person in a position to be able to bring about a further security compromise that would have a significant effect on the operation of the network or service.
(2) In determining for the purposes of this section whether the effect that a security compromise has, or would have, on the operation of a network or service is significant, the following matters in particular are to be taken into account—
(a) the length of the period during which the operation of the network or service is or would be affected;
(b) the number of persons who use the network or service that are or would be affected by the effect on the operation of the network or service;
(c) the size and location of the geographical area within which persons who use the network or service are or would be affected by the effect on the operation of the network or service;
(d) the extent to which activities of persons who use the network or service are or would be affected by the effect on the operation of the network or service.
105L Powers of OFCOM to inform others of security compromise
(1) This section applies where OFCOM consider that—
(a) there is a risk of a security compromise occurring in relation to a public electronic communications network or public electronic communications service; or
(b) a security compromise has occurred in relation to a public electronic communications network or public electronic communications service.
(2) OFCOM must inform the Secretary of State of the risk of or (as the case may be) the occurrence of the security compromise if they consider that the security compromise could result in or has resulted in—
(a) a serious threat to the safety of the public, to public health or to national security;
(b) serious economic or operational problems for persons who are communications providers or persons who make associated facilities available; or
(c) serious economic or operational problems for persons who use electronic communications networks, electronic communications services or associated facilities.
(3) OFCOM may inform the Secretary of State of the risk of or (as the case may be) the occurrence of the security compromise in a case where the duty in subsection (2) does not arise.
(4) OFCOM may inform any of the following about the risk of or (as the case may be) the occurrence of the security compromise—
(a) any person who uses or has used the network or service;
(b) any communications provider;
(c) any person who makes associated facilities available;
(d) any overseas regulator;
(e) the European Union Agency for Cybersecurity.
(5) OFCOM may inform any person who uses or has used the network or service of the technical measures that may be taken by the person for the purposes of—
(a) preventing the security compromise adversely affecting them; or
(b) remedying or mitigating the adverse effect that the security compromise has on them.
(6) OFCOM may direct the provider of the network or service to take steps specified in the direction for the purposes of—
(a) informing persons who use or have used the network or service of the risk of or (as the case may be) the occurrence of the security compromise;
(b) informing persons who use or have used the network or service of the technical measures that may be taken by them for a purpose mentioned in subsection (5)(a) or (b).
(7) OFCOM may if they consider it to be in the public interest—
(a) inform the public of the risk of or (as the case may be) the occurrence of the security compromise;
(b) inform the public of the technical measures that may be taken by members of the public for a purpose mentioned in subsection (5)(a) or (b);
(c) direct the provider of the network or service to do anything that OFCOM could do under paragraph (a) or (b).
(8) It is the duty of the provider of the network or service to comply with a direction given under this section within such reasonable period as may be specified in the direction.
(9) In this section “overseas regulator” means a person who, under the law of a country or territory outside the United Kingdom, has functions in relation to public electronic communications networks or public electronic communications services that correspond to functions that OFCOM have in relation to such networks or services.
105M General duty of OFCOM to ensure compliance with security duties
OFCOM must seek to ensure that providers of public electronic communications networks and public electronic communications services comply with the duties imposed on them by or under sections 105A to 105D, 105J and 105K.
105N Power of OFCOM to assess compliance with security duties
(1) OFCOM may carry out, or arrange for another person to carry out, an assessment of whether the provider of a public electronic communications network or a public electronic communications service is complying or has complied with a duty imposed on the provider by or under any of sections 105A to 105D, 105J and 105K.
(2) Where an assessment under this section is carried out, the provider of the network or service concerned must—
(a) co-operate with the assessment; and
(b) pay the costs reasonably incurred by OFCOM in connection with the assessment.
(1) This section applies for the purposes of an assessment under section 105N in respect of the provider of a public electronic communications network or a public electronic communications service.
(2) OFCOM may by notice (“an assessment notice”) impose on the provider a duty to do any of the following things—
(a) carry out specified tests or tests of a specified description in relation to the network or service;
(b) make arrangements of a specified description for another person to carry out specified tests or tests of a specified description in relation to the network or service;
(c) make available for interview a specified number of persons of a specified description who are involved in the provision of the network or service (not exceeding the number who are willing to be interviewed);
(d) permit an authorised person to enter specified premises;
(e) permit an authorised person to observe any operation taking place on the premises that relates to the network or service;
(f) direct an authorised person to equipment or other material on the premises that is of a specified description;
(g) direct an authorised person to documents on the premises that are of a specified description;
(h) assist an authorised person to view information of a specified description that is capable of being viewed using equipment on the premises;
(i) comply with a request from an authorised person for a copy of the documents to which the person is directed and the information the person is assisted to view;
(j) permit an authorised person to inspect or examine the documents, information, equipment or material to which the person is directed or which the person is assisted to view;
(k) provide an authorised person with an explanation of such documents, information, equipment or material.
(3) The references in subsection (2)(a) and (b) to tests in relation to the network or service include references to—
(a) tests in relation to premises used in connection with the provision of the network or service;
(b) tests in relation to persons involved in the provision of the network or service.
(4) An assessment notice may impose on the provider a duty to carry out, or to make arrangements for another person to carry out, a test in relation to the network or service that risks causing a security compromise, loss to a person or damage to property only if the test consists of the use of techniques that might be expected to be used by a person seeking to cause a security compromise.
(5) An assessment notice may not impose on the provider a duty to permit an authorised person to enter domestic premises.
(6) An assessment notice may not impose on the provider a duty to do anything that would result in the disclosure of documents or information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings.
(7) An assessment notice must, in relation to each duty imposed by the notice, specify the time or times at which, or period or periods within which, the duty must be complied with.
(8) A time or period specified under subsection (7) must not be a time that falls or a period that begins before the end of the period within which an appeal under section 192 can be brought in respect of the assessment notice (ignoring any power to extend the period within which an appeal could be brought).
(9) If an appeal under section 192 is brought in respect of an assessment notice or any provision of an assessment notice, the provider need not comply with any duty imposed by the notice or the provision pending the determination or withdrawal of the appeal.
(10) An assessment notice must provide information about—
(a) the consequences of failing to comply with a duty imposed by the notice; and
(b) the right of appeal in respect of the notice under section 192.
(11) An assessment notice may by further notice—
(a) be revoked by OFCOM;
(b) be varied by OFCOM so as to make it less onerous.
(12) In this section—
“authorised person” means an employee of, or person authorised by, OFCOM;
“domestic premises” means premises, or a part of premises, used as a dwelling;
“specified” means specified in the assessment notice.
(1) This section applies where—
(a) an assessment notice is given under section 105O to the provider of a public electronic communications network or a public electronic communications service;
(b) the notice states that, in OFCOM’s opinion, it is necessary for the provider to comply with a duty imposed by the notice urgently;
(c) the notice gives OFCOM’s reasons for reaching that opinion; and
(d) the notice provides information about the right of the provider to make an application under section 105Q.
(2) Subsections (8) and (9) of section 105O do not apply in relation to the duty mentioned in subsection (1)(b).
(3) A time or period specified under subsection (7) of section 105O in relation to the duty mentioned in subsection (1)(b) must not be a time that falls or a period that begins before the end of the period of 14 days beginning with the day the notice is given.
(4) In a case where—
(a) the duty mentioned in subsection (1)(b) is a duty to do something mentioned in section 105O(2)(d) to (k), and
(b) within the period of 14 days beginning with the day the notice is given an appeal under section 192 is brought in respect of the notice or the provision of the notice that imposes the duty,
the provider of the network or service need not comply with the duty pending the determination or withdrawal of the appeal.
105Q Assessment notices: applications in respect of urgency statements
(1) This section applies where an assessment notice given under section 105O to a provider of a public electronic communications network or a public electronic communications service contains a statement under section 105P(1)(b).
(2) The provider may apply to the court for either or both of the following—
(a) the disapplication of the statement in relation to some or all of the duties imposed by the notice;
(b) a change to the time at which, or period within which, a duty imposed by the notice must be complied with.
(3) On an application under this section, the court may do any of the following—
(a) direct that the notice is to have effect as if it did not contain the statement;
(b) direct that the inclusion of the statement is not to have effect in relation to a duty imposed by the notice;
(c) vary the notice by changing the time at which, or the period within which, a duty imposed by the notice must be complied with;
(d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).
(4) The decision of the court on an application under this section is final.
(5) In this section “the court” means the High Court or, in Scotland, the Court of Session.
105R Assessment notices: information about entering premises
Every report under paragraph 12 of the Schedule to the Office of Communications Act 2002 (OFCOM’s annual report) must include a statement of the number of occasions during the financial year to which the report relates on which premises have been entered in pursuance of a duty imposed under section 105O(2)(d).
(1) Sections 96A to 100, 102 and 103 apply in relation to a contravention of a security duty as they apply in relation to a contravention of a condition set under section 45, other than an SMP apparatus condition.
(2) This section is subject to section 105T (enforcement of security duties: amount of penalties).
(3) In this section “security duty” means a duty imposed by or under any of sections 105A to 105D, 105I to 105K, 105L(6), (7)(c) and (8), 105N(2)(a) and 105O.
105T Enforcement of security duties: amount of penalties
(1) In its application in relation to a contravention of a security duty, other than a security duty imposed by section 105I, section 96B(5) has effect as if the maximum penalty specified were £100,000 per day.
(2) In its application in relation to a contravention of a security duty imposed by section 105I, section 96B(5) has effect as if the maximum penalty specified were £50,000 per day.
(3) In its application in relation to a contravention of a security duty imposed by section 105I, section 97(1) has effect as if the maximum penalty specified were £10 million.
(4) The Secretary of State may by regulations amend this section so as to substitute a different amount for the amount for the time being specified in subsection (1), (2) or (3).
(5) No regulations are to be made containing provision authorised by subsection (4) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.
(6) In this section “security duty” has the same meaning as in section 105S.
105U Enforcement of security duties: proposal for interim steps
(1) This section applies where—
(a) OFCOM determine that there are reasonable grounds for believing that the provider of a public electronic communications network or a public electronic communications service is contravening or has contravened a duty imposed by or under any of sections 105A to 105D;
(b) OFCOM either have not commenced, or have commenced but not completed, enforcement action in connection with the contravention;
(c) OFCOM determine that there are reasonable grounds for believing that either or both of the following conditions are met—
(i) a security compromise has occurred as a result of the contravention;
(ii) there is an imminent risk of a security compromise or (as the case may be) a further security compromise occurring as a result of the contravention; and
(d) OFCOM determine that, having regard to the seriousness or likely seriousness of the security compromise or security compromises mentioned in paragraph (c), it is reasonable to require the provider to take interim steps pending the completion by OFCOM of enforcement action in connection with the contravention.
(2) OFCOM may give a notification to the provider that—
(a) sets out the determinations mentioned in subsection (1);
(b) specifies the interim steps that OFCOM think the provider should be required to take pending the completion by OFCOM of enforcement action in connection with the contravention; and
(c) specifies the period during which the provider has an opportunity to make representations about the matters notified.
(3) In this section and section 105V—
(a) references to the commencement by OFCOM of enforcement action in connection with a contravention are to the giving of a notification under section 96A (as applied by section 105S) in respect of the contravention; and
(b) references to the completion by OFCOM of enforcement action in connection with a contravention are to the taking of action under section 96C(2)(a) or (b) (as applied by section 105S) in connection with the contravention.
(4) In this section “interim steps” means—
(a) in a case where OFCOM determine that there are reasonable grounds for believing that the condition in subsection (1)(c)(i) is met, steps to—
(i) prevent adverse effects (on the network or service or otherwise) arising from the security compromise;
(ii) remedy or mitigate any adverse effects on the network or service arising from the security compromise;
(b) in a case where OFCOM determine that there are reasonable grounds for believing that the condition in subsection (1)(c)(ii) is met, steps to—
(i) eliminate or reduce the risk of the security compromise or (as the case may be) the further security compromise occurring;
(ii) prevent adverse effects (on the network or service or otherwise) arising from the security compromise or (as the case may be) the further security compromise in the event it occurs.
105V Enforcement of security duties: direction to take interim steps
(1) This section applies where—
(a) the provider of a public electronic communications network or a public electronic communications service has been given a notification under section 105U;
(b) OFCOM have allowed the provider an opportunity to make representations about the matters notified; and
(c) the period allowed for the making of representations has expired.
(2) OFCOM may—
(a) direct the provider to take the interim steps or any of the interim steps specified in the notification; or
(b) inform the provider that a direction under paragraph (a) will not be given.
(3) OFCOM may give a direction under subsection (2)(a) only if (after considering any representations) they are satisfied—
(a) that there are reasonable grounds for believing that the contravention on the basis of which the notification was given occurred;
(b) that there are reasonable grounds for believing that either or both of the following conditions are met—
(i) a security compromise has occurred as a result of the contravention;
(ii) there is an imminent risk of a security compromise or (as the case may be) a further security compromise occurring as a result of the contravention; and
(c) that, having regard to the seriousness or likely seriousness of the security compromise or security compromises mentioned in paragraph (b), it is reasonable to give the direction.
(4) A direction under subsection (2)(a) must include a statement of OFCOM’s reasons for giving the direction.
(5) A direction under subsection (2)(a) must, in relation to each interim step, specify the period within which the step must be taken.
(6) A direction under subsection (2)(a) is ineffective in so far as it would require interim steps to be taken after the completion by OFCOM of enforcement action in connection with the contravention concerned.
(7) Where a direction under subsection (2)(a) has been given and has not been revoked, OFCOM must as soon as reasonably practicable—
(a) commence enforcement action in connection with the contravention concerned (unless enforcement action was commenced by OFCOM before the direction was given); and
(b) complete enforcement action in connection with the contravention concerned.
(8) A direction under subsection (2)(a) may at any time—
(a) be revoked by OFCOM; or
(b) be varied by OFCOM so as to make it less onerous.
(9) A provider of a public electronic communications network or a public electronic communications service who is given a direction under subsection (2)(a) must comply with it.
(10) That duty is enforceable in civil proceedings by OFCOM—
(a) for an injunction;
(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or
(c) for any other appropriate remedy or relief.
105W Civil liability for breach of security duties
(1) A duty imposed by or under any of sections 105A to 105D and 105J on a provider of a public electronic communications network or a public electronic communications service is a duty owed to every person who may be affected by a contravention of the duty.
(2) Subsections (3) and (4) apply where a duty is owed by virtue of subsection (1) to a person.
(3) A breach of the duty that causes that person to sustain loss or damage is actionable at the suit or instance of that person.
(4) An act which—
(a) by inducing a breach of the duty or interfering with its performance, causes that person to sustain loss or damage, and
(b) is done wholly or partly for achieving that result,
is actionable at the suit or instance of that person.
(5) In proceedings brought against a provider of a public electronic communications network or a public electronic communications service by virtue of subsection (3), it is a defence for the provider to show that they took all reasonable steps and exercised all due diligence to avoid contravening the duty in question.
(6) The consent of OFCOM is required for the bringing of proceedings by virtue of this section.
(7) If OFCOM give their consent subject to conditions relating to the conduct of the proceedings, the proceedings are not to be carried on except in compliance with those conditions.
105X Relationship between security duties and certain other duties etc
(1) A security duty imposed on a provider of a public electronic communications network or a public electronic communications service does not apply in so far as compliance with the duty would—
(a) result in a failure by the provider to comply with a duty or prohibition imposed by or under an enactment mentioned in section 105A(4);
(b) prevent the provider from giving effect to a warrant or authorisation that has been issued or given under an enactment mentioned in section 105A(4);
(c) prevent the provider from providing a person with assistance in giving effect to a warrant or authorisation that has been issued or given under an enactment mentioned in section 105A(4); or
(d) prevent the provider from providing a person with assistance in exercising any power conferred by or under prison rules.
(2) In this section—
“prison rules” has the same meaning as in section 105A;
“security duty” means a duty imposed by or under—
section 96C as applied by section 105S; or
any of sections 105A to 105D, 105I to 105K, 105L(6), (7)(c) and (8), 105N(2)(a), 105O and 105V.
105Y Statement of policy on ensuring compliance with security duties
(1) OFCOM must prepare and publish a statement of their general policy with respect to the exercise of their functions under sections 105I and 105M to 105V.
(2) OFCOM may from time to time revise that statement as they think fit.
(3) Where OFCOM make or revise their statement of policy under this section, they must publish that statement or (as the case may be) the revised statement in such manner as they consider appropriate for bringing it to the attention of the persons who, in their opinion, are likely to be affected by it.
(4) In exercising their functions under sections 105I and 105M to 105V OFCOM must have regard to the statement for the time being in force under this section.
(1) As soon as practicable after the end of each reporting period OFCOM must prepare and send to the Secretary of State a report for the period (a “security report”).
(2) A security report must contain such information and advice as OFCOM consider may best serve the purpose mentioned in subsection (3).
(3) The purpose is to assist the Secretary of State in the formulation of policy in relation to the security of public electronic communications networks and public electronic communications services.
(4) A security report must in particular include—
(a) information about the extent to which providers of public electronic communications networks and public electronic communications services have complied during the reporting period with the duties imposed on them by or under sections 105A to 105D, 105I to 105K, 105N(2)(a) and 105O;
(b) information about the extent to which providers of public electronic communications networks and public electronic communications services have acted during the reporting period in accordance with codes of practice issued under section 105E;
(c) information about the security compromises that OFCOM have been informed of during the reporting period under section 105K;
(d) information about the action taken by OFCOM during the reporting period in response to security compromises they have been informed of under section 105K;
(e) information about the extent to which and manner in which OFCOM have exercised the functions conferred on them by sections 105I and 105L to 105V during the reporting period;
(f) information about any particular risks to the security of public electronic communications networks and public electronic communications services of which OFCOM have become aware during the reporting period;
(g) any other information of a kind specified in a direction given by the Secretary of State.
(5) A security report must not include personal data (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).
(6) The Secretary of State may—
(a) publish a security report or any part of it; or
(b) disclose a security report or any part of it to any person or body performing functions of a public nature for the purpose of enabling or assisting the performance of those functions.
(7) In publishing or disclosing a security report or any part of a security report, the Secretary of State must have regard to the need to exclude from publication or disclosure, so far as is practicable, the matters which are confidential in accordance with subsection (8).
(8) A matter is confidential under this subsection if—
(a) it relates to the affairs of a particular body; and
(b) publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that body.
(9) In this section “reporting period” means—
(a) the period of 2 years beginning with the day on which section 11 of the Telecommunications (Security) Act 2021 comes into force; and
(b) each successive period of 12 months.
(1) The Secretary of State may give a direction under this section (“a designated vendor direction”) to a public communications provider.
(2) The Secretary of State may give a designated vendor direction only if the Secretary of State considers that—
(a) the direction is necessary in the interests of national security; and
(b) the requirements imposed by the direction are proportionate to what is sought to be achieved by the direction.
(3) A designated vendor direction may impose requirements on a public communications provider with respect to the use, in connection with a purpose mentioned in subsection (4), of goods, services or facilities supplied, provided or made available by a designated vendor specified in the direction.
(4) The purposes referred to in subsection (3) are—
(a) in the case of a provider of a public electronic communications network, the provision of that network;
(b) in the case of a provider of a public electronic communications service, the provision of that service;
(c) in the case of a person who makes available facilities that are associated facilities by reference to a public electronic communications network or public electronic communications service, the making available of those facilities; or
(d) in the case of a provider of a public electronic communications network or public electronic communications service, enabling persons to make use of that network or service.
(5) A designated vendor direction must specify—
(a) the public communications provider or providers to which the direction is given;
(b) the reasons for the direction;
(c) the time at which the direction comes into force.
(6) The requirement in subsection (5)(b) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the direction would be contrary to the interests of national security.
(7) A public communications provider to which a designated vendor direction is given must comply with the direction.
(8) A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility.
(1) This section makes further provision about the requirements that may be imposed by a designated vendor direction on a public communications provider.
(2) The requirements may include, among other things—
(a) requirements prohibiting or restricting the use of goods, services or facilities supplied, provided or made available by a designated vendor specified in the direction;
(b) requirements prohibiting the installation of such goods or the taking up of such services or facilities;
(c) requirements about removing, disabling or modifying such goods or facilities;
(d) requirements about modifying such services;
(e) requirements about the manner in which such goods, services or facilities may be used.
(3) A requirement in a designated vendor direction may, among other things—
(a) relate to the use of goods, services or facilities in connection with a specified function of—
(i) the public electronic communications network provided by the provider;
(ii) the public electronic communications service provided by the provider; or
(iii) an associated facility made available by the provider that is an associated facility by reference to such a network or service (as the case may be);
(b) relate to the use of goods, services or facilities in a specified part of—
(i) the public electronic communications network provided by the provider;
(ii) the public electronic communications service provided by the provider; or
(iii) an associated facility made available by the provider that is an associated facility by reference to such a network or service (as the case may be).
(4) A requirement in a designated vendor direction may make provision by reference to, among other matters—
(a) the source of goods, services or facilities that are supplied, provided or made available by a designated vendor specified in the direction;
(b) the time at which goods, services or facilities were developed or produced (which may be a time before the passing of the Telecommunications (Security) Act 2021);
(c) the time at which goods, services or facilities were procured by, or supplied, provided or made available to, the public communications provider (which may be a time before the passing of that Act).
(5) A designated vendor direction may impose requirements that apply in specified circumstances (for example where the public communications provider is using goods, services or facilities supplied, provided or made available by one or more other specified persons).
(6) A designated vendor direction may provide for exceptions to a requirement.
(7) A requirement to do a thing must specify the period within which the thing is to be done.
(8) A period specified under subsection (7) must be such period as appears to the Secretary of State to be reasonable.
(9) In this section—
(a) a reference to a facility includes a reference to a facility, element or service that is an associated facility;
(b) “specified” means specified in a designated vendor direction.
105Z3 Consultation about designated vendor directions
(1) Before giving a designated vendor direction, the Secretary of State must consult—
(a) the public communications provider or providers which would be subject to the proposed direction, and
(b) the person or persons who would be specified as a designated vendor or vendors in the proposed direction in accordance with section 105Z1(3),
so far as it is reasonably practicable to do so.
(2) The requirement in subsection (1) does not apply if or to the extent that the Secretary of State considers that consultation would be contrary to the interests of national security.
(1) Where a designated vendor direction is given to a public communications provider, the Secretary of State must send a copy of the direction to the designated vendor or vendors specified in the direction, if or to the extent that it is reasonably practicable to do so.
(2) The requirement in subsection (1) does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the direction to that designated vendor would be contrary to the interests of national security.
(3) The Secretary of State may exclude from the copy of the direction anything the disclosure of which the Secretary of State considers—
(a) would, or would be likely to, prejudice to an unreasonable degree the commercial interests of any person; or
(b) would be contrary to the interests of national security.
105Z5 Variation and revocation of designated vendor directions
(1) The Secretary of State must review a designated vendor direction from time to time.
(2) The Secretary of State may—
(a) vary a designated vendor direction;
(b) revoke a designated vendor direction (whether wholly or in part).
(3) The Secretary of State may vary a designated vendor direction only if—
(a) the Secretary of State considers that the direction as varied is necessary in the interests of national security; and
(b) the Secretary of State considers that the requirements imposed by the direction as varied are proportionate to what is sought to be achieved by the direction.
(4) Before varying a designated vendor direction, the Secretary of State must consult—
(a) the public communications provider or providers which would be subject to the direction as proposed to be varied, and
(b) the person or persons who would be affected as a designated vendor or vendors by the direction as proposed to be varied,
so far as it is reasonably practicable to do so.
(5) The requirement in subsection (4) does not apply if or to extent that the Secretary of State considers that consultation would be contrary to the interests of national security.
105Z6 Notice of variation and revocation of designated vendor directions
(1) The Secretary of State must give notice of a variation of a designated vendor direction under section 105Z5 to the public communications provider or providers subject to the direction as varied.
(2) The notice of variation must specify—
(a) how the direction is varied;
(b) the reasons for the variation;
(c) the time at which the variation, or each of them, comes into force.
(3) The requirement in subsection (2)(b) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.
(4) The Secretary of State must send a copy of the notice of variation to the designated vendor or vendors specified in the direction as varied, if or to the extent that it is reasonably practicable to do so.
(5) The requirement in subsection (4) does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the notice of variation to that designated vendor would be contrary to the interests of national security.
(6) The Secretary of State may exclude from the copy of the notice of variation anything the disclosure of which the Secretary of State considers—
(a) would, or would be likely to, prejudice to an unreasonable degree the commercial interests of the public communications provider or providers subject to the direction as varied; or
(b) would be contrary to the interests of national security.
(7) The Secretary of State must give notice of a revocation of a designated vendor direction under section 105Z5 to the public communications provider or providers subject to the direction as it had effect before the revocation.
(8) The notice of revocation must specify—
(a) the time at which the revocation comes into force;
(b) if the direction is partly revoked, what part of the direction is revoked.
(9) The Secretary of State must send a copy of the notice of revocation to the designated vendor or vendors specified in the direction as it had effect before the revocation, if or to the extent that it is reasonably practicable to do so.
(10) The requirement in subsection (9) does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the notice of revocation to that designated vendor would be contrary to the interests of national security.
(11) Where the direction is partly revoked, the Secretary of State may exclude from the copy of the notice of revocation anything the disclosure of which the Secretary of State considers—
(a) would, or would be likely to, prejudice to an unreasonable degree the commercial interests of any person; or
(b) would be contrary to the interests of national security.
105Z7 Designated vendor directions: plans for compliance
(1) This section applies where a designated vendor direction has been given to a public communications provider (and has not been revoked).
(2) The Secretary of State may from time to time require the public communications provider—
(a) to prepare a plan setting out—
(i) the steps that the provider intends to take in order to comply with such requirements imposed by the direction as the Secretary of State may specify; and
(ii) the timing of those steps; and
(b) to provide the plan to the Secretary of State.
(3) The Secretary of State may also require that the plan be provided to OFCOM.
(4) The Secretary of State may specify the period within which a plan required under this section is to be provided to the Secretary of State or OFCOM.
(5) A period specified under subsection (4) must be such period as appears to the Secretary of State to be reasonable.
(1) The Secretary of State may issue a notice (“a designation notice”) designating a person for the purposes of a designated vendor direction.
(2) A designation notice may designate more than one person.
(3) The Secretary of State may issue a designation notice only if the Secretary of State considers that the notice is necessary in the interests of national security.
(4) In considering whether to designate a person, the matters to which the Secretary of State may have regard include—
(a) the nature of the goods, services or facilities that are or might be supplied, provided or made available by the person;
(b) the quality, reliability and security of those goods, services or facilities or any component of them (including the quality, reliability and security of their development or production or of the manner in which they are supplied, provided or made available);
(c) the reliability of the supply of those goods, services or facilities;
(d) the quality and reliability of the provision of maintenance or support for those goods, services or facilities;
(e) the extent to which and the manner in which goods, services or facilities supplied, provided or made available by the person are or might be used in the United Kingdom;
(f) the extent to which and the manner in which goods, services or facilities supplied, provided or made available by the person are or might be used in other countries or territories;
(g) the identity of the persons concerned in—
(i) the development or production of goods, services or facilities supplied, provided or made available by the person or any component of them;
(ii) supplying or providing such goods or services or making such facilities available; or
(iii) providing maintenance or support for such goods, services or facilities;
(h) the identity of the persons who own or control, or are associated with—
(i) the person being considered for designation; or
(ii) any person described in paragraph (g);
(i) the country or territory in which the registered office or anything similar, or any place of business, of—
(i) the person being considered for designation, or
(ii) any of the persons described in paragraph (g) or (h),
is situated;
(j) the conduct of any of the persons described in paragraph (i) as it affects or might affect the national security of any country or territory;
(k) any other connection between a country or territory and any of those persons;
(l) the degree to which any of those persons might be susceptible to being influenced or required to act contrary to the interests of national security.
(5) A designation notice must specify the reasons for the designation.
(6) The requirement in subsection (5) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.
(7) A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility.
(1) Before issuing a designation notice, the Secretary of State must consult the person or persons proposed to be designated in the notice, so far as it is reasonably practicable to do so.
(2) The requirement in subsection (1) does not apply if or to the extent that the Secretary of State considers that consultation would be contrary to the interests of national security.
(3) Where a designation notice is issued, the Secretary of State must send a copy to the person or persons designated in the notice, if or to the extent that it is reasonably practicable to do so.
105Z10 Variation and revocation of designation notices
(1) The Secretary of State must review a designation notice from time to time.
(2) The Secretary of State may—
(a) vary a designation notice;
(b) revoke a designation notice (whether wholly or in part).
(3) The Secretary of State may vary a designation notice only if the Secretary of State considers that the designation notice as varied is necessary in the interests of national security.
(4) Before varying a designation notice, the Secretary of State must consult the person, or each of the persons, proposed to be designated in the notice as varied, so far as it is reasonably practicable to do so.
(5) The requirement in subsection (4) does not apply if or to the extent that the Secretary of State considers that consultation would be contrary to the interests of national security.
(6) The Secretary of State must give notice of a variation to—
(a) any person designated by the designation notice as it had effect before the variation, and
(b) any person designated by the designation notice as varied,
if or to the extent that it is reasonably practicable to do so.
(7) The notice of variation must specify—
(a) how the designation notice is varied;
(b) the reasons for the variation;
(c) the time at which the variation, or each of them, comes into force.
(8) The requirement in subsection (7)(b) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.
(9) The Secretary of State must give notice of a revocation to any person designated by the designation notice as it had effect before the revocation, if or to the extent that it is reasonably practicable to do so.
(10) The notice of revocation must specify—
(a) the time at which the revocation comes into force;
(b) if the designation notice is partly revoked, what part of the notice is revoked.
(1) The Secretary of State must lay before Parliament a copy of—
(a) a designated vendor direction;
(b) a designation notice;
(c) a notice of a variation or revocation of a designated vendor direction; and
(d) a notice of a variation or revocation of a designation notice.
(2) The requirement in subsection (1) does not apply if the Secretary of State considers that laying a copy of the direction or notice (as the case may be) before Parliament would be contrary to the interests of national security.
(3) The Secretary of State may exclude from what is laid before Parliament anything the publication of which the Secretary of State considers—
(a) would, or would be likely to, prejudice to an unreasonable degree the commercial interests of any person; or
(b) would be contrary to the interests of national security.
(1) The Secretary of State may give OFCOM a direction (“a monitoring direction”) requiring them—
(a) to obtain information relating to a specified public communications provider’s compliance with a designated vendor direction;
(b) to prepare and send a report to the Secretary of State based on that information; and
(c) to provide to the Secretary of State on request the information on which a report falling within paragraph (b) is based.
(2) The information that OFCOM may be required to obtain under subsection (1)(a) is—
(a) information that would assist the Secretary of State in determining whether the provider has complied, is complying or is preparing to comply with—
(i) the designated vendor direction; or
(ii) a specified requirement imposed by the designated vendor direction;
(b) information about a specified matter which is relevant to compliance with a requirement imposed by the designated vendor direction;
(c) if the provider has been required to provide a plan under section 105Z7, information about whether the provider is acting in accordance with the plan.
(3) A monitoring direction may make provision about—
(a) the form of a report;
(b) the content of a report.
(4) A monitoring direction may, in particular, require a report to include—
(a) OFCOM’s analysis of information gathered by them;
(b) an explanation of their analysis.
(5) A monitoring direction may require OFCOM to give the Secretary of State separate reports on different matters.
(6) A monitoring direction may make provision about the time or times at which OFCOM must report to the Secretary of State, including provision requiring OFCOM to give reports at specified intervals.
(7) OFCOM must exercise their powers to obtain information in such manner as they consider appropriate for the purposes of preparing a report required by a monitoring direction.
(8) The Secretary of State may give OFCOM more than one monitoring direction in relation to a designated vendor direction.
(9) The Secretary of State may vary or revoke a monitoring direction.
(10) The Secretary of State must consult OFCOM before giving or varying a monitoring direction.
(11) In this section “specified” means specified in a monitoring direction.
(1) The Secretary of State may—
(a) publish a report made by OFCOM in accordance with a monitoring direction or part of it; or
(b) disclose such a report or part of it.
(2) In publishing or disclosing a report made by OFCOM in accordance with a monitoring direction, the Secretary of State must have regard to the need to exclude from publication or disclosure, so far as is practicable, the matters which are confidential in accordance with subsections (3) and (4).
(3) A matter is confidential under this subsection if—
(a) it relates to the affairs of a particular body; and
(b) publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that body.
(4) A matter is confidential under this subsection if—
(a) it relates to the private affairs of an individual; and
(b) publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that individual.
(1) This section applies where the Secretary of State has given OFCOM a monitoring direction relating to a public communications provider (and the monitoring direction has not been revoked).
(2) OFCOM may by notice (“an inspection notice”) given to the provider impose on the provider a duty to take any of the actions mentioned in subsection (4).
(3) OFCOM may exercise the power in subsection (2) for the purpose of obtaining—
(a) information (in any form) that would assist the Secretary of State in determining whether the provider has complied or is complying with—
(i) the designated vendor direction; or
(ii) a specified requirement imposed by the designated vendor direction;
(b) information (in any form) about a specified matter which is relevant to whether the provider has complied or is complying with a requirement imposed by the designated vendor direction.
(4) The actions are—
(a) to carry out surveys of a specified description of—
(i) the public electronic communications network provided by the provider;
(ii) the public electronic communications service provided by the provider; or
(iii) the associated facilities made available by the provider that are associated facilities by reference to such a network or service (as the case may be);
(b) to make arrangements of a specified description for another person to carry out surveys of a specified description of the network, service or associated facilities;
(c) to make available for interview a specified number of persons of a specified description who are involved in the provision of the network or service or the making available of the associated facilities (not exceeding the number who are willing to be interviewed);
(d) to permit an authorised person to enter specified premises;
(e) to permit an authorised person to observe any operation taking place on the premises that relates to the network, service or associated facilities;
(f) to direct an authorised person to equipment or other material on the premises that is of a specified description;
(g) to direct an authorised person to documents on the premises that are of a specified description;
(h) to assist an authorised person to view information of a specified description that is capable of being viewed using equipment on the premises;
(i) to comply with a request from an authorised person for a copy of the documents to which the person is directed and the information the person is assisted to view;
(j) to permit an authorised person to inspect or examine the documents, information, equipment or material to which the person is directed or which the person is assisted to view;
(k) to provide an authorised person with an explanation of such documents, information, equipment or material.
(5) An inspection notice may not impose on the provider a duty to permit an authorised person to enter domestic premises.
(6) An inspection notice may not impose on the provider a duty to do anything that would result in—
(a) the disclosure of documents or information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings; or
(b) a disclosure of documents or information that is prohibited by or under an enactment mentioned in section 105A(4).
(7) An inspection notice must, in relation to each duty imposed by the notice, specify the time or times at which, or period or periods within which, the duty must be complied with.
(8) A time or period specified under subsection (7) must not be a time that falls or a period that begins before the end of the period of 28 days beginning with the day on which the inspection notice is given.
(9) In this section—
“authorised person” means an employee of, or person authorised by, OFCOM;
“domestic premises” means premises, or a part of premises, used as a dwelling;
“specified” means specified in an inspection notice.
(1) An inspection notice must provide information about the consequences of failing to comply with a duty imposed by the notice.
(2) An inspection notice may by further notice—
(a) be revoked by OFCOM;
(b) be varied by OFCOM so as to make it less onerous.
(3) Where an inspection notice is given to a public communications provider, the provider may not act in such a way as to defeat the purpose of the inspection notice.
(4) Where an inspection notice is given to a public communications provider, the provider must pay the costs reasonably incurred by OFCOM in connection with obtaining information by means of the inspection notice.
105Z16 Inspection notices: information about entering premises
Every report under paragraph 12 of the Schedule to the Office of Communications Act 2002 (OFCOM’s annual report) must include a statement of the number of occasions during the financial year to which the report relates on which premises have been entered in pursuance of a duty imposed under section 105Z14(4)(d).
105Z17 Inspection notices: enforcement of compliance
(1) Sections 96A to 100, 102 and 103 apply in relation to—
(a) a contravention of a duty imposed by an inspection notice, or
(b) a contravention of the duty imposed by section 105Z15(3),
as they apply in relation to a contravention of a condition set under section 45, other than an SMP apparatus condition.
(2) Subsection (1) is subject to subsections (3) and (4).
(3) In its application in relation to a contravention referred to in subsection (1), section 96B(5) has effect as if the maximum penalty specified were £50,000 per day.
(4) In its application in relation to a contravention referred to in subsection (1), section 97(1) has effect as if the maximum penalty specified were £10 million.
(5) The Secretary of State may by regulations amend this section so as to substitute a different amount for the amount for the time being specified in subsection (3) or (4).
(6) No regulations are to be made containing provision authorised by subsection (5) unless a draft of the instrument has been laid before Parliament and approved by a resolution of each House.
(1) Where the Secretary of State determines that there are reasonable grounds for believing that a public communications provider is contravening, or has contravened—
(a) a requirement imposed by a designated vendor direction, or
(b) a requirement under section 105Z7,
the Secretary of State may give the provider a notification under this section.
(2) A notification under this section is one which—
(a) sets out the Secretary of State’s determination;
(b) specifies the requirement and contravention in respect of which the determination is made;
(c) specifies the period during which the provider has an opportunity to make representations;
(d) specifies the steps that the Secretary of State thinks should be taken by the provider in order to—
(i) comply with the requirement;
(ii) remedy the consequences of the contravention;
(e) specifies the penalty which the Secretary of State is minded to impose.
(3) A notification under this section may be given in respect of more than one contravention.
(4) If a notification under this section relates to more than one contravention, a separate penalty may be specified under subsection (2)(e) in respect of each contravention.
(5) If a notification under this section is given in respect of a continuing contravention, it may be given in respect of any period during which the contravention has continued.
(6) If a notification under this section relates to a continuing contravention, no more than one penalty may be specified under subsection (2)(e) in respect of the period of contravention specified in the notification.
(7) Notwithstanding subsection (6), in relation to a continuing contravention, a penalty may be specified in respect of each day on which the contravention continues after—
(a) the giving of a confirmation decision under section 105Z20 which requires immediate action in respect of that contravention (see section 105Z20(6)(a)); or
(b) the expiry of any period specified in the confirmation decision for complying with the requirement being contravened.
(8) Where a notification under this section has been given to a public communications provider in respect of a contravention of a requirement, the Secretary of State may give a further notification in respect of the same contravention of that requirement if, and only if—
(a) the contravention is one occurring after the time of the giving of the earlier notification;
(b) the contravention is a continuing contravention and the subsequent notification is in respect of so much of a period as falls after a period to which the earlier notification relates; or
(c) the earlier notification has been withdrawn without a penalty having been imposed in respect of the notified contravention.
(1) The amount of a penalty that may be specified in a notification under section 105Z18 is such amount as the Secretary of State determines to be—
(a) appropriate; and
(b) proportionate to the contravention in respect of which it is imposed.
(2) The amount may not exceed 10 per cent of the turnover of the public communications provider’s relevant business for the relevant period, subject to subsection (3).
(3) In the case of a penalty specified under section 105Z18(7), the amount may not exceed £100,000 per day.
(4) Where the notification relates to a contravention of a requirement under section 105Z7—
(a) subsection (2) has effect as if the maximum amount specified were £10 million; and
(b) subsection (3) has effect as if the maximum amount specified were £50,000 per day.
(5) The Secretary of State may by regulations amend this section so as to substitute a different maximum penalty for the maximum penalty for the time being specified in subsection (3) or (4)(a) or (b).
(6) No regulations are to be made containing provision authorised by subsection (5) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.
(7) For the purposes of this section—
(a) the turnover of a person’s relevant business for a period is to be calculated in accordance with such rules as may be set out in an order under section 97(3)(a); and
(b) what is to be treated as the network, service, facility or business by reference to which the calculation of that turnover falls to be made is to be determined in accordance with such provision as may be made by an order under section 97(3)(a).
(8) In this section—
“relevant business”, in relation to a person, means (subject to the provisions of an order under section 97(3)(a)) so much of any business carried on by the person as consists in any one or more of the following—
the provision of a public electronic communications network;
the provision of a public electronic communications service;
the making available of facilities that are associated facilities by reference to such a network or service;
“relevant period”, in relation to a contravention by a person of a requirement imposed by a designated vendor direction, means—
except in a case falling within paragraph (b) or (c), the period of one year ending with the 31st March next before the time when notification of the contravention was given under section 105Z18;
in the case of a person who at that time has been carrying on that business for a period of less than a year, the period, ending with that time, during which the person has been carrying it on; and
in the case of a person who at that time has ceased to carry on that business, the period of one year ending with the time when the person ceased to carry it on.
(1) This section applies where—
(a) a public communications provider has been given a notification under section 105Z18;
(b) the Secretary of State has allowed the provider an opportunity to make representations about the matters notified; and
(c) the period allowed for the making of representations has expired.
(2) The Secretary of State may—
(a) give the provider a decision (“a confirmation decision”) confirming the imposition of requirements on the provider in accordance with the notification under section 105Z18; or
(b) inform the provider that no further action will be taken.
(3) The Secretary of State may not give the provider a confirmation decision unless, after considering any representations, the Secretary of State is satisfied that the provider has, in one or more of the ways specified in the notification under section 105Z18, contravened—
(a) a requirement imposed by a designated vendor direction, or
(b) a requirement imposed under section 105Z7,
specified in the notification under section 105Z18.
(4) A confirmation decision must be given to the provider without delay.
(5) A confirmation decision must include reasons for the decision.
(6) A confirmation decision may—
(a) require immediate action by the provider—
(i) to comply with the requirement specified in the notification under section 105Z18, and
(ii) to remedy the consequences of the contravention, or
(b) specify a period within which the provider must comply with that requirement and remedy those consequences,
and may specify the steps to be taken by the provider in order to comply with that requirement or remedy those consequences.
(7) A confirmation decision may require the provider to pay—
(a) the penalty specified in the notification under section 105Z18, or
(b) such lesser penalty as the Secretary of State considers appropriate in the light of—
(i) any representations made by the provider, and
(ii) any steps taken by the provider to comply with the requirement specified in the notification under section 105Z18 or to remedy the consequences of the contravention,
and may specify the period within which the penalty is to be paid.
(8) It is the duty of the provider to comply with any requirement imposed by a confirmation decision.
(9) The Secretary of State may enforce the provider’s duty in civil proceedings—
(a) for an injunction;
(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or
(c) for any other appropriate remedy or relief.
(1) This section applies where a sum is payable to the Secretary of State as a penalty under section 105Z20.
(2) In England and Wales, the penalty is recoverable as if it were payable under an order of the county court.
(3) In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.
(4) In Northern Ireland, the penalty is recoverable as if it were payable under an order of a county court in Northern Ireland.
(5) Where action is taken under this section for the recovery of a sum payable as a penalty under section 105Z20, the penalty is—
(a) in relation to England and Wales, to be treated for the purposes of section 98 of the Courts Act 2003 (register of judgments and orders etc) as if it were a judgment entered in the county court;
(b) in relation to Northern Ireland, to be treated for the purposes of Article 116 of the Judgments Enforcement (Northern Ireland) Order 1981 (S.I. 1981/226 (N.I. 6)) (register of judgments) as if it were a judgment in respect of which an application has been accepted under Article 22 or 23(1) of that Order.
(1) The Secretary of State may give a direction under this section (“an urgent enforcement direction”) to a person if the Secretary of State determines that—
(a) there are reasonable grounds for believing that the person is contravening, or has contravened—
(i) a requirement imposed by a designated vendor direction; or
(ii) a requirement not to disclose imposed under section 105Z25;
(b) there are reasonable grounds for suspecting that the case is an urgent case; and
(c) the urgency of the case makes it appropriate for the Secretary of State to take action under this section.
(2) A case is an urgent case for the purposes of this section if the contravention has resulted in, or creates an immediate risk of—
(a) a serious threat to national security; or
(b) significant harm to the security of a public electronic communications network, a public electronic communications service or a facility that is an associated facility by reference to such a network or service.
(3) An urgent enforcement direction must—
(a) specify the requirement and contravention in respect of which it is given;
(b) require the person to take such steps falling within subsection (4) as are specified in the direction;
(c) specify a period within which those steps must be taken; and
(d) specify the Secretary of State’s reasons for giving the direction.
(4) The steps falling within this subsection are the steps that the Secretary of State has determined are appropriate—
(a) for complying with the requirement; or
(b) for remedying the consequences of the contravention.
(5) The requirement in subsection (3)(d) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the direction would be contrary to the interests of national security.
(1) As soon as reasonably practicable after giving an urgent enforcement direction, the Secretary of State must—
(a) confirm the direction; or
(b) revoke the direction (see section 105Z24).
(2) The Secretary of State may confirm an urgent enforcement direction with or without modifications.
(3) The Secretary of State may confirm an urgent enforcement direction only if the Secretary of State has determined that—
(a) the person is contravening, or has contravened—
(i) a requirement imposed by a designated vendor direction; or
(ii) a requirement not to disclose imposed under section 105Z25;
(b) the contravention has resulted in, or creates an immediate risk of, a threat or harm described in section 105Z22(2)(a) or (b); and
(c) it is appropriate to confirm the urgent enforcement direction, with any modifications, to prevent, reduce or remove that threat or harm or immediate risk.
(4) Before confirming an urgent enforcement direction, the Secretary of State must—
(a) give notice to the person to whom the direction was given that the Secretary of State proposes to confirm the direction; and
(b) give the person—
(i) an opportunity of making representations about the grounds on which it was given and its effect; and
(ii) an opportunity of proposing steps to remedy the situation.
(5) The notice under subsection (4)(a) must—
(a) state that the Secretary of State proposes to confirm the direction;
(b) specify any proposed modifications of the direction;
(c) specify the Secretary of State’s reasons for confirming the direction and for any modifications; and
(d) specify a reasonable period for making representations.
(6) The requirement in subsection (5)(c) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.
(7) As soon as reasonably practicable after determining whether to confirm the direction, the Secretary of State must by notice inform the person to whom it was given of the determination.
(1) A person who is given an urgent enforcement direction must comply with it, whether or not it has been confirmed (unless it is revoked).
(2) The duty is enforceable in civil proceedings by the Secretary of State—
(a) for an injunction;
(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or
(c) for any other appropriate remedy or relief.