Trade Union and Labour Relations (Consolidation) Act 1992

Schedule A1A Certain requirements relating to electronic voting and hybrid voting

Sections 51B, 51C, 72M, 72N, 100DA, 100DB, 230A and 230B Part 1 Electronic voting and hybrid voting Application 1 This Part sets out requirements that apply in relation to electronic voting and hybrid voting in relation to a particular ballot. Voting access method and electronic voting instructions 2 (1) One or more voting access methods must be generated for each relevant person. (2) A voting access method must— (a) be unique, (b) be designed in a way which is resistant to attempts to infer or create other voting access methods, (c) be capable of being re-issued, and (d) become ineffective— (i) once the person to whom it was issued has submitted an electronic voting form for the ballot, or (ii) if the person does not vote, at the closure of the ballot. (3) Instructions for how to submit a vote on the electronic voting platform using the voting access method (“electronic voting instructions”) must be produced. (4) The electronic voting instructions must— (a) state the name of the scrutineer for the ballot, and (b) specify the date by which the electronic voting form must be submitted. (5) In this paragraph, “voting access method” means a code, password or other method which allows a person to access the electronic voting platform. Electronic voting form 3 (1) A voting form which is accessed through the electronic voting platform using the voting access method (“electronic voting form”) must be produced. (2) The electronic voting form must allow the person voting to spoil the form by registering a vote for none of the candidates or, as the case may be, options. (3) The electronic voting form must— (a) state the name of the scrutineer for the ballot, and (b) specify the date by which the form must be submitted. (4) In the case of a ballot under section 226(1)(a) (industrial action), subsections (2) to (4) of section 229 (voting paper) apply to the electronic voting form as if for “voting paper” there were substituted “electronic voting form”. (5) Where a person is— (a) eligible to vote in a ballot by electronic voting and another means of voting, or (b) eligible to vote in a ballot by hybrid voting, the person’s electronic voting form must include the provision which was required to be sent with the voting materials under section 51ZA(2)(c), section 72I(2)(c), section 100CA(2)(c) or section 228C(2)(c). (6) The electronic voting form and electronic voting platform must be designed so that data transmitted by submission of an electronic voting form is encrypted before being transmitted and is decrypted only once received by the scrutineer. (7) The electronic voting platform must, when an electronic voting form has been submitted, display to the person who submitted it a message confirming that the vote has been successfully submitted. Unique identifier 4 A unique identifier must be— (a) generated for each relevant person; (b) designed in such a way that by itself it does not enable the identification of the person with whom it is associated. Electronic voting platform 5 (1) The electronic voting platform used for the ballot must be compatible with assistive technologies. (2) In this paragraph “assistive technology” means hardware or software which enables persons with disabilities to interact with, or assists such persons with interacting with, content on the internet. Requirements relating to security 6 (1) In relation to the electronic voting system, the scrutineer must— (a) ensure that the system complies with the security requirements, and (b) take such measures as are appropriate for achieving the security standards. (2) The security requirements are— (a) that a person cannot access— (i) the electronic voting platform without a voting access method or the scrutineer’s authorisation; (ii) any other aspect of the electronic voting system without the scrutineer’s authorisation; (b) that a person who is authorised to access the electronic voting system can only access the system so far as is necessary for the person’s role in relation to the ballot; (c) that a person cannot modify data stored as part of the electronic voting system without the scrutineer’s authorisation; (d) that copies of the data stored as part of the electronic voting system are regularly made. (3) The security standards are— (a) that the electronic voting system is equipped with up-to-date software which protects against malware; (b) that the electronic voting system is resistant to commonly-used methods for breaking encryption or forcing access to the system; (c) that the electronic voting system is operating throughout the duration of the ballot. (4) Throughout the duration of the ballot— (a) the scrutineer must ensure that the electronic voting system is monitored for instances of— (i) unauthorised access; (ii) unauthorised modification of data; (iii) unusual voting patterns; (iv) other security compromises, and (b) any such instances must be recorded by the scrutineer. (5) The scrutineer must ensure that the following requirements are satisfied in relation to the server which hosts the electronic voting platform— (a) the server must be protected at all times by physical security; (b) a person must not be able to access the server without the authorisation of the owner of the server; (c) there must be a timestamped record of physical and digital attempts to access the server. (6) The scrutineer must, throughout the duration of the ballot, ensure that support in relation to the operation of the electronic voting platform is made available for persons who are entitled to vote in the ballot. (7) In this paragraph— “electronic voting system” means— the electronic voting platform, the databases referred to in paragraph 8(3), and any other software which the scrutineer intends to use for the purpose of carrying out the ballot; “malware” means software designed to disrupt, damage, or gain unauthorised access to computer networks and systems. Counting of votes 7 The trade union must ensure that the scrutineer counts the votes cast in the ballot by— (a) submission of an electronic voting form, or (b) marking of a voting paper which was sent to the person in accordance with paragraph 14(1). Processing of information relating to a ballot 8 (1) The scrutineer must store such of the information specified in sub-paragraph (2) as the scrutineer possesses— (a) in secure databases, and (b) in a manner which enables the accurate counting of votes and the calculation of the result of the ballot. (2) The information is— (a) the unique identifiers generated in accordance with paragraph 4, (b) relevant personal information, (c) voting information, and (d) voting access method information. (3) The scrutineer must maintain two separate databases as follows— (a) a database which contains— (i) the unique identifiers generated in accordance with paragraph 4, and (ii) such of the relevant personal information as is necessary for administering the ballot; (b) a database which contains— (i) the unique identifiers generated in accordance with paragraph 4, (ii) such of the voting information as the scrutineer possesses, and (iii) such of the voting access method information as the scrutineer possesses. (4) The scrutineer must not store relevant personal information and voting information together in one database, except where— (a) necessary in response to a request for support under paragraph 6(6); (b) required by a court order; (c) required for the purposes of the investigation of crime or criminal proceedings; (d) required under a request or order made by the Certification Officer; (e) required under another enactment. (5) In this paragraph— “multi-factor authentication” means a method of electronic authentication in which a person is granted access to a database or application only after successfully presenting two or more distinct types of evidence of identity; “personal information” means information relating to a person whose identity— is specified in the information, or can be deduced from it; “relevant personal information” means, in relation to relevant persons— names; email addresses; mobile telephone numbers; home addresses; any other personal information provided to the scrutineer by the trade union; “secure database” means a database— access to which requires multi-factor authentication, and all data stored in which is encrypted to a standard which provides a reasonable level of protection to ensure its confidentiality, integrity, and availability; “voting access method information” means, in relation to relevant persons— voting access methods; whether a person received their voting access method by email, mobile telephone message, internet message via a qualifying internet messaging service or post; “voting information” means, in relation to relevant persons— votes cast in the ballot; timestamps showing when each electronic voting form was submitted; IP addresses from which electronic voting forms have been submitted; whether a person cast their vote by returning a voting paper or submitting an electronic voting form. Audit logs 9 (1) Logs (“audit logs”) must be maintained in relation to the ballot and must include— (a) a description of the process of setting up the electronic voting platform; (b) a description of the process by which the unique identifiers and voting access methods for the ballot were generated; (c) a description of any instance where a voting access method was re-issued; (d) the electronic voting form; (e) the electronic voting instructions; (f) a description of any alteration made to the electronic voting form or the electronic voting instructions during the ballot; (g) records relating to compliance with the requirements set out in paragraph 6; (h) the duration of the ballot; (i) a description of complaints made by voters to the scrutineer; (j) the IP address associated with each electronic voting form submitted; (k) the number of people who voted in the ballot; (l) a record of authorised access to the voting platform (including access by means of a voting access method); (m) a description of changes made to permissions to access the databases which the scrutineer is required to maintain under paragraph 8(3); (n) a description of the process by which the result of the ballot was calculated; (o) an account of the availability of the electronic voting system throughout the duration of the ballot, including details of any unplanned instances of the electronic voting system being shut down; (p) a description of security events; (q) a description of attempts to access and edit the audit logs; (r) any other information which the scrutineer considers is relevant to the integrity, confidentiality and accessibility of the ballot. (2) The audit logs must be maintained during the period beginning when the electronic voting platform is set up and ending when the scrutineer sends the scrutineer’s report to the trade union. (3) In this paragraph— “scrutineer’s report” means a report produced in accordance with whichever of the following provisions is applicable to the ballot or election in question— section 52; section 72O; section 100E; section 231B; “security event” means— an attempt by a person to gain unauthorised access to the electronic voting platform; a cyber attack or suspected cyber attack which affects or could have affected the electronic voting platform; other events which have the effect of overwhelming or causing a failure or requiring a shutdown of the electronic voting platform. Retention of audit logs and data 10 The scrutineer must retain the audit logs and data in the databases which the scrutineer is required to maintain under paragraph 8(3)— (a) until the end of the period of one year beginning with the day on which the result of the ballot is announced by the trade union, and (b) if, within that period, any complaint or claim is made in relation to the ballot, until— (i) the Certification Officer or court authorises the scrutineer to dispose of the audit logs and data in those databases, or (ii) the matter is otherwise concluded. Part 2 Electronic voting Application 11 This Part sets out requirements that apply in relation to electronic voting in relation to a particular ballot. Voting 12 (1) The electronic voting materials must be sent to every person who is eligible to vote by electronic voting, by at least one of the following— (a) mobile telephone message; (b) email; (c) internet message via a qualifying internet messaging service. (2) The requirement in sub-paragraph (1), so far as it relates to the electronic voting instructions, may be satisfied by sending a link to the instructions. (3) In the case of a ballot held under section 97(1)(b) (amalgamation) or section 97(2)(b) (transfer of engagements), nothing else is to be included with the message or email sent in accordance with sub-paragraph (1) except— (a) the notice sent under section 99(1), and (b) the provision required to be sent with the voting materials under section 100CA(2)(c). (4) The mobile telephone number or email address to which a voting access method is sent must be one which was provided to the scrutineer under whichever of the following provisions is applicable to the ballot in question— (a) section 49(7A); (b) section 72F(14); (c) section 100A(12A); (d) section 226B(5). (5) Where a person chooses to vote by electronic voting, the person votes by submitting the electronic voting form which they have accessed using the voting access method sent to them. (6) In this paragraph, “electronic voting materials” means— (a) the voting access method, (b) the electronic voting instructions, and (c) in the case of an election held under section 46(1)(a) (elections for certain positions), a list of the candidates at the election. Part 3 Hybrid voting Application 13 This Part sets out requirements that apply in relation to hybrid voting in relation to a particular ballot. Voting: general requirements 14 (1) The hybrid voting materials must be sent, by post, to the relevant address of every person who is eligible to vote by hybrid voting. (2) Where a person chooses to vote by hybrid voting, the person votes by one of the following— (a) marking the voting paper sent to them; (b) submitting the electronic voting form which they have accessed using the voting access method sent to them. (3) Each voting paper must— (a) state the name of the independent scrutineer and clearly specify the address to which, and the date by which, it is to be returned, (b) be given one of a series of consecutive whole numbers, every one of which is used in giving a different number in that series to each voting paper printed or otherwise produced for the purposes of the ballot, and (c) be marked with its number. (4) Voting papers which have been returned to the scrutineer must be stored securely. (5) In this paragraph, “relevant address” means, in respect of a person, their home address or another address which they have requested the trade union in writing to treat as their postal address. Ballots held under section 97(1)(b) or section 97(2)(b): additional requirements 15 In the case of a ballot held under section 97(1)(b) (amalgamation) or section 97(2)(b) (transfer of engagements), the only documents which may be enclosed with the hybrid voting materials are— (a) the notice which, under section 99(1), is to accompany these, and (b) the provision required to be sent with the voting materials under section 100CA(2)(c). Ballots held under section 226(1)(a): additional requirements 16 (1) This paragraph applies in relation to a ballot held under section 226(1)(a) (industrial action). (2) The voting paper must comply with section 229(2) to (4). (3) This sub-paragraph applies to a merchant seaman if the trade union reasonably believes that— (a) the merchant seaman will be employed in a ship either at sea or at a place outside Great Britain at some time in the period during which votes may be cast, and (b) it will be convenient for the merchant seaman to receive the hybrid voting materials and, in relation to the voting paper, to vote while on the ship or while at a place where the ship is rather than in accordance with paragraph 14(1). (4) In the case of a ballot in which merchant seamen to whom sub-paragraph (3) applies are entitled to vote, paragraph 14(3)(a) is to be read as if, for “the address to which, and the date by which, it is to be returned” there were substituted “the address to which it is to be returned or, as appropriate, the ship to which the seamen belong, and the date by which it is to be returned”. (5) A merchant seaman to whom sub-paragraph (3) applies must, if it is reasonably practicable— (a) have the hybrid voting materials made available to them while on the ship or while at a place where the ship is, and (b) in relation to the voting paper, be given an opportunity to vote while on the ship or while at a place where the ship is. (6) In this paragraph, “merchant seaman” has the meaning given in section 232(3). Interpretation 17 In this Part, “hybrid voting materials” means— (a) a voting paper which complies with the requirements of this Part, (b) instructions for the return of the voting paper, (c) a voting access method, (d) electronic voting instructions, and (e) in the case of an election held under section 46(1)(a) (elections for certain positions), a list of the candidates at the election. Part 4 Interpretation 18 In this Schedule— “ballot” includes an election; “electronic voting platform” means the website or software through which the electronic voting form is accessed; “mobile telephone message” means a message comprised of text or media sent via a mobile messaging protocol to a telephone number allocated in accordance with a national or international numbering plan; “qualifying internet messaging service” means an internet messaging service— which requires a unique telephone number for registration, and for which the means of sending a message using the service is to send the message to the unique telephone number associated with a particular account; “relevant person” means a person who is eligible to vote by either or both of the following means of voting— electronic voting; hybrid voting; “unique telephone number” means, in relation to a qualifying internet messaging service, a telephone number which is not associated with any other account registered with the service.