The Regulation of Premium Rate Services Order 2024
Write the words of this act the way you think they should read. Solon shows your change as a redline against the published text and pins it to that exact text, so it can never be applied to wording you did not see.
Change 1
21 Requirements relating to relevant security testing
(1) No intermediary may carry out a regulated activity, unless the intermediary has completed relevant security testing— (a) within the period of 12 months ending with the day on which any regulated activity begins, and (b) subsequently at annual intervals from the day after which the relevant security testing was most recently completed, for so long as the intermediary carries out the regulated activity. (2) In this article, “relevant security testing” means a process— (a) which is undertaken for the purpose of determining whether the intermediary’s payment platform for relevant operator billing is (in principle) at risk of any security compromises, and (b) the results of which are approved by the generally authorised person (“P”). (3) P may not give an approval for the purposes of paragraph (2)(b), unless P is satisfied that— (a) there is no material risk of security compromises on the intermediary’s payment platform for relevant operator billing, or (b) there is such a risk but that risk is materially reduced by the intermediary having in place measures which, in the reasonable opinion of P, ensure that consumers are adequately protected. (4) The intermediary must keep an up-to-date record of the relevant security testing that it carries out, including details of— (a) the processes for determining risks of security compromises, (b) any risks and measures identified for the purposes of paragraph (3)(b), and (c) the approval given for the purposes of paragraph (2)(b). (5) As soon as reasonably practicable after completing the relevant security testing, the intermediary must provide a record of that testing to the relevant network operator. (6) Where, on receipt of that record, a relevant network operator reasonably believes that— (a) there is a risk of a security compromise, and (b) no measures could be put in place which would ensure that consumers are adequately protected, the relevant network operator must immediately notify the intermediary of that belief. (7) Where a relevant network operator has given a notification under paragraph (6), the relevant network operator and the intermediary must not do anything that would (if done) contribute to the carrying out of the regulated activity affected by the risk of a security compromise. (8) In this article— “connected security compromise” means anything referred to in sub-paragraphs (a) to (f) of the definition of “security compromise” which occurs in relation to another person’s payment platform, and references to the intermediary in sub-paragraphs (d) and (f) of that definition are to be read accordingly; “generally authorised person” has the meaning given in article 10(1)(b); “operator billing” means the process for imposing charges made by a person providing a mobile phone service for a consumer’s use of that service; “payment platform” has the meaning given in article 18(4); “relevant network operator” means a network operator in respect of which the intermediary has entered into arrangements for the purposes of carrying out a regulated activity; “relevant operator billing” means operator billing in respect of a controlled PRS provided by means of an internet access service; “security compromise”, in relation to a payment platform, means— anything that compromises the availability, performance or functionality of the payment platform, any unauthorised access to, interference with or exploitation of the payment platform, or anything that enables such access, interference or exploitation, for whatever reason, anything that compromises the confidentiality of signals conveyed by means of the payment platform, anything that causes signals conveyed by means of the payment platform to be lost, unintentionally altered or altered otherwise than by or with the permission of the intermediary, anything that occurs in connection with the payment platform and compromises the confidentiality of any data stored by electronic means, anything that occurs in connection with the payment platform and causes any data stored by electronic means to be lost, unintentionally altered or altered otherwise than by or with the permission of the intermediary, or anything that occurs in connection with the payment platform and causes a connected security compromise.
21 Requirements relating to relevant security testing
(1) No intermediary may carry out a regulated activity, unless the intermediary has completed relevant security testing— (a) within the period of 12 months ending with the day on which any regulated activity begins, and (b) subsequently at annual intervals from the day after which the relevant security testing was most recently completed, for so long as the intermediary carries out the regulated activity. (2) In this article, “relevant security testing” means a process— (a) which is undertaken for the purpose of determining whether the intermediary’s payment platform for relevant operator billing is (in principle) at risk of any security compromises, and (b) the results of which are approved by the generally authorised person (“P”). (3) P may not give an approval for the purposes of paragraph (2)(b), unless P is satisfied that— (a) there is no material risk of security compromises on the intermediary’s payment platform for relevant operator billing, or (b) there is such a risk but that risk is materially reduced by the intermediary having in place measures which, in the reasonable opinion of P, ensure that consumers are adequately protected. (4) The intermediary must keep an up-to-date record of the relevant security testing that it carries out, including details of— (a) the processes for determining risks of security compromises, (b) any risks and measures identified for the purposes of paragraph (3)(b), and (c) the approval given for the purposes of paragraph (2)(b). (5) As soon as reasonably practicable after completing the relevant security testing, the intermediary must provide a record of that testing to the relevant network operator. (6) Where, on receipt of that record, a relevant network operator reasonably believes that— (a) there is a risk of a security compromise, and (b) no measures could be put in place which would ensure that consumers are adequately protected, the relevant network operator must immediately notify the intermediary of that belief. (7) Where a relevant network operator has given a notification under paragraph (6), the relevant network operator and the intermediary must not do anything that would (if done) contribute to the carrying out of the regulated activity affected by the risk of a security compromise. (8) In this article— “connected security compromise” means anything referred to in sub-paragraphs (a) to (f) of the definition of “security compromise” which occurs in relation to another person’s payment platform, and references to the intermediary in sub-paragraphs (d) and (f) of that definition are to be read accordingly; “generally authorised person” has the meaning given in article 10(1)(b); “operator billing” means the process for imposing charges made by a person providing a mobile phone service for a consumer’s use of that service; “payment platform” has the meaning given in article 18(4); “relevant network operator” means a network operator in respect of which the intermediary has entered into arrangements for the purposes of carrying out a regulated activity; “relevant operator billing” means operator billing in respect of a controlled PRS provided by means of an internet access service; “security compromise”, in relation to a payment platform, means— anything that compromises the availability, performance or functionality of the payment platform, any unauthorised access to, interference with or exploitation of the payment platform, or anything that enables such access, interference or exploitation, for whatever reason, anything that compromises the confidentiality of signals conveyed by means of the payment platform, anything that causes signals conveyed by means of the payment platform to be lost, unintentionally altered or altered otherwise than by or with the permission of the intermediary, anything that occurs in connection with the payment platform and compromises the confidentiality of any data stored by electronic means, anything that occurs in connection with the payment platform and causes any data stored by electronic means to be lost, unintentionally altered or altered otherwise than by or with the permission of the intermediary, or anything that occurs in connection with the payment platform and causes a connected security compromise.
One line that says what changes, such as "Halve the dog tax".
Who it helps, what it costs, what it fixes. It is what persuades people to support it.
How this law is officially changed
Solon does not know this law's official route yet. The proposal is recorded all the same, and the route appears here once its source is added.
A proposal here is not law. Support on Solon is evidence that people want the change; the official route says what it takes to make it law.
Sign in to file your proposal. What you have written stays on this page.
Sign in to file itThink it through
Ask what your change would do, who would gain and who would bear a cost, and where something like it is already law. The assistant reads your draft as it stands, cites the law and the studies it finds, and takes no side. What you file stays yours.