Telecommunications (Security) Act 2021

8 Civil liability for contravention of security duties

After section 105V of the Communications Act 2003 insert—

“105W Civil liability for breach of security duties

(1) A duty imposed by or under any of sections 105A to 105D and 105J on a provider of a public electronic communications network or a public electronic communications service is a duty owed to every person who may be affected by a contravention of the duty.

(2) Subsections (3) and (4) apply where a duty is owed by virtue of subsection (1) to a person.

(3) A breach of the duty that causes that person to sustain loss or damage is actionable at the suit or instance of that person.

(4) An act which—

(a) by inducing a breach of the duty or interfering with its performance, causes that person to sustain loss or damage, and

(b) is done wholly or partly for achieving that result,

is actionable at the suit or instance of that person.

(5) In proceedings brought against a provider of a public electronic communications network or a public electronic communications service by virtue of subsection (3), it is a defence for the provider to show that they took all reasonable steps and exercised all due diligence to avoid contravening the duty in question.

(6) The consent of OFCOM is required for the bringing of proceedings by virtue of this section.

(7) If OFCOM give their consent subject to conditions relating to the conduct of the proceedings, the proceedings are not to be carried on except in compliance with those conditions.”