The Cyber (Sanctions) (EU Exit) Regulations 2020

PART 1 U.K. General

Citation and commencement U.K.

1.—(1) These Regulations may be cited as the Cyber (Sanctions) (EU Exit) Regulations 2020.

(2) These Regulations come into force in accordance with regulations made by the Secretary of State under section 56 of the Act.

Commencement Information

I1 Reg. 1 not in force at made date, see reg. 1(2)

I2 Reg. 1 in force at 14.12.2020 by S.I. 2020/1514, reg. 6(1)

Interpretation U.K.

2.  In these Regulations—

“the Act” means the Sanctions and Anti-Money Laundering Act 2018;

“arrangement” includes any agreement, understanding, scheme, transaction or series of transactions, whether or not legally enforceable (but see paragraph 12 of Schedule 1 for the meaning of that term in that Schedule);

“conduct” includes acts and omissions;

“document” includes information recorded in any form and, in relation to information recorded otherwise than in legible form, references to its production include producing a copy of the information in legible form;

“the EU Cyber Regulation” means Council Regulation (EU) 2019/796 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States M1 , as it has effect in EU law;

“relevant cyber activity” has the meaning given by regulation 4(2);

“technical assistance” means the provision of technical support or any other technical service;

“Treasury licence” means a licence under regulation 20(1);

“United Kingdom person” has the same meaning as in section 21 of the Act.

Commencement Information

I3 Reg. 2 not in force at made date, see reg. 1(2)

I4 Reg. 2 in force at 14.12.2020 by S.I. 2020/1514, reg. 6(1)

Marginal Citations

M1 OJ No. L 129, 17.5.2019, p.1.

Application of prohibitions and requirements outside the United Kingdom U.K.

3.—(1) A United Kingdom person may contravene a relevant prohibition by conduct wholly or partly outside the United Kingdom.

(2) Any person may contravene a relevant prohibition by conduct in the territorial sea.

(3) For the purposes of this regulation, a “relevant prohibition” means any prohibition imposed by—

(a) regulation 9(2) (confidential information),

(b) Part 3 (Finance), or

(c) a condition of a Treasury licence.

(4) A United Kingdom person may comply, or fail to comply, with a relevant requirement by conduct wholly or partly outside the United Kingdom.

(5) Any person may comply, or fail to comply, with a relevant requirement by conduct in the territorial sea.

(6) In this regulation a “relevant requirement” means any requirement imposed—

(a) by or under Part 6 (Information and records), or by reason of a request made under a power conferred by that Part, or

(b) by a condition of a Treasury licence.

(7) Nothing in this regulation is to be taken to prevent a relevant prohibition or a relevant requirement from applying to conduct (by any person) in the United Kingdom.

Commencement Information

I5 Reg. 3 not in force at made date, see reg. 1(2)

I6 Reg. 3 in force at 31.12.2020 by S.I. 2020/1514, reg. 6(2)

Purpose U.K.

4.—(1) The purpose of the regulations contained in this instrument that are made under section 1 of the Act is to further the prevention of relevant cyber activity.

(2) For the purpose of paragraph (1), “relevant cyber activity” means an activity falling within paragraph (3) which—

(a) undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country M2 other than the United Kingdom,

(b) directly or indirectly causes, or is intended to cause, economic loss to, or prejudice to the commercial interests of, those affected by the activity,

(c) undermines, or is intended to undermine, the independence or effective functioning of—

(i) an international organisation, or

(ii) a non-governmental organisation or forum whose mandate or purposes relate to the governance of international sport or the Internet, or

(d) otherwise affects a significant number of persons in an indiscriminate manner.

(3) The following activity falls within this paragraph—

(a) accessing, or attempting to access, an information system,

(b) carrying out, or attempting to carry out, information system interference, or

(c) carrying out, or attempting to carry out, data interference, except where—

(i) the owner or other right holder of the information system or part of it has consented to such action,

(ii) there is a lawful defence to such action, or

(iii) such action is otherwise permitted under the law of the United Kingdom.

(4) For the purpose of paragraphs (2) and (3)—

“data interference”, in relation to digital data on an information system, means—

(a)

deleting, damaging, deteriorating, altering or suppressing that data,

(b)

rendering that data inaccessible, or

(c)

stealing that data or otherwise stealing funds, economic resources or intellectual property related to such data;

“information system” includes—

(a)

a device or group of interconnected or related devices, one or more of which, pursuant to a programme, automatically processes digital data;

(b)

digital data stored, processed, retrieved or transmitted by such a device or group of devices for the purposes of its or their operation, use, protection or maintenance;

“information system interference” means hindering or interrupting the functioning of an information system by—

(a)

inputting digital data,

(b)

transmitting, damaging, deleting, deteriorating, altering or suppressing such data, or

(c)

rendering such data inaccessible;

“integrity”, in respect of a country (whether the United Kingdom or a country other than the United Kingdom), includes—

(a)

the exercise of governmental functions of that country;

(b)

the exercise of parliamentary functions in that country;

(c)

the functioning of bodies, organisations or institutions involved in public elections or the voting process;

(d)

the operation of the criminal or civil justice system in that country;

(e)

the provision of essential services to the population, including banking, education, energy, healthcare, sewerage, transport or water;

(f)

the operation of critical national infrastructure;

“international organisation” means an organisation and its subordinate bodies governed by international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

“prosperity”, in respect of a country (whether the United Kingdom or a country other than the United Kingdom), includes the effective functioning of the economy, or part of it, of that country.

Commencement Information

I7 Reg. 4 not in force at made date, see reg. 1(2)

I8 Reg. 4 in force at 14.12.2020 by S.I. 2020/1514, reg. 6(1)

Marginal Citations

M2 Section 62(1) of the Sanctions and Anti-Money Laundering Act 2018 defines a “country” as including any territory, region or other place.