Telecommunications (Security) Act 2021

6 Powers of OFCOM to assess compliance with security duties U.K.

(1) The Communications Act 2003 is amended as follows.

(2) After section 105M insert—

“105N Power of OFCOM to assess compliance with security duties

(1) OFCOM may carry out, or arrange for another person to carry out, an assessment of whether the provider of a public electronic communications network or a public electronic communications service is complying or has complied with a duty imposed on the provider by or under any of sections 105A to 105D, 105J and 105K.

(2) Where an assessment under this section is carried out, the provider of the network or service concerned must—

(a) co-operate with the assessment; and

(b) pay the costs reasonably incurred by OFCOM in connection with the assessment.

105O Power of OFCOM to give assessment notices

(1) This section applies for the purposes of an assessment under section 105N in respect of the provider of a public electronic communications network or a public electronic communications service.

(2) OFCOM may by notice (“an assessment notice”) impose on the provider a duty to do any of the following things—

(a) carry out specified tests or tests of a specified description in relation to the network or service;

(b) make arrangements of a specified description for another person to carry out specified tests or tests of a specified description in relation to the network or service;

(c) make available for interview a specified number of persons of a specified description who are involved in the provision of the network or service (not exceeding the number who are willing to be interviewed);

(d) permit an authorised person to enter specified premises;

(e) permit an authorised person to observe any operation taking place on the premises that relates to the network or service;

(f) direct an authorised person to equipment or other material on the premises that is of a specified description;

(g) direct an authorised person to documents on the premises that are of a specified description;

(h) assist an authorised person to view information of a specified description that is capable of being viewed using equipment on the premises;

(i) comply with a request from an authorised person for a copy of the documents to which the person is directed and the information the person is assisted to view;

(j) permit an authorised person to inspect or examine the documents, information, equipment or material to which the person is directed or which the person is assisted to view;

(k) provide an authorised person with an explanation of such documents, information, equipment or material.

(3) The references in subsection (2)(a) and (b) to tests in relation to the network or service include references to—

(a) tests in relation to premises used in connection with the provision of the network or service;

(b) tests in relation to persons involved in the provision of the network or service.

(4) An assessment notice may impose on the provider a duty to carry out, or to make arrangements for another person to carry out, a test in relation to the network or service that risks causing a security compromise, loss to a person or damage to property only if the test consists of the use of techniques that might be expected to be used by a person seeking to cause a security compromise.

(5) An assessment notice may not impose on the provider a duty to permit an authorised person to enter domestic premises.

(6) An assessment notice may not impose on the provider a duty to do anything that would result in the disclosure of documents or information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings.

(7) An assessment notice must, in relation to each duty imposed by the notice, specify the time or times at which, or period or periods within which, the duty must be complied with.

(8) A time or period specified under subsection (7) must not be a time that falls or a period that begins before the end of the period within which an appeal under section 192 can be brought in respect of the assessment notice (ignoring any power to extend the period within which an appeal could be brought).

(9) If an appeal under section 192 is brought in respect of an assessment notice or any provision of an assessment notice, the provider need not comply with any duty imposed by the notice or the provision pending the determination or withdrawal of the appeal.

(10) An assessment notice must provide information about—

(a) the consequences of failing to comply with a duty imposed by the notice; and

(b) the right of appeal in respect of the notice under section 192.

(11) An assessment notice may by further notice—

(a) be revoked by OFCOM;

(b) be varied by OFCOM so as to make it less onerous.

(12) In this section—

• “authorised person” means an employee of, or person authorised by, OFCOM;

• “domestic premises” means premises, or a part of premises, used as a dwelling;

• “specified” means specified in the assessment notice.

105P Assessment notices: urgency statements

(1) This section applies where—

(a) an assessment notice is given under section 105O to the provider of a public electronic communications network or a public electronic communications service;

(b) the notice states that, in OFCOM’s opinion, it is necessary for the provider to comply with a duty imposed by the notice urgently;

(c) the notice gives OFCOM’s reasons for reaching that opinion; and

(d) the notice provides information about the right of the provider to make an application under section 105Q.

(2) Subsections (8) and (9) of section 105O do not apply in relation to the duty mentioned in subsection (1)(b).

(3) A time or period specified under subsection (7) of section 105O in relation to the duty mentioned in subsection (1)(b) must not be a time that falls or a period that begins before the end of the period of 14 days beginning with the day the notice is given.

(4) In a case where—

(a) the duty mentioned in subsection (1)(b) is a duty to do something mentioned in section 105O(2)(d) to (k), and

(b) within the period of 14 days beginning with the day the notice is given an appeal under section 192 is brought in respect of the notice or the provision of the notice that imposes the duty,

the provider of the network or service need not comply with the duty pending the determination or withdrawal of the appeal.

105Q Assessment notices: applications in respect of urgency statements

(1) This section applies where an assessment notice given under section 105O to a provider of a public electronic communications network or a public electronic communications service contains a statement under section 105P(1)(b).

(2) The provider may apply to the court for either or both of the following—

(a) the disapplication of the statement in relation to some or all of the duties imposed by the notice;

(b) a change to the time at which, or period within which, a duty imposed by the notice must be complied with.

(3) On an application under this section, the court may do any of the following—

(a) direct that the notice is to have effect as if it did not contain the statement;

(b) direct that the inclusion of the statement is not to have effect in relation to a duty imposed by the notice;

(c) vary the notice by changing the time at which, or the period within which, a duty imposed by the notice must be complied with;

(d) vary the notice by making other changes required to give effect to a direction under paragraph (a) or (b) or in consequence of a variation under paragraph (c).

(4) The decision of the court on an application under this section is final.

(5) In this section “the court” means the High Court or, in Scotland, the Court of Session.

105R Assessment notices: information about entering premises

Every report under paragraph 12 of the Schedule to the Office of Communications Act 2002 (OFCOM’s annual report) must include a statement of the number of occasions during the financial year to which the report relates on which premises have been entered in pursuance of a duty imposed under section 105O(2)(d).”

(3) In section 135 (information required for purposes of certain OFCOM functions) in subsection (3) (particular purposes for which information may be required) after paragraph (i) insert—

“(iza) carrying out an assessment under section 105N;”.

(4) In Schedule 8 (decisions not subject to appeal) after paragraph 7 insert—

“7A A decision to include a statement under section 105P(1)(b) in an assessment notice under section 105O.”

Commencement Information

I1 S. 6 not in force at Royal Assent, see s. 28

I2 S. 6 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)