The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015

Amendment of the Privacy and Electronic Communications (EC Directive) Regulations 2003

2.—(1) The Privacy and Electronic Communications (EC Directive) Regulations 2003(1) are amended follows.

(2) After regulation 16, insert—

“Emergency alerts

16A.— (1) A relevant public communications provider (P) may, for the purpose of providing an emergency alert service, disregard the restrictions on the processing of data relating to users or subscribers set out in paragraph (2) if the conditions set out in paragraph (3) are met.

(2) The restrictions are—

(a) the restrictions on the processing of traffic data under regulations 7(1) and 8(2); and

(b) the restrictions on the processing of location data under regulations 14(2) and 14(5).

(3) The conditions are—

(a) P is notified by a relevant public authority that—

(i) an emergency within the meaning of section 1(1) of the Civil Contingencies Act 2004(2) has occurred, is occurring or is about to occur; and

(ii) it is expedient to use an emergency alert service;

(b) P is directed by the relevant public authority to convey a specified communication over a specified time period to users or subscribers of P’s public electronic communications network whom P considers—

(i) are in one or more specified places in the United Kingdom which is or may be affected by the emergency; or

(ii) have been in a specified place affected by the emergency since the emergency occurred but are no longer in the place; and

(c) P complies with that direction.

(4) P may, for the purpose of testing an emergency alert service, disregard the restrictions on the processing of data relating to users or subscribers set out in paragraph (2) if the conditions set out in paragraph (5) are met.

(5) The conditions are—

(a) P is notified by a Minister of the Crown that, in the Minister’s opinion, it is necessary to test an emergency alert service for the purpose of ensuring that the service is maintained in good working order and is an effective means of communicating with users and subscribers in an emergency;

(b) the Minister gives directions as to how the test is to be conducted; and

(c) P complies with the directions in sub-paragraph (b).

(6) Traffic data or location data which relate to users or subscribers of a public electronic communications network and are processed in accordance with this regulation must, within 7 days of the expiry of the time period specified by the relevant public authority pursuant to paragraph (3)(b) or, as the case may be, within 48 hours of receipt of the Minister’s directions pursuant to paragraph (5)(b), be—

(a) erased; or

(b) (i) in the case of an individual, modified so that they cease to constitute personal data of that user or subscriber; or

(ii) in the case of a corporate subscriber, modified so that they cease to be data that would be personal data if that user or subscriber was an individual.

(7) The processing of traffic data or location data in accordance with this regulation shall be carried out only by P or by a person acting under P’s authority.

(8) For the purposes of this regulation—

(a) “emergency alert service” means a service comprising one or more communications to mobile telecommunications devices over a public electronic communications network to warn, advise or inform users or subscribers in relation to an aspect or effect of an emergency which may affect or have affected them by reason of their location;

(b) “relevant public authority” means—

(i) a Minister of the Crown;

(ii) the Scottish Ministers;

(iii) the Welsh Ministers;

(iv) a Northern Ireland department;

(v) a chief officer of police within the meaning of section 101(1) of the Police Act 1996(3);

(vi) the chief constable of the Police Service of Scotland;

(vii) the chief constable of the Police Service of Northern Ireland;

(viii) the chief constable of the British Transport Police Force;

(ix) the Environment Agency;

(x) the Scottish Environment Protection Agency;

(xi) the Natural Resources Body for Wales;

(c) “relevant public communications provider” means a person who—

(i) provides a public electronic communications network;

(ii) provides cellular mobile electronic communications services; and

(iii) holds a wireless telegraphy licence granted under section 8 of the Wireless Telegraphy Act 2006(4).”.

(3) In paragraph 8A of Schedule 1 for “In section 55A—” substitute “Except where paragraph 8AA applies, in section 55A—”.

(4) After paragraph 8A of Schedule 1 insert—

“8AA.   In section 55A, when applied to regulations 19 to 24 of these Regulations—

(a) in subsection (1)—

(i) for “data controller” there shall be substituted “person”;

(ii) in paragraph (a), for “of section 4(4) by the data controller” there shall be substituted “of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003, and”; and

(iii) for paragraphs (b) and (c) there shall be substituted—

“(b) subsection (2) or (3) applies.”;

(b) in subsection (3)—

(i) for “data controller” there shall be substituted “person”; and

(ii) for paragraph (a) substitute—

“(a) knew or ought to have known that there was a risk that the contravention would occur, but”;

(c) subsection (3A) shall be omitted;

(d) in subsection (4), for “data controller” there shall be substituted “person”; and

(e) in subsection (9), the definition of “data controller” shall be omitted.”

(5) After paragraph 8B of Schedule 1 insert—

“8C.   In section 55E, for the words “data controller” in subsection (2), there shall be substituted the word “person”.”

(1)

S.I. 2003/2426, as amended by S.I. 2204/1039, S.I. 2010/22 and S.I. 2011/1208.

(2)

2004 c. 36.

(3)

1996 c. 16.

(4)

2006 c. 36, as amended by S.I. 2011/1210 and other amendments which are not relevant for the purposes of these Regulations.