Telecommunications (Security) Act 2021

Monitoring and enforcement U.K.

18 Monitoring of designated vendor directions U.K.

(1) The Communications Act 2003 is amended as follows.

(2) After section 105Z11 insert—

“105Z12 Monitoring of designated vendor directions

(1) The Secretary of State may give OFCOM a direction (“a monitoring direction”) requiring them—

(a) to obtain information relating to a specified public communications provider’s compliance with a designated vendor direction;

(b) to prepare and send a report to the Secretary of State based on that information; and

(c) to provide to the Secretary of State on request the information on which a report falling within paragraph (b) is based.

(2) The information that OFCOM may be required to obtain under subsection (1)(a) is—

(a) information that would assist the Secretary of State in determining whether the provider has complied, is complying or is preparing to comply with—

(i) the designated vendor direction; or

(ii) a specified requirement imposed by the designated vendor direction;

(b) information about a specified matter which is relevant to compliance with a requirement imposed by the designated vendor direction;

(c) if the provider has been required to provide a plan under section 105Z7, information about whether the provider is acting in accordance with the plan.

(3) A monitoring direction may make provision about—

(a) the form of a report;

(b) the content of a report.

(4) A monitoring direction may, in particular, require a report to include—

(a) OFCOM’s analysis of information gathered by them;

(b) an explanation of their analysis.

(5) A monitoring direction may require OFCOM to give the Secretary of State separate reports on different matters.

(6) A monitoring direction may make provision about the time or times at which OFCOM must report to the Secretary of State, including provision requiring OFCOM to give reports at specified intervals.

(7) OFCOM must exercise their powers to obtain information in such manner as they consider appropriate for the purposes of preparing a report required by a monitoring direction.

(8) The Secretary of State may give OFCOM more than one monitoring direction in relation to a designated vendor direction.

(9) The Secretary of State may vary or revoke a monitoring direction.

(10) The Secretary of State must consult OFCOM before giving or varying a monitoring direction.

(11) In this section “specified” means specified in a monitoring direction.

105Z13 Reports made under monitoring directions

(1) The Secretary of State may—

(a) publish a report made by OFCOM in accordance with a monitoring direction or part of it; or

(b) disclose such a report or part of it.

(2) In publishing or disclosing a report made by OFCOM in accordance with a monitoring direction, the Secretary of State must have regard to the need to exclude from publication or disclosure, so far as is practicable, the matters which are confidential in accordance with subsections (3) and (4).

(3) A matter is confidential under this subsection if—

(a) it relates to the affairs of a particular body; and

(b) publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that body.

(4) A matter is confidential under this subsection if—

(a) it relates to the private affairs of an individual; and

(b) publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that individual.”

(3) In section 135 (information required for purposes of certain OFCOM functions) in subsection (3) (particular purposes for which information may be required) before paragraph (ia) insert—

“(izd) preparing a report under section 105Z12;”.

(4) In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—

• ““monitoring direction” has the meaning given by section 105Z12;”.

(5) In section 393 (general restrictions on disclosure of information) in subsection (6) (exceptions) before paragraph (ba) insert—

“(bzb) prevents the publication or disclosure of a report or part of a report under section 105Z13(1);”.

(6) In Schedule 8 (decisions not subject to appeal) after paragraph 11 insert—

“11A A decision to require information under section 135, so far as the information is required for the purpose of preparing a report under section 105Z12.”

Commencement Information

I1 S. 18 in force at Royal Assent, see s. 28(1)(c)

19 Monitoring directions: inspection notices U.K.

(1) The Communications Act 2003 is amended as follows.

(2) After section 105Z13 insert—

“105Z14 Power of OFCOM to give inspection notices

(1) This section applies where the Secretary of State has given OFCOM a monitoring direction relating to a public communications provider (and the monitoring direction has not been revoked).

(2) OFCOM may by notice (“an inspection notice”) given to the provider impose on the provider a duty to take any of the actions mentioned in subsection (4).

(3) OFCOM may exercise the power in subsection (2) for the purpose of obtaining—

(a) information (in any form) that would assist the Secretary of State in determining whether the provider has complied or is complying with—

(i) the designated vendor direction; or

(ii) a specified requirement imposed by the designated vendor direction;

(b) information (in any form) about a specified matter which is relevant to whether the provider has complied or is complying with a requirement imposed by the designated vendor direction.

(4) The actions are—

(a) to carry out surveys of a specified description of—

(i) the public electronic communications network provided by the provider;

(ii) the public electronic communications service provided by the provider; or

(iii) the associated facilities made available by the provider that are associated facilities by reference to such a network or service (as the case may be);

(b) to make arrangements of a specified description for another person to carry out surveys of a specified description of the network, service or associated facilities;

(c) to make available for interview a specified number of persons of a specified description who are involved in the provision of the network or service or the making available of the associated facilities (not exceeding the number who are willing to be interviewed);

(d) to permit an authorised person to enter specified premises;

(e) to permit an authorised person to observe any operation taking place on the premises that relates to the network, service or associated facilities;

(f) to direct an authorised person to equipment or other material on the premises that is of a specified description;

(g) to direct an authorised person to documents on the premises that are of a specified description;

(h) to assist an authorised person to view information of a specified description that is capable of being viewed using equipment on the premises;

(i) to comply with a request from an authorised person for a copy of the documents to which the person is directed and the information the person is assisted to view;

(j) to permit an authorised person to inspect or examine the documents, information, equipment or material to which the person is directed or which the person is assisted to view;

(k) to provide an authorised person with an explanation of such documents, information, equipment or material.

(5) An inspection notice may not impose on the provider a duty to permit an authorised person to enter domestic premises.

(6) An inspection notice may not impose on the provider a duty to do anything that would result in—

(a) the disclosure of documents or information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings; or

(b) a disclosure of documents or information that is prohibited by or under an enactment mentioned in section 105A(4).

(7) An inspection notice must, in relation to each duty imposed by the notice, specify the time or times at which, or period or periods within which, the duty must be complied with.

(8) A time or period specified under subsection (7) must not be a time that falls or a period that begins before the end of the period of 28 days beginning with the day on which the inspection notice is given.

(9) In this section—

• “authorised person” means an employee of, or person authorised by, OFCOM;

• “domestic premises” means premises, or a part of premises, used as a dwelling;

• “specified” means specified in an inspection notice.

105Z15 Inspection notices: further provision

(1) An inspection notice must provide information about the consequences of failing to comply with a duty imposed by the notice.

(2) An inspection notice may by further notice—

(a) be revoked by OFCOM;

(b) be varied by OFCOM so as to make it less onerous.

(3) Where an inspection notice is given to a public communications provider, the provider may not act in such a way as to defeat the purpose of the inspection notice.

(4) Where an inspection notice is given to a public communications provider, the provider must pay the costs reasonably incurred by OFCOM in connection with obtaining information by means of the inspection notice.

105Z16 Inspection notices: information about entering premises

Every report under paragraph 12 of the Schedule to the Office of Communications Act 2002 (OFCOM’s annual report) must include a statement of the number of occasions during the financial year to which the report relates on which premises have been entered in pursuance of a duty imposed under section 105Z14(4)(d).

105Z17 Inspection notices: enforcement of compliance

(1) Sections 96A to 100, 102 and 103 apply in relation to—

(a) a contravention of a duty imposed by an inspection notice, or

(b) a contravention of the duty imposed by section 105Z15(3),

as they apply in relation to a contravention of a condition set under section 45, other than an SMP apparatus condition.

(2) Subsection (1) is subject to subsections (3) and (4).

(3) In its application in relation to a contravention referred to in subsection (1), section 96B(5) has effect as if the maximum penalty specified were £50,000 per day.

(4) In its application in relation to a contravention referred to in subsection (1), section 97(1) has effect as if the maximum penalty specified were £10 million.

(5) The Secretary of State may by regulations amend this section so as to substitute a different amount for the amount for the time being specified in subsection (3) or (4).

(6) No regulations are to be made containing provision authorised by subsection (5) unless a draft of the instrument has been laid before Parliament and approved by a resolution of each House.”

(3) In section 113 (suspension of application of the electronic communications code) in subsection (2)(b) (a condition for suspension) at the end of the words in parentheses insert “or 105Z17”.

(4) In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—

• ““inspection notice” has the meaning given by section 105Z14;”.

(5) In Schedule 8 (decisions not subject to appeal) before paragraph 8 insert—

“7D A decision to impose a duty under section 105Z14.”

Commencement Information

I2 S. 19 in force at Royal Assent, see s. 28(1)(c)

20 Power of Secretary of State to enforce compliance with designated vendor directions etc U.K.

After section 105Z17 of the Communications Act 2003 insert—

“105Z18 Notification of contravention

(1) Where the Secretary of State determines that there are reasonable grounds for believing that a public communications provider is contravening, or has contravened—

(a) a requirement imposed by a designated vendor direction, or

(b) a requirement under section 105Z7,

the Secretary of State may give the provider a notification under this section.

(2) A notification under this section is one which—

(a) sets out the Secretary of State’s determination;

(b) specifies the requirement and contravention in respect of which the determination is made;

(c) specifies the period during which the provider has an opportunity to make representations;

(d) specifies the steps that the Secretary of State thinks should be taken by the provider in order to—

(i) comply with the requirement;

(ii) remedy the consequences of the contravention;

(e) specifies the penalty which the Secretary of State is minded to impose.

(3) A notification under this section may be given in respect of more than one contravention.

(4) If a notification under this section relates to more than one contravention, a separate penalty may be specified under subsection (2)(e) in respect of each contravention.

(5) If a notification under this section is given in respect of a continuing contravention, it may be given in respect of any period during which the contravention has continued.

(6) If a notification under this section relates to a continuing contravention, no more than one penalty may be specified under subsection (2)(e) in respect of the period of contravention specified in the notification.

(7) Notwithstanding subsection (6), in relation to a continuing contravention, a penalty may be specified in respect of each day on which the contravention continues after—

(a) the giving of a confirmation decision under section 105Z20 which requires immediate action in respect of that contravention (see section 105Z20(6)(a)); or

(b) the expiry of any period specified in the confirmation decision for complying with the requirement being contravened.

(8) Where a notification under this section has been given to a public communications provider in respect of a contravention of a requirement, the Secretary of State may give a further notification in respect of the same contravention of that requirement if, and only if—

(a) the contravention is one occurring after the time of the giving of the earlier notification;

(b) the contravention is a continuing contravention and the subsequent notification is in respect of so much of a period as falls after a period to which the earlier notification relates; or

(c) the earlier notification has been withdrawn without a penalty having been imposed in respect of the notified contravention.

105Z19 Amount of penalty

(1) The amount of a penalty that may be specified in a notification under section 105Z18 is such amount as the Secretary of State determines to be—

(a) appropriate; and

(b) proportionate to the contravention in respect of which it is imposed.

(2) The amount may not exceed 10 per cent of the turnover of the public communications provider’s relevant business for the relevant period, subject to subsection (3).

(3) In the case of a penalty specified under section 105Z18(7), the amount may not exceed £100,000 per day.

(4) Where the notification relates to a contravention of a requirement under section 105Z7—

(a) subsection (2) has effect as if the maximum amount specified were £10 million; and

(b) subsection (3) has effect as if the maximum amount specified were £50,000 per day.

(5) The Secretary of State may by regulations amend this section so as to substitute a different maximum penalty for the maximum penalty for the time being specified in subsection (3) or (4)(a) or (b).

(6) No regulations are to be made containing provision authorised by subsection (5) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.

(7) For the purposes of this section—

(a) the turnover of a person’s relevant business for a period is to be calculated in accordance with such rules as may be set out in an order under section 97(3)(a); and

(b) what is to be treated as the network, service, facility or business by reference to which the calculation of that turnover falls to be made is to be determined in accordance with such provision as may be made by an order under section 97(3)(a).

(8) In this section—

• “relevant business”, in relation to a person, means (subject to the provisions of an order under section 97(3)(a)) so much of any business carried on by the person as consists in any one or more of the following—

  (a)

  the provision of a public electronic communications network;

  (b)

  the provision of a public electronic communications service;

  (c)

  the making available of facilities that are associated facilities by reference to such a network or service;

• “relevant period”, in relation to a contravention by a person of a requirement imposed by a designated vendor direction, means—

  (a)

  except in a case falling within paragraph (b) or (c), the period of one year ending with the 31st March next before the time when notification of the contravention was given under section 105Z18;

  (b)

  in the case of a person who at that time has been carrying on that business for a period of less than a year, the period, ending with that time, during which the person has been carrying it on; and

  (c)

  in the case of a person who at that time has ceased to carry on that business, the period of one year ending with the time when the person ceased to carry it on.

105Z20 Enforcement of notification

(1) This section applies where—

(a) a public communications provider has been given a notification under section 105Z18;

(b) the Secretary of State has allowed the provider an opportunity to make representations about the matters notified; and

(c) the period allowed for the making of representations has expired.

(2) The Secretary of State may—

(a) give the provider a decision (“a confirmation decision”) confirming the imposition of requirements on the provider in accordance with the notification under section 105Z18; or

(b) inform the provider that no further action will be taken.

(3) The Secretary of State may not give the provider a confirmation decision unless, after considering any representations, the Secretary of State is satisfied that the provider has, in one or more of the ways specified in the notification under section 105Z18, contravened—

(a) a requirement imposed by a designated vendor direction, or

(b) a requirement imposed under section 105Z7,

specified in the notification under section 105Z18.

(4) A confirmation decision must be given to the provider without delay.

(5) A confirmation decision must include reasons for the decision.

(6) A confirmation decision may—

(a) require immediate action by the provider—

(i) to comply with the requirement specified in the notification under section 105Z18, and

(ii) to remedy the consequences of the contravention, or

(b) specify a period within which the provider must comply with that requirement and remedy those consequences,

and may specify the steps to be taken by the provider in order to comply with that requirement or remedy those consequences.

(7) A confirmation decision may require the provider to pay—

(a) the penalty specified in the notification under section 105Z18, or

(b) such lesser penalty as the Secretary of State considers appropriate in the light of—

(i) any representations made by the provider, and

(ii) any steps taken by the provider to comply with the requirement specified in the notification under section 105Z18 or to remedy the consequences of the contravention,

and may specify the period within which the penalty is to be paid.

(8) It is the duty of the provider to comply with any requirement imposed by a confirmation decision.

(9) The Secretary of State may enforce the provider’s duty in civil proceedings—

(a) for an injunction;

(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or

(c) for any other appropriate remedy or relief.

105Z21 Enforcement of penalty

(1) This section applies where a sum is payable to the Secretary of State as a penalty under section 105Z20.

(2) In England and Wales, the penalty is recoverable as if it were payable under an order of the county court.

(3) In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.

(4) In Northern Ireland, the penalty is recoverable as if it were payable under an order of a county court in Northern Ireland.

(5) Where action is taken under this section for the recovery of a sum payable as a penalty under section 105Z20, the penalty is—

(a) in relation to England and Wales, to be treated for the purposes of section 98 of the Courts Act 2003 (register of judgments and orders etc) as if it were a judgment entered in the county court;

(b) in relation to Northern Ireland, to be treated for the purposes of Article 116 of the Judgments Enforcement (Northern Ireland) Order 1981 (S.I. 1981/226 (N.I. 6)) (register of judgments) as if it were a judgment in respect of which an application has been accepted under Article 22 or 23(1) of that Order.”

Commencement Information

I3 S. 20 in force at Royal Assent, see s. 28(1)(c)

21 Urgent enforcement directions U.K.

(1) The Communications Act 2003 is amended as follows.

(2) After section 105Z21 insert—

“105Z22 Urgent enforcement direction

(1) The Secretary of State may give a direction under this section (“an urgent enforcement direction”) to a person if the Secretary of State determines that—

(a) there are reasonable grounds for believing that the person is contravening, or has contravened—

(i) a requirement imposed by a designated vendor direction; or

(ii) a requirement not to disclose imposed under section 105Z25;

(b) there are reasonable grounds for suspecting that the case is an urgent case; and

(c) the urgency of the case makes it appropriate for the Secretary of State to take action under this section.

(2) A case is an urgent case for the purposes of this section if the contravention has resulted in, or creates an immediate risk of—

(a) a serious threat to national security; or

(b) significant harm to the security of a public electronic communications network, a public electronic communications service or a facility that is an associated facility by reference to such a network or service.

(3) An urgent enforcement direction must—

(a) specify the requirement and contravention in respect of which it is given;

(b) require the person to take such steps falling within subsection (4) as are specified in the direction;

(c) specify a period within which those steps must be taken; and

(d) specify the Secretary of State’s reasons for giving the direction.

(4) The steps falling within this subsection are the steps that the Secretary of State has determined are appropriate—

(a) for complying with the requirement; or

(b) for remedying the consequences of the contravention.

(5) The requirement in subsection (3)(d) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the direction would be contrary to the interests of national security.

105Z23 Urgent enforcement direction: confirmation

(1) As soon as reasonably practicable after giving an urgent enforcement direction, the Secretary of State must—

(a) confirm the direction; or

(b) revoke the direction (see section 105Z24).

(2) The Secretary of State may confirm an urgent enforcement direction with or without modifications.

(3) The Secretary of State may confirm an urgent enforcement direction only if the Secretary of State has determined that—

(a) the person is contravening, or has contravened—

(i) a requirement imposed by a designated vendor direction; or

(ii) a requirement not to disclose imposed under section 105Z25;

(b) the contravention has resulted in, or creates an immediate risk of, a threat or harm described in section 105Z22(2)(a) or (b); and

(c) it is appropriate to confirm the urgent enforcement direction, with any modifications, to prevent, reduce or remove that threat or harm or immediate risk.

(4) Before confirming an urgent enforcement direction, the Secretary of State must—

(a) give notice to the person to whom the direction was given that the Secretary of State proposes to confirm the direction; and

(b) give the person—

(i) an opportunity of making representations about the grounds on which it was given and its effect; and

(ii) an opportunity of proposing steps to remedy the situation.

(5) The notice under subsection (4)(a) must—

(a) state that the Secretary of State proposes to confirm the direction;

(b) specify any proposed modifications of the direction;

(c) specify the Secretary of State’s reasons for confirming the direction and for any modifications; and

(d) specify a reasonable period for making representations.

(6) The requirement in subsection (5)(c) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.

(7) As soon as reasonably practicable after determining whether to confirm the direction, the Secretary of State must by notice inform the person to whom it was given of the determination.

105Z24 Urgent enforcement direction: enforcement

(1) A person who is given an urgent enforcement direction must comply with it, whether or not it has been confirmed (unless it is revoked).

(2) The duty is enforceable in civil proceedings by the Secretary of State—

(a) for an injunction;

(b) for specific performance of a statutory duty under section 45 of the Court of Session Act 1988; or

(c) for any other appropriate remedy or relief.”

(3) In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—

• ““urgent enforcement direction” has the meaning given by section 105Z22.”

Commencement Information

I4 S. 21 in force at Royal Assent, see s. 28(1)(c)