Telecommunications (Security) Act 2021

15 Designated vendor directions U.K.

(1) The Communications Act 2003 is amended as follows.

(2) After section 105Z insert—

“Security of public electronic communications networks and services: designated vendor directions U.K.

105Z1 Designated vendor directions

(1) The Secretary of State may give a direction under this section (“a designated vendor direction”) to a public communications provider.

(2) The Secretary of State may give a designated vendor direction only if the Secretary of State considers that—

(a) the direction is necessary in the interests of national security; and

(b) the requirements imposed by the direction are proportionate to what is sought to be achieved by the direction.

(3) A designated vendor direction may impose requirements on a public communications provider with respect to the use, in connection with a purpose mentioned in subsection (4), of goods, services or facilities supplied, provided or made available by a designated vendor specified in the direction.

(4) The purposes referred to in subsection (3) are—

(a) in the case of a provider of a public electronic communications network, the provision of that network;

(b) in the case of a provider of a public electronic communications service, the provision of that service;

(c) in the case of a person who makes available facilities that are associated facilities by reference to a public electronic communications network or public electronic communications service, the making available of those facilities; or

(d) in the case of a provider of a public electronic communications network or public electronic communications service, enabling persons to make use of that network or service.

(5) A designated vendor direction must specify—

(a) the public communications provider or providers to which the direction is given;

(b) the reasons for the direction;

(c) the time at which the direction comes into force.

(6) The requirement in subsection (5)(b) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the direction would be contrary to the interests of national security.

(7) A public communications provider to which a designated vendor direction is given must comply with the direction.

(8) A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility.

105Z2 Further provision about requirements

(1) This section makes further provision about the requirements that may be imposed by a designated vendor direction on a public communications provider.

(2) The requirements may include, among other things—

(a) requirements prohibiting or restricting the use of goods, services or facilities supplied, provided or made available by a designated vendor specified in the direction;

(b) requirements prohibiting the installation of such goods or the taking up of such services or facilities;

(c) requirements about removing, disabling or modifying such goods or facilities;

(d) requirements about modifying such services;

(e) requirements about the manner in which such goods, services or facilities may be used.

(3) A requirement in a designated vendor direction may, among other things—

(a) relate to the use of goods, services or facilities in connection with a specified function of—

(i) the public electronic communications network provided by the provider;

(ii) the public electronic communications service provided by the provider; or

(iii) an associated facility made available by the provider that is an associated facility by reference to such a network or service (as the case may be);

(b) relate to the use of goods, services or facilities in a specified part of—

(i) the public electronic communications network provided by the provider;

(ii) the public electronic communications service provided by the provider; or

(iii) an associated facility made available by the provider that is an associated facility by reference to such a network or service (as the case may be).

(4) A requirement in a designated vendor direction may make provision by reference to, among other matters—

(a) the source of goods, services or facilities that are supplied, provided or made available by a designated vendor specified in the direction;

(b) the time at which goods, services or facilities were developed or produced (which may be a time before the passing of the Telecommunications (Security) Act 2021);

(c) the time at which goods, services or facilities were procured by, or supplied, provided or made available to, the public communications provider (which may be a time before the passing of that Act).

(5) A designated vendor direction may impose requirements that apply in specified circumstances (for example where the public communications provider is using goods, services or facilities supplied, provided or made available by one or more other specified persons).

(6) A designated vendor direction may provide for exceptions to a requirement.

(7) A requirement to do a thing must specify the period within which the thing is to be done.

(8) A period specified under subsection (7) must be such period as appears to the Secretary of State to be reasonable.

(9) In this section—

(a) a reference to a facility includes a reference to a facility, element or service that is an associated facility;

(b) “specified” means specified in a designated vendor direction.

105Z3 Consultation about designated vendor directions

(1) Before giving a designated vendor direction, the Secretary of State must consult—

(a) the public communications provider or providers which would be subject to the proposed direction, and

(b) the person or persons who would be specified as a designated vendor or vendors in the proposed direction in accordance with section 105Z1(3),

so far as it is reasonably practicable to do so.

(2) The requirement in subsection (1) does not apply if or to the extent that the Secretary of State considers that consultation would be contrary to the interests of national security.

105Z4 Notice of designated vendor directions

(1) Where a designated vendor direction is given to a public communications provider, the Secretary of State must send a copy of the direction to the designated vendor or vendors specified in the direction, if or to the extent that it is reasonably practicable to do so.

(2) The requirement in subsection (1) does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the direction to that designated vendor would be contrary to the interests of national security.

(3) The Secretary of State may exclude from the copy of the direction anything the disclosure of which the Secretary of State considers—

(a) would, or would be likely to, prejudice to an unreasonable degree the commercial interests of any person; or

(b) would be contrary to the interests of national security.

105Z5 Variation and revocation of designated vendor directions

(1) The Secretary of State must review a designated vendor direction from time to time.

(2) The Secretary of State may—

(a) vary a designated vendor direction;

(b) revoke a designated vendor direction (whether wholly or in part).

(3) The Secretary of State may vary a designated vendor direction only if—

(a) the Secretary of State considers that the direction as varied is necessary in the interests of national security; and

(b) the Secretary of State considers that the requirements imposed by the direction as varied are proportionate to what is sought to be achieved by the direction.

(4) Before varying a designated vendor direction, the Secretary of State must consult—

(a) the public communications provider or providers which would be subject to the direction as proposed to be varied, and

(b) the person or persons who would be affected as a designated vendor or vendors by the direction as proposed to be varied,

so far as it is reasonably practicable to do so.

(5) The requirement in subsection (4) does not apply if or to extent that the Secretary of State considers that consultation would be contrary to the interests of national security.

105Z6 Notice of variation and revocation of designated vendor directions

(1) The Secretary of State must give notice of a variation of a designated vendor direction under section 105Z5 to the public communications provider or providers subject to the direction as varied.

(2) The notice of variation must specify—

(a) how the direction is varied;

(b) the reasons for the variation;

(c) the time at which the variation, or each of them, comes into force.

(3) The requirement in subsection (2)(b) does not apply if or to the extent that the Secretary of State considers that specifying reasons in the notice would be contrary to the interests of national security.

(4) The Secretary of State must send a copy of the notice of variation to the designated vendor or vendors specified in the direction as varied, if or to the extent that it is reasonably practicable to do so.

(5) The requirement in subsection (4) does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the notice of variation to that designated vendor would be contrary to the interests of national security.

(6) The Secretary of State may exclude from the copy of the notice of variation anything the disclosure of which the Secretary of State considers—

(a) would, or would be likely to, prejudice to an unreasonable degree the commercial interests of the public communications provider or providers subject to the direction as varied; or

(b) would be contrary to the interests of national security.

(7) The Secretary of State must give notice of a revocation of a designated vendor direction under section 105Z5 to the public communications provider or providers subject to the direction as it had effect before the revocation.

(8) The notice of revocation must specify—

(a) the time at which the revocation comes into force;

(b) if the direction is partly revoked, what part of the direction is revoked.

(9) The Secretary of State must send a copy of the notice of revocation to the designated vendor or vendors specified in the direction as it had effect before the revocation, if or to the extent that it is reasonably practicable to do so.

(10) The requirement in subsection (9) does not apply, in the case of a designated vendor, if the Secretary of State considers that sending a copy of the notice of revocation to that designated vendor would be contrary to the interests of national security.

(11) Where the direction is partly revoked, the Secretary of State may exclude from the copy of the notice of revocation anything the disclosure of which the Secretary of State considers—

(a) would, or would be likely to, prejudice to an unreasonable degree the commercial interests of any person; or

(b) would be contrary to the interests of national security.

105Z7 Designated vendor directions: plans for compliance

(1) This section applies where a designated vendor direction has been given to a public communications provider (and has not been revoked).

(2) The Secretary of State may from time to time require the public communications provider—

(a) to prepare a plan setting out—

(i) the steps that the provider intends to take in order to comply with such requirements imposed by the direction as the Secretary of State may specify; and

(ii) the timing of those steps; and

(b) to provide the plan to the Secretary of State.

(3) The Secretary of State may also require that the plan be provided to OFCOM.

(4) The Secretary of State may specify the period within which a plan required under this section is to be provided to the Secretary of State or OFCOM.

(5) A period specified under subsection (4) must be such period as appears to the Secretary of State to be reasonable.”

(3) In section 151 (interpretation of Chapter 1 of Part 2) at the appropriate place in subsection (1) insert—

• ““designated vendor” means a person designated by a designation notice;”;

• ““designated vendor direction” has the meaning given by section 105Z1(1);”.

Commencement Information

I1 S. 15 in force at Royal Assent, see s. 28(1)(c)