Telecommunications (Security) Act 2021

23 Power of Secretary of State to require information etc

After section 105Z26 of the Communications Act 2003 insert—

“105Z27 Power of Secretary of State to require information etc

(1) The Secretary of State may require a person falling within subsection (2) to provide the Secretary of State with such information as the Secretary of State may reasonably require for the purpose of exercising the Secretary of State’s functions under sections 105Z1 to 105Z26.

(2) The persons falling within this subsection are—

(a) a person who is or has been a public communications provider;

(b) a person not falling within paragraph (a) who appears to the Secretary of State to have information relevant to the exercise of the Secretary of State’s functions under sections 105Z1 to 105Z26.

(3) The Secretary of State may require a person falling within subsection (2)—

(a) to produce, generate or obtain information for the purpose of providing it under subsection (1);

(b) to collect or retain information that the person would not otherwise collect or retain for the purpose of providing it under subsection (1);

(c) to process, collate or analyse any information held by the person (including information the person has been required to collect or retain) for the purpose of producing or generating information to be provided under subsection (1).

(4) The information that may be required under subsection (1) includes, in particular, information about—

(a) the use, or proposed use, of goods, services or facilities supplied, provided or made available by a particular person or a particular description of person;

(b) goods, services or facilities proposed to be supplied, provided or made available by a particular person or a particular description of person;

(c) goods, services or facilities proposed to be supplied, provided or made available by a person who has not, or has not recently, supplied, provided or made available for use in the United Kingdom—

(i) goods, services or facilities of that description; or

(ii) any goods, services or facilities;

(d) the manner in which a public electronic communications network or a public electronic communications service is, or is proposed to be, provided or facilities that are associated facilities by reference to such a network or service are, or are proposed to be, made available;

(e) future developments of such a network or service or such associated facilities.

(5) The Secretary of State may require a person to provide information under this section at such times or in such circumstances as may be specified by the Secretary of State.

(6) A person must comply with a requirement imposed under this section in such manner and within such reasonable period as may be specified by the Secretary of State.

(7) The powers in this section are subject to the limitations in section 105Z28.

(8) A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility.

105Z28 Restrictions on imposing information requirements

(1) This section limits the purposes for which, and manner in which, requirements may be imposed under section 105Z27.

(2) The Secretary of State is not to require a person to provide information under section 105Z27 except by a notice served on the person that—

(a) describes the required information; and

(b) sets out the Secretary of State’s reasons for requiring it.

(3) The Secretary of State is not to impose a requirement on a person under section 105Z27(3) except by a notice served on the person that sets out the requirement and the Secretary of State’s reasons for imposing it.

(4) The requirements in subsections (2)(b) and (3) do not apply if or to the extent that the Secretary of State considers that setting out reasons in the notice would be contrary to the interests of national security.

(5) The Secretary of State is not to require the provision of information under section 105Z27 except where the making of a demand for the information is proportionate to the use to which the information is to be put in the carrying out of the Secretary of State’s functions.

(6) The Secretary of State is not to impose a requirement on a person under section 105Z27(3) except where the imposition of the requirement is proportionate to the use to which the information required to be produced, generated, obtained, collected or retained (including information required to be produced or generated by processing, collating or analysing) is to be put in the carrying out of the Secretary of State’s functions.

(7) A requirement to provide information under section 105Z27 does not require a person to disclose information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings.

105Z29 Enforcement of information requirements etc

(1) Sections 105Z18, 105Z19(1) to (3), 105Z20 and 105Z21 apply in relation to a contravention by a person of a requirement under section 105Z27 as they apply in relation to a contravention by a public communications provider of a requirement imposed by a designated vendor direction, subject to subsection (2).

(2) Section 105Z19 (as applied by this section) has effect as if—

(a) in subsection (2), the maximum penalty specified were £10 million;

(b) in subsection (3), the maximum penalty specified were £50,000 per day.

(3) The Secretary of State may by regulations amend subsection (2) so as to substitute a different amount for the amount for the time being specified in subsection (2)(a) or (b).

(4) No regulations are to be made containing provision authorised by subsection (3) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.”