Communications Act 2003

[F1 105L Powers of OFCOM to inform others of security compromise U.K.

(1) This section applies where OFCOM consider that—

(a) there is a risk of a security compromise occurring in relation to a public electronic communications network or public electronic communications service; or

(b) a security compromise has occurred in relation to a public electronic communications network or public electronic communications service.

(2) OFCOM must inform the Secretary of State of the risk of or (as the case may be) the occurrence of the security compromise if they consider that the security compromise could result in or has resulted in—

(a) a serious threat to the safety of the public, to public health or to national security;

(b) serious economic or operational problems for persons who are communications providers or persons who make associated facilities available; or

(c) serious economic or operational problems for persons who use electronic communications networks, electronic communications services or associated facilities.

(3) OFCOM may inform the Secretary of State of the risk of or (as the case may be) the occurrence of the security compromise in a case where the duty in subsection (2) does not arise.

(4) OFCOM may inform any of the following about the risk of or (as the case may be) the occurrence of the security compromise—

(a) any person who uses or has used the network or service;

(b) any communications provider;

(c) any person who makes associated facilities available;

(d) any overseas regulator;

(e) the European Union Agency for Cybersecurity.

(5) OFCOM may inform any person who uses or has used the network or service of the technical measures that may be taken by the person for the purposes of—

(a) preventing the security compromise adversely affecting them; or

(b) remedying or mitigating the adverse effect that the security compromise has on them.

(6) OFCOM may direct the provider of the network or service to take steps specified in the direction for the purposes of—

(a) informing persons who use or have used the network or service of the risk of or (as the case may be) the occurrence of the security compromise;

(b) informing persons who use or have used the network or service of the technical measures that may be taken by them for a purpose mentioned in subsection (5)(a) or (b).

(7) OFCOM may if they consider it to be in the public interest—

(a) inform the public of the risk of or (as the case may be) the occurrence of the security compromise;

(b) inform the public of the technical measures that may be taken by members of the public for a purpose mentioned in subsection (5)(a) or (b);

(c) direct the provider of the network or service to do anything that OFCOM could do under paragraph (a) or (b).

(8) It is the duty of the provider of the network or service to comply with a direction given under this section within such reasonable period as may be specified in the direction.

(9) In this section “overseas regulator” means a person who, under the law of a country or territory outside the United Kingdom, has functions in relation to public electronic communications networks or public electronic communications services that correspond to functions that OFCOM have in relation to such networks or services.]

Textual Amendments

F1 Ss. 105J-105L inserted (1.10.2022) by Telecommunications (Security) Act 2021 (c. 31), ss. 4(2), 28(2)(b); S.I. 2022/931, reg. 2(b)