Telecommunications (Security) Act 2021

12 Powers to require and share information related to security

(1) The Communications Act 2003 is amended as follows.

(2) In section 24B (provision of information to assist in formulation of policy) after subsection (2) insert—

“(3) But subsection (2) does not prevent OFCOM providing the Secretary of State with any information that they consider may assist the Secretary of State in the formulation of policy in relation to the security of public electronic communications networks or public electronic communications services.”

(3) In section 135 (power of OFCOM to require information for the purposes of certain functions)—

(a) in subsection (3) (particular purposes for which information may be required)—

(i) after paragraph (izb) (inserted by section 11(4)) insert—

“(izc) assessing the risk of a security compromise occurring in relation to a public electronic communications network or a public electronic communications service;”;

(ii) omit paragraphs (ie) and (if);

(b) in subsection (3A) (particular descriptions of information that may be required) before paragraph (a) insert—

“(za) information concerning future developments of a public electronic communications network or public electronic communications service that could have an impact on the security of the network or service,”;

(c) after subsection (3B) insert—

“(3C) OFCOM may require a person falling within subsection (2)—

(a) to produce, generate or obtain security information for the purpose of providing it under subsection (1);

(b) to collect or retain security information that the person would not otherwise collect or retain for the purpose of providing it under subsection (1);

(c) to process, collate or analyse any information held by the person (including information the person has been required to collect or retain) for the purpose of producing or generating security information to be provided under subsection (1).

(3D) In subsection (3C) “security information” means information OFCOM consider necessary for the purpose of carrying out their functions under sections 105L to 105Z.”; and

(d) in subsection (4) for the words from “required” to “it” substitute “must comply with a requirement imposed under this section”.

(4) In section 137 (restrictions on imposing information requirements)—

(a) in subsection (1) for “information may be required” substitute “requirements may be imposed”;

(b) omit subsection (2A); and

(c) after subsection (6) insert—

“(7) OFCOM are not to impose a requirement on a person under section 135(3C) except by a notice served on the person that sets out the requirement and OFCOM’s reasons for imposing it.”