The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations make amendments to the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“the 2003 Regulations”) with two distinct purposes. This first is to make provision in connection with alert messages in the event of an emergency. The second is to lower the threshold at which the Information Commissioner may impose a monetary penalty, under the Data Protection Act 1998 as applied to the 2003 Regulations, for a serious breach of regulations 19 to 24 of the 2003 Regulations.

The 2003 Regulations implemented the provisions of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector. The 2003 Regulations were amended in 2004 (S.I. 2004/1039), 2010 (S.I. 2010/22) and in 2011 (S.I. 2011/1208), the last amendments being to implement the European legislative changes contained in provisions of Directive 2009/136/EC.

Regulation 2(2) permits certain providers of mobile electronic communications services to disregard restrictions on the processing of traffic and location data that would otherwise be imposed on them by the 2003 Regulations. The providers are only permitted to do this for the purposes of providing an emergency alert service, or testing such a service, and only when acting in accordance with directions given by a relevant public authority (as defined) or, in relation to testing, by a Minister of the Crown. Only a provider or a person acting under the provider’s authority may process the traffic and location data. The regulation places a limit on the length of time that providers may retain the traffic and location data they process, unless the data is modified in such a way that the data cannot identify an individual or corporate body. This amendment is consistent with articles 1(3) and 15(1) of Directive 2002/58/EC, which make provision in relation to activities that protect public security.

An impact assessment of the effect of regulation 2(2) will have on the costs of business and the voluntary sector is published with the Explanatory Memorandum alongside the instrument on www.legislation.gov.uk.

Regulations 2(3) and 2(4) amend Schedule 1 to the 2003 Regulations, firstly to set out the threshold for the imposition of a monetary penalty for any serious breach of the 2003 Regulations in relation to matters other than those set out in regulations 19 to 24 (regulation 2(3)) and secondly to set out the threshold at which a monetary penalty for serious breaches of regulations 19 to 24 of the 2003 Regulations may be imposed (regulation 2(4)). This is to ensure that the penalty regime for breaches is “effective, proportionate and dissuasive” as required by Article 15a of Directive 2002/58/EC, as amended by Directive 2009/136/EC.

Regulation 2(5) amends Schedule 1 to the 2003 Regulations in order to make a minor textual modification, for the purposes of the 2003 Regulations, to section 55E of the Data Protection Act 1998. This is to bring that section in line with the other sections of the Data Protection Act 1998 which were inserted into regulation 31 of the 2003 Regulations by S.I. 2011/1208.

A full impact assessment has not been produced for regulations 2(3) to 2(5) as no impact on business and the voluntary sector is foreseen.

A transposition note has been produced for these Regulations and is published with the Explanatory Memorandum alongside the instrument on www.legislation.gov.uk.