Telecommunications (Security) Act 2021

Designated vendor directions: further provision U.K.

22 Requirement not to disclose U.K.

After section 105Z24 of the Communications Act 2003 insert—

“105Z25 Requirement not to disclose

(1) The Secretary of State may require a public communications provider which has been given a designated vendor direction or a designated vendor who has been sent a copy under section 105Z4 not to disclose to any other person the contents of—

(a) the designated vendor direction, or

(b) a part of the designated vendor direction specified by the Secretary of State,

without the permission of the Secretary of State.

(2) The Secretary of State may require a designated vendor not to disclose to any other person the contents of—

(a) the designation notice, or

(b) a part of the designation notice specified by the Secretary of State,

without the permission of the Secretary of State.

(3) The Secretary of State may require a public communications provider which has been given a notification under section 105Z18 (notification of contravention of designated vendor direction etc) not to disclose to any other person the existence or contents of—

(a) the notification, or

(b) a part of the notification specified by the Secretary of State,

without the permission of the Secretary of State.

(4) The Secretary of State may require a public communications provider which has been given a confirmation decision under section 105Z20 (enforcement of notification under section 105Z18) not to disclose to any other person the existence or contents of—

(a) the confirmation decision, or

(b) a part of the confirmation decision specified by the Secretary of State,

without the permission of the Secretary of State.

(5) The Secretary of State may require a person who has been given an urgent enforcement direction not to disclose to any other person the existence or contents of—

(a) the urgent enforcement direction, or

(b) a part of the urgent enforcement direction specified by the Secretary of State,

without the permission of the Secretary of State.

(6) The Secretary of State may require a person who has been given a notice under section 105Z23(4)(a) or (7) (notices relating to confirmation of an urgent enforcement direction) not to disclose to any other person the existence or contents of—

(a) the notice, or

(b) a part of the notice specified by the Secretary of State,

without the permission of the Secretary of State.

(7) The Secretary of State may not impose a requirement on a person under subsection (1), (2), (3), (4), (5) or (6) unless the condition in subsection (8) is satisfied.

(8) The condition in this subsection is that the Secretary of State considers that it would be contrary to the interests of national security for—

(a) the contents of the designated vendor direction or the part specified under subsection (1),

(b) the contents of the designation notice or the part specified under subsection (2),

(c) the existence or contents of the notification under section 105Z18 or the part specified under subsection (3),

(d) the existence or contents of the confirmation decision under section 105Z20 or the part specified under subsection (4),

(e) the existence or contents of the urgent enforcement direction or the part specified under subsection (5), or

(f) the existence or contents of the notice under section 105Z23(4)(a) or (7) or the part specified under subsection (6),

(as the case may be) to be disclosed, except as permitted by the Secretary of State.

(9) If the condition in subsection (10) is satisfied, the Secretary of State may require a person consulted under section 105Z3(1), 105Z5(4), 105Z9(1) or 105Z10(4) not to disclose to any other person—

(a) the existence of the consultation and any information disclosed to the person in the consultation, or

(b) the existence of a part of the consultation specified by the Secretary of State and any information disclosed to the person in that part of the consultation,

without the permission of the Secretary of State.

(10) The condition in this subsection is that the Secretary of State considers that it would be contrary to the interests of national security for the matters described in subsection (9)(a) or (as the case may be) subsection (9)(b) to be disclosed, except as permitted by the Secretary of State.

(11) Where a person is subject to a requirement under this section not to disclose a matter, disclosure of that matter by an employee of the person or a person engaged in the person’s business is to be regarded as a disclosure by the person, unless the person can show that the person took all reasonable steps to prevent such a disclosure.

105Z26 Enforcement of requirement not to disclose

(1) Sections 105Z18, 105Z19(1) to (3), 105Z20 and 105Z21 apply in relation to a contravention by a person of a requirement not to disclose imposed under section 105Z25 as they apply in relation to a contravention by a public communications provider of a requirement imposed by a designated vendor direction, subject to subsections (2) to (6).

(2) Section 105Z18 (as applied by this section) has effect as if, in subsection (2)(d), for sub-paragraphs (i) and (ii) there were substituted—

“(i) bring the contravention to an end;

(ii) limit the consequences of the contravention;”.

(3) Section 105Z19 (as applied by this section) has effect as if—

(a) in subsection (2), the maximum penalty specified were £10 million;

(b) in subsection (3), the maximum penalty specified were £50,000 per day.

(4) The Secretary of State may by regulations amend subsection (3) so as to substitute a different amount for the amount for the time being specified in subsection (3)(a) or (b).

(5) No regulations are to be made containing provision authorised by subsection (4) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.

(6) Section 105Z20 (as applied by this section) has effect as if—

(a) in subsection (6)—

(i) in paragraph (a), for sub-paragraphs (i) and (ii) there were substituted—

“(i) to bring the contravention to an end, and

(ii) to limit the consequences of the contravention,”;

(ii) in paragraph (b), for “comply with that requirement and remedy” there were substituted “bring that contravention to an end and limit”;

(iii) in the words following paragraph (b), for “comply with that requirement or remedy” there were substituted “bring that contravention to an end or limit”;

(b) in subsection (7)(b)(ii), for the words from “comply” to “remedy” there were substituted “bring the contravention to an end or to limit”.”

Commencement Information

I1 S. 22 in force at Royal Assent, see s. 28(1)(c)

23 Power of Secretary of State to require information etc U.K.

After section 105Z26 of the Communications Act 2003 insert—

“105Z27 Power of Secretary of State to require information etc

(1) The Secretary of State may require a person falling within subsection (2) to provide the Secretary of State with such information as the Secretary of State may reasonably require for the purpose of exercising the Secretary of State’s functions under sections 105Z1 to 105Z26.

(2) The persons falling within this subsection are—

(a) a person who is or has been a public communications provider;

(b) a person not falling within paragraph (a) who appears to the Secretary of State to have information relevant to the exercise of the Secretary of State’s functions under sections 105Z1 to 105Z26.

(3) The Secretary of State may require a person falling within subsection (2)—

(a) to produce, generate or obtain information for the purpose of providing it under subsection (1);

(b) to collect or retain information that the person would not otherwise collect or retain for the purpose of providing it under subsection (1);

(c) to process, collate or analyse any information held by the person (including information the person has been required to collect or retain) for the purpose of producing or generating information to be provided under subsection (1).

(4) The information that may be required under subsection (1) includes, in particular, information about—

(a) the use, or proposed use, of goods, services or facilities supplied, provided or made available by a particular person or a particular description of person;

(b) goods, services or facilities proposed to be supplied, provided or made available by a particular person or a particular description of person;

(c) goods, services or facilities proposed to be supplied, provided or made available by a person who has not, or has not recently, supplied, provided or made available for use in the United Kingdom—

(i) goods, services or facilities of that description; or

(ii) any goods, services or facilities;

(d) the manner in which a public electronic communications network or a public electronic communications service is, or is proposed to be, provided or facilities that are associated facilities by reference to such a network or service are, or are proposed to be, made available;

(e) future developments of such a network or service or such associated facilities.

(5) The Secretary of State may require a person to provide information under this section at such times or in such circumstances as may be specified by the Secretary of State.

(6) A person must comply with a requirement imposed under this section in such manner and within such reasonable period as may be specified by the Secretary of State.

(7) The powers in this section are subject to the limitations in section 105Z28.

(8) A reference in this section to a facility includes a reference to a facility, element or service that is an associated facility.

105Z28 Restrictions on imposing information requirements

(1) This section limits the purposes for which, and manner in which, requirements may be imposed under section 105Z27.

(2) The Secretary of State is not to require a person to provide information under section 105Z27 except by a notice served on the person that—

(a) describes the required information; and

(b) sets out the Secretary of State’s reasons for requiring it.

(3) The Secretary of State is not to impose a requirement on a person under section 105Z27(3) except by a notice served on the person that sets out the requirement and the Secretary of State’s reasons for imposing it.

(4) The requirements in subsections (2)(b) and (3) do not apply if or to the extent that the Secretary of State considers that setting out reasons in the notice would be contrary to the interests of national security.

(5) The Secretary of State is not to require the provision of information under section 105Z27 except where the making of a demand for the information is proportionate to the use to which the information is to be put in the carrying out of the Secretary of State’s functions.

(6) The Secretary of State is not to impose a requirement on a person under section 105Z27(3) except where the imposition of the requirement is proportionate to the use to which the information required to be produced, generated, obtained, collected or retained (including information required to be produced or generated by processing, collating or analysing) is to be put in the carrying out of the Secretary of State’s functions.

(7) A requirement to provide information under section 105Z27 does not require a person to disclose information in respect of which a claim to legal professional privilege (or, in Scotland, to confidentiality of communications) could be maintained in legal proceedings.

105Z29 Enforcement of information requirements etc

(1) Sections 105Z18, 105Z19(1) to (3), 105Z20 and 105Z21 apply in relation to a contravention by a person of a requirement under section 105Z27 as they apply in relation to a contravention by a public communications provider of a requirement imposed by a designated vendor direction, subject to subsection (2).

(2) Section 105Z19 (as applied by this section) has effect as if—

(a) in subsection (2), the maximum penalty specified were £10 million;

(b) in subsection (3), the maximum penalty specified were £50,000 per day.

(3) The Secretary of State may by regulations amend subsection (2) so as to substitute a different amount for the amount for the time being specified in subsection (2)(a) or (b).

(4) No regulations are to be made containing provision authorised by subsection (3) unless a draft of the regulations has been laid before Parliament and approved by a resolution of each House.”

Commencement Information

I2 S. 23 in force at Royal Assent, see s. 28(1)(c)