Reports on security etc

Reporting on matters related to security
11
1
The Communications Act 2003 is amended as follows.
2
After section 105Y insert—

OFCOM reports on security
105Z
1
As soon as practicable after the end of each reporting period OFCOM must prepare and send to the Secretary of State a report for the period (a “security report”).
2
A security report must contain such information and advice as OFCOM consider may best serve the purpose mentioned in subsection (3).
3
The purpose is to assist the Secretary of State in the formulation of policy in relation to the security of public electronic communications networks and public electronic communications services.
4
A security report must in particular include—
a
information about the extent to which providers of public electronic communications networks and public electronic communications services have complied during the reporting period with the duties imposed on them by or under sections 105A to 105D, 105I to 105K, 105N(2)(a) and 105O;
b
information about the extent to which providers of public electronic communications networks and public electronic communications services have acted during the reporting period in accordance with codes of practice issued under section 105E;
c
information about the security compromises that OFCOM have been informed of during the reporting period under section 105K;
d
information about the action taken by OFCOM during the reporting period in response to security compromises they have been informed of under section 105K;
e
information about the extent to which and manner in which OFCOM have exercised the functions conferred on them by sections 105I and 105L to 105V during the reporting period;
f
information about any particular risks to the security of public electronic communications networks and public electronic communications services of which OFCOM have become aware during the reporting period;
g
any other information of a kind specified in a direction given by the Secretary of State.
5
A security report must not include personal data (within the meaning of Parts 5 to 7 of the Data Protection Act 2018 (see section 3(2) and (14) of that Act).
6
The Secretary of State may—
a
publish a security report or any part of it; or
b
disclose a security report or any part of it to any person or body performing functions of a public nature for the purpose of enabling or assisting the performance of those functions.
7
In publishing or disclosing a security report or any part of a security report, the Secretary of State must have regard to the need to exclude from publication or disclosure, so far as is practicable, the matters which are confidential in accordance with subsection (8).
8
A matter is confidential under this subsection if—
a
it relates to the affairs of a particular body; and
b
publication or disclosure of that matter would or might, in the Secretary of State’s opinion, seriously and prejudicially affect the interests of that body.
9
In this section “reporting period” means—
a
the period of 2 years beginning with the day on which section 11 of the Telecommunications (Security) Act 2021 comes into force; and
b
each successive period of 12 months.
3
In section 134B (matters to be dealt with by OFCOM reports on infrastructure)—
a
in subsection (1) (the electronic communications networks matters) after paragraph (h) insert—
ha
the extent to which providers of public UK networks are complying with the duties imposed on them by or under sections 105A to 105D,
; and
b
in subsection (2) (the electronic communications services matters) after paragraph (f) (but before the “and” after it) insert—
fa
the extent to which providers of public UK services are complying with the duties imposed on them by or under sections 105A to 105D,
.
4
In section 135 (information required for purposes of certain OFCOM functions) in subsection (3) (particular purposes for which information may be required) after paragraph (iza) (inserted by section 6(3)) insert—
izb
preparing a report under section 105Z;
.
5
In section 393 (general restrictions on disclosure of information) in subsection (6) (exceptions) after paragraph (b) insert—
bza
prevents the publication or disclosure of a report or part of a report under section 105Z(6);
.
6
In Schedule 8 (decisions not subject to appeal) after paragraph 7B (inserted by section 10(3)) insert—
7C
A decision relating to the making of a report under section 105Z.

Powers to require and share information related to security
12
1
The Communications Act 2003 is amended as follows.
2
In section 24B (provision of information to assist in formulation of policy) after subsection (2) insert—
3
But subsection (2) does not prevent OFCOM providing the Secretary of State with any information that they consider may assist the Secretary of State in the formulation of policy in relation to the security of public electronic communications networks or public electronic communications services.
3
In section 135 (power of OFCOM to require information for the purposes of certain functions)—
a
in subsection (3) (particular purposes for which information may be required)—
i
after paragraph (izb) (inserted by section 11(4)) insert—
izc
assessing the risk of a security compromise occurring in relation to a public electronic communications network or a public electronic communications service;
;
ii
omit paragraphs (ie) and (if);
b
in subsection (3A) (particular descriptions of information that may be required) before paragraph (a) insert—
za
information concerning future developments of a public electronic communications network or public electronic communications service that could have an impact on the security of the network or service,
;
c
after subsection (3B) insert—
3C
OFCOM may require a person falling within subsection (2)—
a
to produce, generate or obtain security information for the purpose of providing it under subsection (1);
b
to collect or retain security information that the person would not otherwise collect or retain for the purpose of providing it under subsection (1);
c
to process, collate or analyse any information held by the person (including information the person has been required to collect or retain) for the purpose of producing or generating security information to be provided under subsection (1).
3D
In subsection (3C) “security information” means information OFCOM consider necessary for the purpose of carrying out their functions under sections 105L to 105Z.
; and
d
in subsection (4) for the words from “required” to “it” substitute “must comply with a requirement imposed under this section”.
4
In section 137 (restrictions on imposing information requirements)—
a
in subsection (1) for “information may be required” substitute “requirements may be imposed”;
b
omit subsection (2A); and
c
after subsection (6) insert—
7
OFCOM are not to impose a requirement on a person under section 135(3C) except by a notice served on the person that sets out the requirement and OFCOM’s reasons for imposing it.

Appeals against security decisions of OFCOM
13
1
Section 194A of the Communications Act 2003 (disposal of appeals against decisions of OFCOM etc) is amended as follows.
2
After subsection (2) insert—
2A
In a case where the appeal is against a relevant security decision of OFCOM, the Tribunal is to apply those principles without taking any special account of the merits of the case.
2B
Subsection (2A) has effect notwithstanding any retained case law or retained general principle of EU law.
3
In subsection (6) at the end insert—
- “relevant security decision” means a decision under any of sections 105I, 105L to 105O and 105U to 105W;
- “retained case law” and “retained general principle of EU law” have the meanings given by section 6(7) of the European Union (Withdrawal) Act 2018.

Reviews of sections 1 to 13
14
1
The Secretary of State must carry out reviews of the impact and effectiveness of sections 1 to 13.
2
After each review the Secretary of State must publish a report of the review and lay a copy before Parliament.
3
The reports must be published not more than 5 years apart.
4
The first report must be published within the period of 5 years beginning with the day on which this Act is passed.
S. 11 not in force at Royal Assent, see s. 28
S. 12 not in force at Royal Assent, see s. 28
S. 13 not in force at Royal Assent, see s. 28
S. 14 in force at Royal Assent, see s. 28(1)(c)
S. 11 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)
S. 12 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)
S. 13 in force at 1.10.2022 by S.I. 2022/931, reg. 2(b)