Product Security And Telecommunications Infrastructure 2022

Chapter 3: Enforcement

Section 26: Enforcement of Part 1

114. Subsection (1) establishes that the Secretary of State will be responsible for enforcing the provisions of Part 1 and any regulations made under it.
115. Subsections (2) and (3) set out that the powers of investigation in Schedule 5 to the Consumer Rights Act 2015 are available to the Secretary of State and amend Schedule 5 of the Consumer Rights Act 2015 to that effect.
116. Subsection (4) removes the restriction in paragraph 13(4) of Schedule 5 of the Consumer Rights Act 2015 that limits information requests to determining if a breach has occurred and allows the Secretary of State to exercise powers in relation to production of information for any purpose relating to the enforcement of Part 1. For instance, requests for financial information might be needed to ensure only relevant entities are considered when calculating worldwide revenue for a company group.
117. Subsection (4) also removes the restriction in paragraph 13(5) of Schedule 5 to the 2015 Act, so that the Secretary of State can request that a manufacturer, importer or distributor produce information without there needing to be a reasonable suspicion of a breach of the legislation. This allows the Secretary of State to undertake their enforcement functions. Requesting information is needed to correctly ascertain if compliance failures have occurred, the level of risk arising from these compliance failures and ensure notices or corrective measures are issued where it is deemed necessary and proportionate to do so.
118. Subsection (5) provides that the Secretary of State may not bring proceedings for offences under Part 1 in Scotland, to ensure that the legislation does not contradict Scottish court procedures.

Section 27: Delegation of enforcement functions

119. This section provides that the Secretary of State may delegate enforcement functions to a person via regulations.
120. Subsection (2) provides that the Secretary of State may make payments for the performance of enforcement functions to an authorised person. This could be payment for singular enforcement actions or continuous responsibility for multiple enforcement activities.
121. Subsection (3) provides that regulations which authorise a person to exercise enforcement functions do not prevent the Secretary of State from also performing a function to which those regulations relate.
122. Subsection (4) defines an "enforcement function" as (a) any function of the Secretary of State under this Chapter, or (b) any function of the Secretary of State under Schedule 5 to the Consumer Rights Act 2015, so far as exercisable for the purposes of this Part.
123. Where a person is authorised to undertake an enforcement function under subsection (1), subsection (5) provides that any reference to the Secretary of State in provisions relating to that enforcement function should also be read as a reference to that person.
124. The exercise of this power will be subject to the affirmative resolution procedure.

Section 28: Compliance notices

125. This Section provides that the Secretary of State may give a compliance notice where they have reasonable grounds to believe a person has failed to comply with a relevant duty.
126. Subsection (2) describes a compliance notice as a notice requiring the recipient to comply with a relevant duty within a specified time frame. Subsection (3) provides that a compliance notice must (a) set out the reasons for giving the compliance notice, (b) explain what may happen if the person does not comply with it, and (c) explain how the person may appeal against it.
127. Subsection (4) provides that a compliance notice may require the recipient to take specified steps to comply with a relevant duty and/or to provide evidence to satisfy the Secretary of State within a specified period that the person has complied or is complying with the relevant duty.
128. Subsection (5) requires that, before issuing a compliance notice, the Secretary of State must notify the recipient that they intend to give a compliance notice and provide an opportunity for the recipient to make representations about the giving of the notice.
129. Subsection (6) sets out that the Secretary of State must not impose the compliance notice until 10 days after they have notified the recipient that they intend to issue a compliance notice.
130. Subsection (7) provides that only one compliance notice can be given for the same act or omission. A person may receive multiple notices where there are repeated and different breaches.

Section 29: Stop notices

131. This Section provides that the Secretary of State may give a stop notice where they have reasonable grounds to believe that a person is carrying on, or is likely to carry on, an activity in breach of a relevant duty.
132. Subsection (2) describes a stop notice as a notice requiring the recipient to stop carrying on an activity within a specified time frame. Subsection (3) provides that a stop notice must (a) set out the reasons for giving the stop notice, (b) explain what may happen if the person does not comply with it, and (c) explain how the person may appeal against it.
133. Subsection (4) provides further detail as to what a stop notice may require, including informing customers of risks posed by the product to which the stop notice relates.
134. Subsection (5) provides that, before issuing a stop notice, the Secretary of State must notify the recipient that they intend to give a stop notice and provide an opportunity for the recipient to make representations about the giving of a notice.
135. Subsection (6) provides that the Secretary of State must not impose the stop notice until 10 days after they have notified the recipient that they intend to issue a stop notice.
136. Subsection (7) provides that, if the Secretary of State considers that there is an urgent need to give a stop notice, then the requirements in subsections (5) and (6) do not apply.

Section 30: Recall notices

137. This Section provides a power for the Secretary of State to give a recall notice to a manufacturer or their authorised representative, an importer or a distributor.
138. Subsection (1) provides that a recall notice may only be given if (a) the Secretary of State has reasonable grounds to believe that there is a compliance failure in relation to any UK consumer connectable products that have been supplied to customers, (b) the Secretary of State considers that the action (if any) being taken by any relevant person in relation to the compliance failure is inadequate, and (c) the Secretary of State considers that any no other action which the Secretary of State may take under Sections 28, 29 and 42 would be sufficient to deal with the risks posed by the compliance failure.
139. Subsection (3) describes a recall notice as a notice requiring the recipient to make arrangements within a specified period for the return of the products to the recipient or to another person specified in the notice.
140. Subsection (4) provides that a recall notice must (a) set out the reasons for giving the recall notice, (b) explain what may happen if the person does not comply with it, and (c) explain how the person may appeal against it.
141. Subsection (5) provides some further detail as to what a recall notice may require, including, informing customers of risks posed by the product to which the recall notice relates.
142. Subsection (6) provides that before issuing a recall notice, the Secretary of State must notify the recipient that they intend to give a recall notice and provide an opportunity for the recipient to make representations about the giving of a notice.
143. The Secretary of State must not impose a recall notice until ten days after they have notified the recipient that they intend to issue a recall notice.
144. Subsection (8) provides that if there is an urgent need to give a recall notice, then the requirements in subsections (6) and (7) do not apply.

     Example of issuing a recall notice A smart camera with a universal default password is hacked and used to spy on consumers or to facilitate robberies. The manufacturer is unable and unwilling to comply with its duties in relation to the product and continues to supply the product to customers. After assessing the risk of the breach, the Secretary of State determines the compliance failure poses an immediate and high risk to any UK household which has purchased this product and to the UK’s economy due to the products facilitation of robberies. The Secretary of State gives a recall notice to the manufacturer/importer/distributor(s) or to any combination of relevant persons involved in the supply chain of the product to ensure the products are removed from circulation and the threat is eliminated.

Section 31: Power to vary or revoke enforcement notices

145. This Section provides the Secretary of State with power to vary or revoke an enforcement notice, as long as the changes do not make the notice more onerous than the original notice.

     Example of varying a stop notice The enforcement authority identifies that a popular baby monitor comes with a universal default password. The enforcement authority issues a compliance notice to the manufacturer, requiring that they ensure the product complies with all technical aspects of a security requirement within 14 days or stop making it available. The manufacturer has identified a solution to the problem and requests the Secretary of State allows the manufacturer 28 days to comply with the notice instead. The additional time is requested because another manufacturer supplies a key component part within the product and the primary manufacturer needs to work with its supplier to achieve compliance. The Secretary of State is satisfied that the manufacturer is taking reasonable steps to comply, the additional time is genuinely needed, and that the extension does not materially expose citizens, networks and infrastructure to additional harm. The Secretary of State decides to vary the notice so that compliance is required within 28 days. Example of revoking a stop notice The Secretary of State issues a stop notice requiring a distributor to stop selling a non-compliant smart television within 60 days. The distributor works with the manufacturer to resolve the compliance failure and within 15 days the product complies with the security requirements. The Secretary of State is satisfied that the product complies, and decides to revoke the notice so the distributor can continue to make it available.

Section 32: Failure to comply with enforcement notice

146. This Section makes it an offence for a recipient of an enforcement notice to fail to comply with that notice. A person guilty of an offence under this Section is liable to a fine of the type set out in subsection (9).
147. Subsection (2) sets out that it is a defence to this offence for the recipient of the notice to show that they took all reasonable steps to comply with the notice. Subsection (3) provides that a person is taken to have shown that fact where sufficient evidence is adduced to raise this as an issue and the contrary is not proven beyond reasonable doubt. When considering the defence, the relevant courts may consider evidence provided to show the recipient’s effort to comply with the notice as well as any evidence demonstrating the recipient could have undertaken additional effort to comply with the notice.
148. A person charged with an offence under this Section must serve a notice on a prosecutor or obtain the permission of the court if that person intends to rely on a defence under subsection (2), which involves a third party allegation. "Third party allegation" is defined in subsection (5) to mean the act or omission of another person or reliance on information provided by another person.
149. Subsection (7) states that in England, Wales or Northern Ireland the prosecutor must be notified 7 days in advance of the hearing of the proceedings and subsection (8) states that in Scotland the prosecutor must be notified ten days before the trial diet or where there is an intermediate diet, at or before this diet.

Section 33: Appeals against enforcement notices

150. Subsection (1) provides that a recipient of an enforcement notice will be able to appeal to the First-tier Tribunal against the notice or any provision of it, including the decision to issue it. Appeals can also be made against any variation to a notice made under Section 31.
151. Appeals must be made within 28 days from the date the notice was given by the enforcement authority. If the appeal is against the variation of the notice, then the appeal must be within 28 days beginning on the day on which the notice was varied.
152. Subsection (3) establishes the Tribunal’s power to either confirm the notice or, if it is satisfied that any of the grounds in subsection (4) apply, to vary or cancel the notice or any part of it.
153. Subsection (5) provides that if the Tribunal cancels a notice (whether in part or in full), it may require the person who gave the notice to reconsider the matter and make a new decision in accordance with the Tribunal’s ruling.
154. Subsection (6) limits the Tribunal’s powers so that the Tribunal cannot direct the person who gave the notice to take any action that they would otherwise be unauthorised to take. The Tribunal cannot, for example, order a person to recall products that are not in scope of Part 1 of this Act, because this exceeds the powers of the Secretary of State.
155. Subsection (7) allows the Tribunal to review the facts on which the decision to give the notice, or to include any provision of it, was based. The Tribunal may also consider evidence that was not available to the person who issued the notice. This allows for an appeals process even where the person who received the notice did not have an opportunity to submit evidence to the enforcement authority prior to the service of the notice by virtue of Section 29(7) or Section 30(8).
156. Subsections (8) and (9) act as safeguards. Subsection (8) temporarily suspends the effect of the enforcement notice, or the variation of the enforcement notice, against which an appeal is made until that appeal is determined or withdrawn. Subsection (9) allows the Upper Tribunal to suspend the notice, or any part of it, if an appeal against the decision of the First-tier Tribunal is or may be made until the Upper Tribunal determines that appeal or until it is withdrawn.

Section 34: Compensation for notices wrongly given

157. This Section sets out that the Secretary of State is liable to pay compensation to the person to whom a stop or a recall notice is wrongly given for loss or damage caused as a result of the giving of the notice. Compensation is only payable if the breach that led to the imposition of the stop or recall notice did not occur, and the decision to give a notice was not due to any neglect or default by the recipient of the notice.
158. Subsection (3) states that the Secretary of State will be responsible for determining the amount of compensation payable to a person under this Section.
159. Subsection (4) states that the Secretary of State may take into consideration the extent to which the person took reasonable steps to reduce the loss or damage caused as a result of the giving of the notice.
160. Subsections (5) and (6) states that a person seeking compensation must make a claim to the Secretary of State which includes evidence of the loss or damage in respect of which compensation is sought and the amount of the compensation sought. The claim must be made in a form and manner directed by the Secretary of State.
161. Subsection (7) provides that the Secretary of State must decide whether compensation will be paid and the amount of any compensation (if payable) and notify the person making the claim of their decision within 45 days beginning on the day on which the Secretary of State receives a claim.

Section 35: Appeals against decisions under section 34

162. This Section sets out a person’s right to appeal to the First-tier Tribunal against the decision not to award compensation or against the amount of the compensation payable under Section 34.
163. An appeal must be brought within 28 days beginning on the day the Secretary of State notified the person claiming compensation whether compensation would be paid, or the amount to be paid (if payable).
164. Where the decision appealed against is the decision not to award compensation, subsections (3) and (4) give the Tribunal the power to confirm or quash the decision that is being appealed and where it is quashed, to order the Secretary of State to pay compensation of an amount determined by the Tribunal or refer the decision back to the Secretary of State to retake the decision in accordance with its ruling.
165. Where the decision appealed against is the amount of compensation awarded, subsection (5) provides that the Tribunal may confirm the amount of compensation awarded, vary the amount of the compensation or require the Secretary of State to retake the decision that is appealed in accordance with its ruling.
166. Subsection (6) provides that an appeal against the decision not to award compensation or against the amount of the compensation may be made on the grounds that the decision appealed against was based wholly or partly on an error of fact or that the decision appealed against was wrong in law. Appeals against the amount of the compensation may also be made on the ground that the amount of the compensation was unfair or unreasonable for any other reason.
167. Subsection (7) provides that the Tribunal may review any facts on which the decision to appeal was based and take into account evidence not available to the Secretary of State and subsection (8) provides that the Tribunal cannot direct the Secretary of State to pay any compensation that they would not be otherwise be liable to pay under Section 34(2).

Section 36: Monetary Penalties

168. This Section provides that, where the Secretary of State is satisfied, on the balance of probabilities, that a person has failed to comply with a relevant duty, the Secretary of State may give a penalty notice requiring the recipient to pay a fine of a specified amount within a specified time period of no less than 28 days. The amount must not exceed any maximum established under Section 38.
169. A penalty may be issued even if the recipient has not previously received an enforcement notice in respect of the relevant breach but a person may not receive more than one penalty notice for a single breach. All penalties paid to the Secretary of State are to be paid into the Consolidated fund.
170. Where a breach continues beyond the period set in the penalty notice, subsection (5) provides that a daily penalty can be imposed requiring the person to pay up to £20,000 for each additional day the breach continues. There is no cap on the potential penalty accrued in daily penalties. If a daily penalty is to be imposed, then the daily penalty amount must also be set out in the initial penalty notice.

Section 37: Determining the amount of a penalty

171. This Section sets out that the penalty must be an amount considered by the Secretary of State to be appropriate and proportionate to the breach for which it is imposed. It must be determined taking into account the effects arising from a breach, and action taken by the recipient to remedy the breach or mitigate its effects.

Section 38: The relevant maximum

172. This Section sets the relevant maximum penalty for breaches to be the greater of £10 million or 4 per cent of the person’s qualifying worldwide revenue for the person’s most recent complete accounting period.
173. Where a non-compliant relevant person is a member of one or more groups (e.g. groups of companies), subsection (6) provides a power for the Secretary of State to determine the class of members within the group or groups that will have their revenue taken into account for the purposes of calculating the relevant maximum penalty.
174. Subsection (7) provides a power for the Secretary of State to set out in regulations how qualifying worldwide revenue for a period is to be determined for the purpose of calculating the maximum possible penalty.
175. Regulations under these powers are subject to the affirmative resolution procedure.

Section 39: Penalty notices: further provision

176. This Section sets out that, before giving a penalty notice, the Secretary of State must notify the recipient of their intention to give a notice and provide an opportunity for the recipient to make representations. Although there is no formal time limit within which a relevant person has to make representations, in practice it is likely that a relevant person would make representations within 28 days as the Secretary of State can issue a penalty notice as soon as 28 days after notification.
177. Subsection (3) sets out that the penalty notice must (a) give reasons for the notice, (b) include the amount of the penalty, (c) set out how payment may be made,(d) the deadline for making payment, (e) explain how the notice can be appealed, and (f) explain the consequences of failing to pay the penalty.
178. Subsections (4) and (5) provide that after issuing a variable monetary penalty notice, the Secretary of State may vary or revoke the notice but any variation may not make the notice more onerous. For example, the Secretary of State may reduce the amount of the penalty or allow for it to be paid at a later date but cannot require a higher penalty to be paid after the initial penalty notice has been issued.

Section 40: Enforcement of penalty notices

179. This Section establishes the procedure for enforcing a penalty notice in England and Wales, Scotland, and Northern Ireland.

Section 41: Appeals against penalty notices

180. This Section provides that a person who receives a penalty notice has the right to appeal to the First-tier Tribunal against the imposition of a penalty, the amount of a penalty or period in which a penalty or any part of it must be paid. Any appeal must be brought before the end of the period of 28 days beginning with the day on which the penalty notice was given, or the day on which the penalty notice was varied by the Secretary of State.
181. Subsections (3), (4) and (5) set out what the Tribunal may do, and the conditions under which the Tribunal may cancel or vary the decision of the Secretary of State.
182. Where the Tribunal cancels the notice, it may refer the matter back to the decision-maker with a direction to reconsider the matter and make a new decision in line with its ruling. However, the Tribunal may not direct the person who gave the penalty notice to take any action that the person would not have otherwise have the power to take.
183. Subsection (7) provides that the Tribunal may review any determination of fact on which the decision appealed against was based. The Tribunal may also take into account evidence that was not available to the person who gave the notice.
184. Subsection (8) is a safeguard that ensures that the penalty notice will not have effect (and therefore a penalty will not be payable) if an appeal against it is made to the First-tier Tribunal until that appeal is determined or withdrawn. The same applies in respect of a variation of a penalty notice. Subsection (9) is similar and it allows the Upper Tribunal, if an appeal against the decision of the First-tier Tribunal is or may be made, to suspend the penalty notice until the appeal is determined or withdrawn.

Section 42: Forfeiture

185. This Section sets out when relevant connectable products may be forfeited.
186. "Forfeitable products" are defined to include relevant connectable products that are in the possession or control of specific economic operators. This includes products that have been returned, for example, as a result of a recall notice, to one of the aforementioned economic operators. Products detained under paragraph 28 of Schedule 5 to the Consumer Rights Act 2015 are also forfeitable products.
187. Subsections (2) and (3) provide the conditions under which the Secretary of State may apply to court for an order for the forfeiture of products and the conditions upon which the court may make an order for the forfeiture of products.
188. Subsection (6) provides that an order for forfeiture may require the delivery of property to the Secretary of State, or such other person as the court may direct. It also provides that the court may permit the Secretary of State, or such other person as the court may direct, to destroy or otherwise dispose of the property in whatever way the Secretary of State or other person considers appropriate. An order under this Section may also require the property to be destroyed or otherwise disposed of in accordance with any directions of the court.
189. Subsections (7), (8), and (9) provide for the conditions under which forfeited products detained under paragraph 28 of Schedule 5 to the 2015 Act are returned to whomever is entitled to them.

Section 43: Further provision about forfeiture

190. This Section sets out how applications for an order for the forfeiture of products will be made to the courts in England and Wales and Northern Ireland.
191. Applications for an order for forfeiture of products can be made in cases where proceedings have been brought in England and Wales and Northern Ireland for an offence under either (a) Section 32; or (b) paragraph 36(1) or (2) of Schedule 5 to the Consumer Rights Act 2015.
192. Subsection (4) establishes that the court may only make an order for forfeiture if (a) the Secretary of State has given notice to every identifiable person with an interest in the product of the application, date and location of the proceedings for forfeiture; or (b) the court is satisfied that it was reasonable in the circumstances not to have given such notice.
193. Subsection (5) provides for any person having an interest in any forfeitable products to appear in court proceedings under Section 42.
194. Subsection (6) is a safeguard. It provides that a forfeiture order may not take effect until the period for appealing against the court’s decision to order forfeiture has ended or, if an appeal is made, until it has been determined or withdrawn.

Section 44: Appeals against decision under section 42

195. This Section sets out that appeals against an order for the forfeiture of products under Section 42 are permitted by any party to the proceedings in which the order was made, and by any other parties entitled to the products.
196. Subsection (2) provides for the Secretary of State to appeal against a decision not to make an order for forfeiture under Section 42, or an order under subsection (8) of that Section for the return of any products.
197. Subsection (5) provides that an appeal under this Section must be brought before the end of the period of 28 days, beginning with the date of the order or other decision appealed against.

Section 45: Power to inform public about compliance failures

198. This Section provides a power for the Secretary of State to publish whatever information they consider appropriate in order to inform the public about (a) the nature of the compliance failure, (b) any risks posed by using the product, or (c) any steps that may be taken to mitigate the effect of any such risks, where the Secretary of State has reasonable grounds to believe there is a compliance failure. This power is subject to any enactment or rule of law restricting the disclosure of information.

Section 46: Power to publish details of enforcement action taken against relevant persons

199. This Section enables the Secretary of State to publish information about failures by relevant persons to comply with their security requirements. The power includes allowing the Secretary of State to publish details about enforcement notices, penalties and forfeiture orders.

Section 47: Power to recall products

200. This Section provides a power for the Secretary of State to recall non-compliant products that have been supplied to customers in cases where a recall notice has not been complied with or where it was not possible to give a recall notice to the relevant person, and the Secretary of State has reasonable grounds to believe that there is a compliance failure in consumer connectable products supplied to consumers.
201. Subsection (4) provides that the Secretary of State may make arrangements for the delivery, disposal and destruction of the recalled products.
202. Subsection (5) provides that the Secretary of State may pay any amount it considers appropriate to customers who return products in a recall organised by the Secretary of State.
203. Subsection (6) provides that if the Secretary of State provides any financial incentive for the return of the product organised under Section 46 to a customer, a relevant person who is required to pay compensation to that customer is able to deduct the amount paid by the Secretary of State from any amount that the relevant person is required to pay (whether as a result of the exercise of the customer’s statutory rights or otherwise).
204. Subsection (7) provides that, where the recipient of a recall notice fails to comply with it, the Secretary of State may recover any costs or expenses reasonably incurred in taking action under this Section relating to a compliance failure from the person who failed to comply with the recall notice.

Section 48: Disclosure of information

205. This Section allows the Secretary of State to disclose to a person any information obtained in connection with the Secretary of State’s enforcement functions, where the disclosure made is for a purpose connected with an enforcement function of the Secretary of State. Subsection (2) provides that a person may disclose any information to the Secretary of State if it is for the purposes of enabling or assisting the Secretary of State to exercise any enforcement function.
206. As per subsection (3), this is done without breaching any restriction on the disclosure of information imposed on the person making the disclosure. However, subsections (4) and (5) provide that any action taken under this Section must not contravene data protection legislation or any of Parts 1 to 7 or Chapter 1 of Part 9 of the Investigatory Powers Act 2016.
207. Subsection (7) inserts Part 1 of the Product Security and Telecommunications Act 2022 into Schedule 14 of the Enterprise Act 2002 to empower the Secretary of State to disclose information to others (e.g. other regulators) so that they can carry out their functions pursuant to any act listed in Schedule 15 to the 2002 Act, or any subordinate legislation as may be specified for the purposes of section 241(3) of the 2002 Act.

Section 49: Offence of purporting to act as authorised to exercise enforcement function

208. This offence is in addition to the offence of purporting to act as officer at paragraph 37 of Schedule 5 to the Consumer Rights Act 2015.
209. While paragraph 37 of Schedule 5 to the 2015 Act provides that it is an offence for a person who is not an officer of an enforcer to purport to act as such under Part 3 or 4 of that Schedule, this Section additionally sets out that it is an offence for a person to purport to act as authorised to exercise a function of the Secretary of State under Chapter 3 (the enforcement provisions).
210. Subsection (2) provides the maximum penalty that the relevant court can impose on a person found guilty of the offence.

Section 50: Means of giving notices

211. This Section provides the means by which an enforcement notice can be given to a person, namely (a) handing it to the person, (b) leaving it at the person’s proper address, (c) sending it by post to the person at that address, or (d) where appropriate, sending it to the person by electronic means.

Section 51: Liability of authorised representatives

212. Where a manufacturer established abroad authorises a person in the United Kingdom, with the agreement of that person, to perform any of the duties listed in subsection (3) on their behalf, this Section sets out that the authorised representative must comply with those duties. Subsection (5) stipulates that this does not affect the manufacturer’s liability for a failure to comply with a duty.

Section 52: Offences by directors, partners etc

213. This Section provides for the liability of a director, manager, secretary, or other similar officer of a corporate body, or any person purporting to act in such a capacity. This includes anyone in a similar corporate position, including members who manage the body corporate’s affairs, and partners of a Scottish partnership or those purporting to act as such a partner.
214. Such persons (as well as the body corporate) are liable when an offence is committed either with their consent or connivance or due to their neglect.