PART I GENERAL

1 Citation and commencement
1 These Regulations may be cited as the Telecommunications (Data Protection and Privacy) Regulations 1999.
2 These Regulations shall come into force–
(a) for the purposes of regulation 3(2), on 16th August 1999;
(b) for all other purposes, on 1st March 2000.

2 Interpretation
1 In these Regulations–
“the Act of 1984” means the Telecommunications Act 1984;
“bill” includes an invoice, account, statement or other instrument of the like character and “billing” shall be construed accordingly;
“corporate subscriber” means a subscriber who is not an individual, that is to say a subscriber who is–
(a) a company within the meaning of section 735(1) of the Companies Act 1985;
1985 c. 6.
(b) a company incorporated in pursuance of a royal charter or letters patent;
(c) a partnership in Scotland;
(d) a corporation sole; or
(e) any other body corporate or other entity which is a legal person distinct from the persons (if any) of which it is composed;
“the Data Protection Commissioner” and “the Commissioner” both mean the Commissioner appointed under section 6 of the Data Protection Act 1998;
“the Directive” means Directive 97/66/EC of the European Parliament and of the Council of the European Union;
“the Director” means the Director General of Telecommunications appointed under section 1 of the Act of 1984;
“individual” means a living individual and includes an unincorporated body of such individuals;
“public telecommunications network” means any transmission system, and any associated switching equipment and other resources, which (in either case)–
(a) permit the conveyance of signals between defined termination points by wire, by radio, by optical or by other electro-magnetic means, and
(b) are used, in whole or in part, for the provision of publicly available telecommunications services;
“relevant telecommunications network”, in relation to a telecommunications service provider, means a public telecommunications network which is used by that service provider for the provision of publicly available telecommunications services;
“relevant telecommunications service provider” means–
(a) in relation to a user, the provider of the services he uses, and
(b) in relation to a subscriber, the provider who provides him with services;
“subscriber” means a person who is a party to a contract with a telecommunications service provider for the supply of publicly available telecommunications services;
“telecommunications network provider” means a person who provides a public telecommunications network (whether or not he is also a telecommunications service provider);
“telecommunications service provider” means a person who provides publicly available telecommunications services (whether or not he is also a telecommunications network provider);
“telecommunications services” means services the provision of which consists, in whole or in part, of the transmission and routing of signals on telecommunications networks, not being services by way of radio or television broadcasting;
“user” means an individual using a publicly available telecommunications service (whether or not he is a subscriber).
1984 c. 12.
1998 c. 29.
O.J. No. L24, 30.1.98, p. 1.
2 Section 1 of the Data Protection Act 1998 (basic interpretative provisions) shall have effect for the purposes of these Regulations as it has effect for the purposes of that Act.
3 Subject to paragraphs (1) and (2) and except where the context otherwise requires, expressions used in these Regulations which are also used in the Directive have the same meanings in these Regulations as they have in the Directive.
4 In a case in which signals are conveyed to telecommunications equipment used by a subscriber wholly or partly otherwise than by line, any reference in these Regulations to a line shall be construed as including a reference to what, in that case, functionally corresponds to a line and “connected”, in relation to a line, shall be construed accordingly.

3 Revocation and amendment of provisions and modification of contracts
1 The Telecommunications (Data Protection and Privacy) (Direct Marketing) Regulations 1998 are hereby revoked.
S.I.1998/3170.
2 Until the coming into force of paragraph (1) on 1st March 2000 and the revocation thereby of the said Regulations of 1998, those Regulations shall have effect subject to the amendment set out in Part I of Schedule 1.
3 The amendments set out in Part II of Schedule 1 shall have effect.
4 To the extent that any term in a contract between–
(a) a subscriber to, and the provider of, publicly available telecommunications services, or
(b) such a provider and a telecommunications network provider,
would be inconsistent with a requirement of these Regulations, that term shall be void.

4 Requirements of Regulations
Notwithstanding that the requirements of these Regulations are requirements imposed by law, where a person is required to provide, or ensure the provision of, a facility he may make a reasonable charge in respect thereof save insofar as is otherwise provided in regulations 11(2) and (3), 12(2) and (3), 18(1), 19(1) and 31.

5 Consents, notices, notifications and requests for purposes of Regulations
1 Except where the context otherwise requires, a consent, notice or notification for the purposes of these Regulations may be in general or more limited terms and may be subject to conditions.
2 A consent, notice, notification or request for the purposes of these Regulations may (without prejudice to any other method of transmission) be sent by post.

PART II TRAFFIC AND BILLING DATA

6 Limitation on processing certain traffic data
1 This regulation relates to data which–
(a) are in respect of traffic handled by a telecommunications network provider or a telecommunications service provider;
(b) are processed to secure the connection of a call and held by the provider concerned; and
(c) constitute personal data whereof the data subject is a subscriber to, or user of, any publicly available telecommunications service or, in the case of a corporate subscriber, would constitute such personal data if that subscriber were an individual.
2 Upon the termination of the call in question, save as provided in regulations 7(2) and 8(2), such data as are mentioned in paragraph (1) shall be erased or shall be so dealt with that they cease to be such data as are mentioned in paragraph (1)(c).

7 Limitation on processing certain billing data
1 This regulation relates to the processing of any such data as are mentioned in Schedule 2 and are held by a telecommunications network provider or a telecommunications service provider for purposes connected with the payment of sums falling to be paid–
(a) by a subscriber, or
(b) by way of interconnection charges.
2 Such data as are mentioned in paragraph (1) of that regulation, such data as are mentioned in paragraph (1) of this regulation may, and may only, be processed for the purposes there mentioned until the expiry of the period during which legal proceedings may be brought in respect of the payments due, or alleged to be due, or where such proceedings are brought within that period, until those proceedings are finally determined and, for the purposes hereof, the proceedings shall not be taken to be finally determined–
(a) until the end of the ordinary time for an appeal by either party, if no appeal proceedings are brought within that time, or
(b) if any such proceedings are so brought, until the conclusion of the appeal proceedings.
3 References in paragraph (2) to appeal proceedings include references to an application for leave to appeal.

8 Processing of billing data for certain marketing purposes by a telecommunications service provider
1 This regulation relates to the processing of such data as are mentioned in Schedule 2 which–
(a) are held by a telecommunications service provider, and
(b) constitute personal data whereof the data subject is a subscriber to that service or, in the case of a corporate subscriber, would constitute such data if that subscriber were an individual.
2 Such data as are mentioned in paragraph (1) of that regulation, such data as are mentioned in paragraph (1) of this regulation may be processed by the telecommunications service provider concerned for the purposes of marketing telecommunications services which he provides if, but only if, the subscriber concerned has given his consent.

9 Further provisions relating to the processing of traffic and billing data
1 This regulation relates to the processing by either a telecommunications network provider or a telecommunications service provider (“the relevant person”) of data to which regulation 6, 7 or 8 relates.
2 The processing of such data as are mentioned in paragraph (1) shall, without prejudice to any other restriction contained in this Part, be restricted to what is necessary for the purposes of such an activity as is mentioned in paragraph (3) or for the purposes of regulation 6(2) and (unless the relevant person is an individual and the processing is carried out by him personally) processing for such purposes shall only be carried out by a person–
(a) acting under the authority of the relevant person, and
(b) whose activities under that authority include such an activity as is mentioned in paragraph (3).
3 The activities referred to in paragraph (2) are activities relating to–
(a) the management of billing or traffic;
(b) customer enquiries;
(c) the prevention or detection of fraud, and
(d) the marketing of any telecommunications services provided by the relevant person.

10 Savings relating to the settling of disputes
Nothing in this Part shall preclude the furnishing of billing or traffic data to a person who is a competent authority for the purposes of any provision relating to the settling of disputes (by way of legal proceedings or otherwise) which is contained in, or made by virtue of, any enactment.

PART III CALLING OR CONNECTED LINE IDENTIFICATION

11 Prevention of calling line identification—outgoing calls
1 This regulation relates to outgoing calls on a line.
2 The relevant telecommunications service provider shall ensure that a user originating a call has, subject to regulations 13 and 14, as respects that call, a simple means to prevent, without charge, presentation of the identity of the calling line on the connected line.
3 The relevant telecommunications service provider shall ensure that a subscriber has, subject to regulations 13 and 14, as respects his line and all calls originating therefrom, a simple means to prevent, without charge, presentation of the identity of his line on any connected line.

12 Prevention of calling or connected line identification—incoming calls
1 This regulation relates to incoming calls on a line.
2 Where presentation on the connected line of the identity of the calling line is available, the relevant telecommunications service provider shall ensure that the called subscriber has a simple means to prevent, without charge for reasonable use of the facility, presentation of the identity of a calling line on the connected line.
3 Where presentation on the calling line of the identity of the connected line is available, the relevant telecommunications service provider shall ensure that a called subscriber has a simple means to prevent, without charge, presentation of the identity of the connected line on any calling line.
4 Where presentation on the connected line of the identity of the calling line, before the establishment of a call, is available, the relevant telecommunications service provider shall ensure that the called subscriber has, as respects all or particular calls in the case of which such presentation has been prevented as mentioned in regulation 11(2) or (3), a simple means to reject the calls in question.
5 In this regulation “called subscriber” means the subscriber whose line is the called line (whether or not it is also the connected line).

13 999 or 112 calls
1 This regulation relates to calls to the emergency services made using either the national emergency call number 999 or the single European emergency call number 112 (“999 or 112 calls”).
2 In order to facilitate responses to such calls–
(a) all 999 or 112 calls shall be excluded from the calls referred to in regulation 11, and
(b) in relation to 999 or 112 calls, no person shall be entitled to prevent the presentation on the connected line of the identity of the calling line.

14 Tracing of malicious or nuisance calls
1 This regulation shall apply where the relevant telecommunications service provider has been notified by a subscriber that he requests the tracing of malicious or nuisance calls received on his line.
2 Until such time as action in pursuance of such a request has ceased, the relevant telecommunications service provider or the provider of a relevant telecommunications network, where the subscriber has made application in that behalf, may–
(a) in relation to calls in relation to which the subscriber’s line is the called line, and
(b) so far as it appears to the provider in question necessary or expedient for the purposes of such action,
override anything done to prevent the presentation of the identity of the calling line.
3 Any term of a contract for the provision of telecommunications services which relates to such prevention shall have effect subject to the provisions of paragraph (2).
4 In relation to such calls as are mentioned in paragraph (2)(a), nothing in these Regulations shall preclude the relevant telecommunications service provider, or a provider of a relevant telecommunications network, from holding and making available to a person with a legitimate interest therein, data containing the identification of a calling subscriber which were obtained while paragraph (2) applied.

15 Facilities for calling or connected line identification to be publicised
A telecommunications service provider who offers facilities for calling or connected line identification shall take all reasonable steps to publicise that he does so and of the effect of this Part in relation thereto.

16 Supplementary provisions
1 Any other telecommunications service provider and any telecommunications network provider shall comply with any reasonable requests made by a relevant telecommunications service provider for the purposes of regulation 11, 12 or 14.
2 Where a subscriber has two or more lines, regulations 11 and 12 shall, in his case, have effect separately as respects each line as if that line were his only line.

PART IV DIRECTORIES OF SUBSCRIBERS

17 Application and interpretation of Part IV
1 This Part shall apply in relation to a directory of subscribers to publicly available telecommunications services, whether in printed form or in electronic form–
(a) which is made available to the public or a section of the public, or
(b) information from which is provided by a directory enquiry service.
2 In this Part any reference to a directory is a reference to such a directory as is mentioned in paragraph (1), “production” in relation to a directory means its publication or preparation and cognate expressions shall be construed accordingly.
3 Such a request as is mentioned in paragraph (3) of regulation 18 or paragraph (2) of regulation 19 shall be treated for the purposes of the regulation in question as having no application in relation to an edition of a directory which was first produced before the request was received by the producer of the directory; and, for the purposes hereof, an edition of a directory which is revised after it was first produced shall be treated as a new edition.

18 Entries relating to individuals
1 This regulation applies in relation to a directory which includes entries which relate to subscribers who are individuals, and any person who produces such a directory shall, without charge to any such subscriber, ensure that it complies with this regulation.
2 Except to the extent, if any, to which the subscriber in question has consented otherwise, such a directory shall not contain any personal data whereof the data subject is a subscriber who is an individual other than data which are necessary to identify him and the number allocated to him.
3 Without prejudice to paragraph (2), where a subscriber who is an individual has so requested the producer of such a directory then, in his case–
(a) no entry relating to a number specified in the request shall be included in that directory;
(b) no entry therein shall contain a reference which reveals his sex; and
(c) no such entry shall contain such part of his address as is so specified.
4 Where, in connection with the production of a directory, information relating to a particular subscriber is supplied to the producer thereof by some other person–
(a) where the other person has in his possession such a request by that subscriber as is mentioned in paragraph (3) (to whomsoever made) or a copy or record of such a request, he shall, without undue delay, transmit a copy of that request or a copy of that record to the producer of the directory, and
(b) subject to receipt by the producer of the directory of a copy of a request or of a record thereof so transmitted, the request in question shall be treated for the purposes of paragraph (3) as if it had been made to that producer.

19 Entries relating to corporate subscribers
1 This regulation applies in relation to a directory which includes entries which relate to corporate subscribers and any person who produces such a directory shall, without charge to any such subscriber, ensure that it complies with this regulation.
2 Where a corporate subscriber has so requested the producer of such a directory, then, in its case, no entry relating to a number specified in the request shall be included in that directory.
3 Paragraph (4) of regulation 18 shall have effect for the purposes of this regulation as if any reference therein to paragraph (3) of that regulation were a reference to paragraph (2) of this regulation.

20 Supplementary provisions relating to directory enquiry services
Where a person directs an enquiry relating to a particular subscriber to a directory enquiry service but there is either no entry relating to that subscriber, or no entry relating to his number, in a directory used by that service, nothing in this Part shall be taken to preclude the person in question being told the reason, or possible reason, why there is no such entry, in particular, that, in pursuance of a request made by the subscriber for the purposes of regulation 18(3), regulation 18(3)(a) applies or, in the case of a corporate subscriber, in pursuance of a request made by it for the purposes of regulation 19(2), that provision applies.

PART V USE OF TELECOMMUNICATIONS SERVICES FOR DIRECT MARKETING PURPOSES

21 Application and interpretation of Part V
1 This Part shall apply in relation to the use of publicly available telecommunications services for direct marketing purposes.
2 Any reference in this Part to direct marketing is a reference to the communication of any advertising or marketing material on a particular line.
3 In this Part, “caller” means a person using publicly available telecommunications services for direct marketing purposes, except that where such services are so used at the instigation of some other person “caller” means that other person.
4 In regulations 26(3) and 27(5) and (6), “directory of subscribers” means a directory of subscribers to publicly available telecommunications services, whether in printed form or in electronic form, which is made available to the public or a section of the public and, in relation to such a directory, “producer” means the person by whom the directory is published or prepared.

22 Use of automated calling systems for direct marketing purposes—communications on lines of individual or corporate subscribers
1 This regulation applies in relation to the use of publicly available telecommunications services by means of an automated calling system (that is to say, a system which, when activated, operates to make calls without human intervention) for the communication of material for direct marketing purposes, whether the called line is that of a subscriber who is an individual or that of a corporate subscriber.
2 A person shall not use, or instigate the use of, publicly available telecommunications services, and a subscriber to such services shall not permit his line to be used, as mentioned in paragraph (1), except where the called line is that of a subscriber who has previously notified the caller that for the time being he consents to such communications as are there mentioned being sent by, or at the instigation of, the caller in question on that line.

23 Use of fax for direct marketing purposes—unsolicited communications on lines of individual or corporate subscribers
1 This regulation applies in relation to the use of publicly available telecommunications services for the unsolicited communication of material, for direct marketing purposes, by means of facsimile transmission, whether the called line is that of a subscriber who is an individual or that of a corporate subscriber; and, in a case in which an automated calling system within the meaning of regulation 22(1) is used, the provisions of this regulation and those of regulation 22 are without prejudice to each other.
2 A person shall not use, or instigate the use of, publicly available telecommunications services, and a subscriber to such services shall not permit his line to be used, as mentioned in paragraph (1) where–
(a) the called line is that of a subscriber who has previously notified the caller (notwithstanding, in the case of a subscriber who is an individual, that he enjoys the benefit of regulation 24) that such unsolicited communications as are so mentioned should not be sent on that line, or
(b) the number allocated to a subscriber in respect of the called line is one listed in the record kept under paragraph (4).
3 For the purposes of paragraphs (1) and (2), the communication of material as mentioned in paragraph (1) shall not be treated as unsolicited where the called line is that of a subscriber who has notified the caller that he does not for the time being object to such communications as are so mentioned being sent by, or at the instigation of, the caller in question on that line.
4 For the purposes of this regulation–
(a) the Director shall maintain and keep up-to-date, in printed form or in electronic form, a record of the numbers allocated to subscribers, in respect of particular lines, who have notified him (notwithstanding, in the case of individuals, that they enjoy the benefit of regulation 24) that they do not for the time being wish to receive such communications as are mentioned in paragraph (1) on the lines in question, and he shall remove a number from the record where he has reason to believe that it has ceased to be allocated to the subscriber by whom he was so notified, and
(b) on the request of–
(i) a person wishing to send, or instigate the sending of, such communications, or
(ii) a subscriber wishing to permit the use of his line for the sending of such communications,
for information derived from that record, the Director shall, unless it is not reasonably practicable so to do, on the payment to him of such fee as is applicable and is, subject to paragraph (5), required by him, make the information requested available to that person or that subscriber.
5 For the purposes of paragraph (4)(b) the Director may require different fees–
(a) for making available information derived from the record in different forms or manners, or
(b) for making available information derived from the whole or from different parts of the record,
but the fees required by him shall be ones in relation to which the Secretary of State has notified the Director that he is satisfied that they are designed to secure, as nearly as may be and taking one year with another, that the aggregate fees received, or reasonably expected to be received, equal the costs incurred, or reasonably expected to be incurred, by the Director, in discharging his duties under paragraph (4).
6 The functions of the Director under paragraph (4), other than the function of determining the fees to be required for the purposes of sub-paragraph (b) thereof, may be discharged on his behalf by some other person in pursuance of arrangements in that behalf made by the Director with that other person.

24 Use of fax for direct marketing purposes—communications on lines of subscribers who are individuals
1 This regulation applies in relation to the use of publicly available telecommunications services for the communication of material, for direct marketing purposes, by means of facsimile transmission where the called line is that of a subscriber who is an individual; and–
(a) the provisions of this regulation and those of regulation 23 are without prejudice to each other, and
(b) in a case in which an automated calling system within the meaning of regulation 22(1) is used, the provisions of this regulation and those of regulation 22 are without prejudice to each other.
2 A person shall not use, or instigate the use of, publicly available telecommunications services, and a subscriber to such services shall not permit his line to be used, as mentioned in paragraph (1), except where the called line is that of a subscriber who has previously notified the caller that he consents for the time being to such communications as are there mentioned being sent by, or at the instigation of, the caller in question on that line.

25 Unsolicited calls for direct marketing purposes on lines of subscribers who are individuals
1 This regulation applies in relation to the use of publicly available telecommunications services for the purposes of making unsolicited calls, for direct marketing purposes, otherwise than in a case in which the material communicated is communicated by means of facsimile transmission, where the called line is that of a subscriber who is an individual; and, in a case in which an automated calling system within the meaning of regulation 22(1) is used, the provisions of this regulation and those of regulation 22 are without prejudice to each other.
2 A person shall not use, or instigate the use of, publicly available telecommunications services, and a subscriber to such services shall not permit his line to be used, as mentioned in paragraph (1) where–
(a) the called line is that of a subscriber who has previously notified the caller that such unsolicited calls as are there mentioned should not for the time being be made on that line, or
(b) the number allocated to a subscriber in respect of the called line is one listed in the record kept under paragraph (4).
3 For the purposes of paragraphs (1) and (2), a call on a subscriber’s line shall not be treated as an unsolicited call if that subscriber has notified the caller that he does not object to calls being made by, or at the instigation of, the caller in question for direct marketing purposes on that line.
4 For the purposes of this regulation–
(a) the Director shall maintain and keep up-to-date, in printed form or in electronic form, a record of the numbers allocated to subscribers who are individuals, in respect of particular lines, who have notified him that they do not for the time being wish to receive unsolicited calls made for direct marketing purposes on the lines in question, and he shall remove a number from the record where he has reason to believe that it has ceased to be allocated to the subscriber by whom he was so notified, and
(b) on the request of–
(i) a person wishing to make, or instigate the making of, such calls, or
(ii) a subscriber wishing to permit the use of his line for the making of such calls,
for information derived from that record, the Director shall, unless it is not reasonably practicable so to do, on the payment to him of such fee as is applicable and is, subject to paragraph (5), required by him, make the information requested available to that person or that subscriber.
5 For the purposes of paragraph (4)(b) the Director may require different fees–
(a) for making available information derived from the record in different forms or manners, or
(b) for making available information derived from the whole or from different parts of the record,
but the fees required by him shall be ones in relation to which the Secretary of State has notified the Director that he is satisfied that they are designed to secure, as nearly as may be and taking one year with another, that the aggregate fees received, or reasonably expected to be received, equal the costs incurred, or reasonably expected to be incurred, by the Director in discharging his duties under paragraph (4).
6 The functions of the Director under paragraph (4), other than the function of determining the fees to be required for the purposes of sub-paragraph (b) thereof, may be discharged on his behalf by some other person in pursuance of arrangements in that behalf made by the Director with that other person.

26 Notifications for the purposes of regulation 23(4)(a) or 25(4)(a)
1 Where any such person as is mentioned in paragraph (3) has in his possession such a notification as is mentioned in regulation 23(4)(a) or regulation 25(4)(a) (to whomsoever it is addressed) or a copy or record of such a notification–
(a) he shall, without undue delay, transmit a copy of that notification or a copy of that record to the Director, and
(b) subject to receipt by the Director of a copy of a notification or of a record thereof so transmitted, the notification in question shall be treated for the purposes of regulation 23(4)(a) or, as the case may be, regulation 25(4)(a) as if it had been given to the Director.
2 Where the Director has made arrangements in pursuance of paragraph (6) of regulation 23 or, as the case may be, paragraph (6) of regulation 25 for the discharge of functions under paragraph (4) of the regulation in question by some other person on his behalf, paragraph (1) of this regulation shall have effect, in relation to such a notification as is mentioned in paragraph (4)(a) of the regulation in question, as if for the reference to the Director in sub-paragraph (a) and the first reference to him in sub-paragraph (b) there were substituted references to that other person.
3 The persons referred to in paragraph (1) are–
(a) a telecommunications service provider;
(b) the producer of a directory of subscribers; and
(c) where, in connection with the production of such a directory, information relating to a particular subscriber is supplied to the producer thereof by some other person, that other person.

27 Supplementary provisions
1 Where publicly available telecommunications services are used for the communication of material for direct marketing purposes–
(a) in a case in which an automated calling system within the meaning of regulation 22(1) is used or the material is communicated by means of facsimile transmission, the caller shall ensure that the material communicated includes the particulars mentioned in paragraph (2)(a) and (b) below;
(b) otherwise than as mentioned in sub-paragraph (a), the caller shall ensure that the material communicated includes the particulars mentioned in paragraph (2)(a) below and, if the recipient of the call so requests, those mentioned in paragraph (2)(b) below.
2 The particulars referred to in paragraph (1) are–
(a) the name of the caller;
(b) either the address of the caller or a freephone telephone number on which he can be reached.
3 Where a person by whom numbers are allocated to subscribers is requested by or on behalf of the Director, for the purposes of his functions under regulation 23(4) or 25(4), to furnish information as to when a particular number ceases to be allocated to a particular subscriber, that person shall comply with the request.
4 A caller shall not be held to have contravened regulation 23 or regulation 25 by reason of the making, or instigating the making, of a call and a subscriber shall not be held to have contravened regulation 23 or regulation 25 by permitting his line to be used for the making of a call, by reason only that the number of the called line is one listed in the record kept under paragraph (4) of the regulation in question, if that number was not so listed at any time within the 28 days preceding that on which the call is made.
5 Subject to paragraph (6), the producer of a directory of subscribers shall ensure that it contains a statement drawing attention to the provisions of regulations 22, 23, 24, and 25.
6 Nothing in paragraph (5) shall apply in relation to a directory of subscribers which is comprised in an edition first published before the coming into force of these Regulations; and, for the purposes hereof, an edition of a directory which is revised after it was first published shall be treated as a new edition.

PART VI MISCELLANEOUS PROVISIONS

28 Security of telecommunications services
1 Subject to paragraph (2), a telecommunications service provider shall take technical and organisational measures which are appropriate to secure the security of the service he provides.
2 If necessary, the measures required by paragraph (1) shall be taken by a telecommunications service provider in conjunction with the provider of the relevant telecommunications network who shall comply with any reasonable requests made by the service provider for the purposes hereof.
3 Where, notwithstanding the taking of measures required hereby, there is a significant risk to the security of the relevant telecommunications network, the telecommunications service provider shall inform the subscribers concerned of–
(a) that risk;
(b) any measures appropriate to afford safeguards against that risk which they themselves might take, and
(c) the costs involved in the taking of such measures.
4 For the purposes of this regulation, measures shall only be taken to be appropriate if, having regard to–
(a) the state of technological development, and
(b) the cost of implementing the measures,
they are proportionate to the risks against which they would afford safeguards.
5 For the purposes of this regulation the security of a public telecommunications service or network shall not be taken to be at risk by reason of the intentional disclosure, or possibility of such disclosure, of any matter falling within subsection (1)(a) or (b) of section 45 of the Act of 1984 by a telecommunications service or network provider in a case or circumstances in which he would not be guilty of an offence under that section which, for the purposes of this paragraph, shall have effect as if–
(a) the reference in subsection (1) thereof to a person engaged in the running of a public telecommunications system were a reference to such a provider;
(b) for the words “that system”, in both places where they occur in subsection (1)(a) and (b) thereof, there were substituted the words “a public telecommunications system”; and
(c) the reference in subsection (1)(a) thereof to a message were a reference to a communication.
Section 45 was amended by section 11(1) of the Interception of Communications Act 1985 (c. 56).

29 Right to bills which are not itemised
At the request of the subscriber concerned, a telecommunications service provider shall only submit to him bills which are not itemised.

30 Itemised billing and privacy
1 The Secretary of State and the Director shall each have a duty, when exercising any function assigned to him by a provision of the Act of 1984 specified in paragraph (2), to have regard to the need to reconcile the rights of subscribers receiving itemised bills with the rights to privacy of calling users and called subscribers, for example by ensuring that sufficient alternative means for the making of calls or methods of paying therefor are available to such users and subscribers.
2 For the purposes of paragraph (1), the specified provisions of the Act of 1984 are sections 7, 8, 12, 13, 15, 16, 17, 18, 47, 48, 49, and 50.

31 Termination of unwanted automatic call forwarding
Where calls originally directed to another line are being automatically forwarded to a subscriber’s line as a result of action taken by a third party and the subscriber so requests the relevant telecommunications service provider (“the subscriber’s provider”), that provider shall ensure, without charge, that such forwarding ceases without any avoidable delay, and any other telecommunications service provider and any telecommunications network provider shall comply with any reasonable requests made by the subscriber’s provider for the purposes of this regulation.

32 National security
1 Nothing in any of the provisions of these Regulations shall require a telecommunications service or network provider to do, or refrain from doing, anything (including the processing of data) if exemption from the requirement in question is required for the purpose of safeguarding national security.
2 Subject to paragraph (4), a certificate signed by a Minister of the Crown certifying that exemption from any requirement of these Regulations is or at any time was required for the purpose of safeguarding national security shall be conclusive evidence of that fact.
3 A certificate under paragraph (2) may identify the circumstances in which it applies by means of a general description and may be expressed to have prospective effect.
4 Any person directly affected by the issuing of a certificate under paragraph (2) may appeal to the Tribunal against the certificate.
5 If on an appeal under paragraph (4), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may allow the appeal and quash the certificate.
6 Where in any proceedings under or by virtue of these Regulations it is claimed by a telecommunications service or network provider that a certificate under paragraph (2) which identifies the circumstances in which it applies by means of a general description applies in the circumstances in question, any other party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply in those circumstances and, subject to any determination under paragraph (7), the certificate shall be conclusively presumed so to apply.
7 On any appeal under paragraph (6), the Tribunal may determine that the certificate does not so apply.
8 In this regulation “the Tribunal” means the Data Protection Tribunal referred to in section 6 of the Data Protection Act 1998 and–
(a) subsections (8), (9), (10) and (12) of section 28 of that Act and Schedule 6 thereto shall apply for the purposes of, and in connection with, this regulation as if any references therein to sub-section (2), (4) or (6) of the said section 28 were, respectively, references to paragraph (2), (4) or (6) of this regulation and
(b) section 58 of that Act shall so apply as if the reference therein to the functions of the Tribunal under that Act included a reference to the functions of the Tribunal under paragraphs (4) to (7) of this regulation.

33 Legal requirements, law enforcement etc
Nothing in any of the provisions of these Regulations shall require a telecommunications service or network provider to do, or refrain from doing, anything (including the processing of data)–
(a) if compliance with the requirement in question–
(i) would be inconsistent with any requirement imposed by or under any enactment, by any rule of law or by the order of a court, or
(ii) would be likely to prejudice the prevention or detection of crime or the apprehension or prosecution of offenders; or
(b) if exemption from the requirement in question–
(i) is required for the purposes of, or in connection with, any legal proceedings (including prospective legal proceedings),
(ii) is necessary for the purposes of obtaining legal advice, or
(iii) is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

34 Transitory and transitional provisions
The provisions in Schedule 3 shall have effect.

PART VII COMPENSATION AND ENFORCEMENT

35 Compensation for failure to comply with requirements of Regulations
1 A person who suffers damage by reason of any contravention of any of the requirements of these Regulations by any other person shall be entitled to compensation from the other person for that damage.
2 In proceedings brought against a person by virtue of this regulation it shall be a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.

36 Enforcement—extension of Part V of the Data Protection Act 1998
1 The provisions of Part V of the Data Protection Act 1998 and of Schedules 6 and 9 thereto are hereby extended for the purposes of these Regulations and, for those purposes, shall have effect subject to the omissions and other modifications set out in Schedule 4.
2 In regulations 37 and 38, “enforcement functions” means the functions of the Data Protection Commissioner under the provisions referred to in paragraph (1) as extended thereby.
3 The provisions of this regulation and those of regulation 35 are without prejudice to each other.

37 Request that Commissioner exercise his enforcement functions
Where it is alleged that there has been contravention of any of the requirements of these Regulations either the Director or a person aggrieved by the alleged contravention may request the Commissioner to exercise his enforcement functions in respect of that contravention, but those functions shall be exercisable by him whether or not he has been so requested.

38 Technical advice to Commissioner
The Director shall comply with any reasonable request made by the Commissioner, in connection with his enforcement functions, for advice on technical and similar matters relating to telecommunications.
Parliamentary Under Secretary of State for Small Firms, Trade and Industry, Department of Trade and Industry 1999