The Electronic Communications (Security Measures) Regulations 2022

Interpretation

2.  In these Regulations—

“the Act” means the Communications Act 2003;

“assessed security risk”, in relation to a public electronic communications network or a public electronic communications service, means the extent of the overall risk of security compromises occurring in relation to the network or service, as determined by an assessment under regulation 11(b);

“connected security compromise” has the same meaning as in section 105A of the Act(1);

“content”, in relation to a signal, means any element of the signal, or any data attached to or logically associated with the signal, which reveals anything of what might reasonably be considered to be the meaning (if any) of the communication, but—

(a)

any meaning arising from the fact of the signal or from any data relating to the transmission of the signal is to be disregarded, and

(b)

anything which is systems data as defined by section 263(4) of the Investigatory Powers Act 2016(2) is not content;

“incoming signal”, in relation to a public electronic communications network, means any signal received by the network;

“network provider” means a person who provides a public electronic communications network;

“security critical function”, in relation to a public electronic communications network or a public electronic communications service, means any function of the network or service whose operation is likely to have a material impact on the proper operation of the entire network or service or a material part of it;

“security permission”, in relation to a public electronic communications network or a public electronic communications service, means a permission given to a person in relation to the network or service that would give the person an opportunity to cause a security compromise to occur in relation to the network or service;

“sensitive data”, in relation to a public electronic communications network or a public electronic communications service, means—

(a)

data which controls, or significantly contributes to, a security critical function, or

(b)

data which is the content of a signal;

“service provider” means a person who provides a public electronic communications service;

“signal” has the same meaning as in section 32 of the Act.

(1)

Section 105A was inserted by S.I. 2011/1210 and substituted by section 1 of the Telecommunications (Security) Act 2021.

(2)

2016 c. 25.