Electronic Communications Citation, commencement and interpretation 1 1 These Regulations may be cited as the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 and shall come into force on 26th May 2011. 2 In these Regulations “the 2003 Regulations ” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 . Amendment of the 2003 Regulations 2 The 2003 Regulations are amended as set out in the following regulations. 3 In regulation 2— a in the definition of “location data” after “electronic communications network” insert “or by an electronic communications service”; b after the definition of “ OFCOM ”, insert ““personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a public electronic communications service;”. 4 1 In regulation 5, after paragraph (1) insert— 1A The measures referred to in paragraph (1) shall at least— a ensure that personal data can be accessed only by authorised personnel for legally authorised purposes; b protect personal data stored or transmitted against accidental or unlawful destruction, accidental loss or alteration, and unauthorised or unlawful storage, processing, access or disclosure; and c ensure the implementation of a security policy with respect to the processing of personal data. 2 After paragraph (5) insert— 6 The Information Commissioner may audit the measures taken by a provider of a public electronic communications service to safeguard the security of that service. . 5 After regulation 5, insert— Personal data breach 5A 1 In this regulation and in regulations 5B and 5C, “service provider” has the meaning given in regulation 5(1). 2 If a personal data breach occurs, the service provider shall, without undue delay, notify that breach to the Information Commissioner. 3 Subject to paragraph (6), if a personal data breach is likely to adversely affect the personal data or privacy of a subscriber or user, the service provider shall also, without undue delay, notify that breach to the subscriber or user concerned. 4 The notification referred to in paragraph (2) shall contain at least a description of— a the nature of the breach; b the consequences of the breach; and c the measures taken or proposed to be taken by the provider to address the breach. 5 The notification referred to the paragraph (3) shall contain at least— a a description of the nature of the breach; b information about contact points within the service provider’s organisation from which more information may be obtained; and c recommendations of measures to allow the subscriber to mitigate the possible adverse impacts of the breach. 6 The notification referred to in paragraph (3) is not required if the service provider has demonstrated, to the satisfaction of the Information Commissioner that— a it has implemented appropriate technological protection measures which render the data unintelligible to any person who is not authorised to access it, and b that those measures were applied to the data concerned in that breach. 7 If the service provider has not notified the subscriber or user in compliance with paragraph (3), the Information Commissioner may, having considered the likely adverse effects of the breach, require it to do so. 8 Service providers shall maintain an inventory of personal data breaches comprising — a the facts surrounding the breach, b the effects of that breach, and c remedial action taken which shall be sufficient to enable the Information Commissioner to verify compliance with the provisions of this regulation. The inventory shall only include information necessary for this purpose. Personal data breach: audit 5B The Information Commissioner may audit the compliance of service providers with the provisions of regulation 5A. Personal data breach: enforcement 5C 1 If a service provider fails to comply with the notification requirements of regulation 5A, the Information Commissioner may issue a fixed monetary penalty notice in respect of that failure. 2 The amount of a fixed monetary penalty under this regulation shall be £1,000. 3 Before serving such a notice, the Information Commissioner must serve the service provider with a notice of intent. 4 The notice of intent must— a state the name and address of the service provider; b state the nature of the breach; c indicate the amount of the fixed monetary penalty; d include a statement informing the service provider of the opportunity to discharge liability for the fixed monetary penalty; e indicate the date on which the Information Commissioner proposes to serve the fixed monetary penalty notice; and f inform the service provider that he may make written representations in relation to the proposal to serve a fixed monetary penalty notice within the period of 21 days from the service of the notice of intent. 5 A service provider may discharge liability for the fixed monetary penalty if he pays to the Information Commissioner the amount of £800 within 21 days of receipt of the notice of intent. 6 The Information Commissioner may not serve a fixed monetary penalty notice until the time within which representations may be made has expired. 7 The fixed monetary penalty notice must state— a the name and address of the service provider; b details of the notice of intent served on the service provider; c whether there have been any written representations; d details of any early payment discounts; e the grounds on which the Information Commissioner imposes the fixed monetary penalty; f the date by which the fixed monetary penalty is to be paid; and g details of, including the time limit for, the service provider’s right of appeal against the imposition of the fixed monetary penalty. 8 A service provider on whom a fixed monetary penalty is served may appeal to the Tribunal against the issue of the fixed monetary penalty notice. 9 Any sum received by the Information Commissioner by virtue of this regulation must be paid into the Consolidated Fund. 10 In England and Wales and Northern Ireland, the penalty is recoverable— a if a county court so orders, as if it were payable under an order of that court; b if the High Court so orders, as if it were payable under an order of that court. 11 In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland. 6 1 In regulation 6— 2 In paragraph (1) for “use an electronic communications network to store information, or to”, substitute “store or”. 3 For paragraph (2)(b) substitute “(b) has given his or her consent”. 4 After paragraph (3) insert— 3A For the purposes of paragraph (2), consent may be signified by a subscriber who amends or sets controls on the internet browser which the subscriber uses or by using another application or programme to signify consent. 5 In paragraph (4)(a) omit “or facilitating”. 7 In regulation 7(3)(b) for “given his consent” substitute “previously notified the provider that he consents”. 8 In regulation 19(1) after “automated calling” insert “or communication”. 9 1 In regulation 23, at the end of paragraph (a) omit “or”. 2 After paragraph (b) insert— c where that electronic mail would contravene regulation 7 of the Electronic Commerce (EC Directive) Regulations 2002 ; or d where that electronic mail encourages recipients to visit websites which contravene that regulation. 10 After regulation 29 insert— 29A 1 Where regulations 28 and 29 apply, communications providers must establish and maintain internal procedures for responding to requests for access to users’ personal data. 2 Communications providers shall on demand provide the Information Commissioner with information about— a those procedures; b the number of requests received; c the legal justification for the request; and d the communications provider’s response. 11 In regulation 31— a in paragraph (1) after “provisions of Part V” insert “and sections 55A to 55E”. b at the end of paragraph (2) insert “and the functions set out in regulations 31A and 31B”. 12 After regulation 31 insert— Enforcement: third party information notices 31A 1 The Information Commissioner may require a communications provider (A) to provide information to the Information Commissioner by serving on A a notice (“a third party information notice”). 2 The third party information notice may require A to release information held by A about another person’s use of an electronic communications network or an electronic communications service where the Information Commissioner believes that the information requested is relevant information. 3 Relevant information is information which the Information Commissioner considers is necessary to investigate the compliance of any person with these Regulations. 4 The notice shall set out— a the information requested, b the form in which the information must be provided; c the time limit within which the information must be provided; and d information about the rights of appeal conferred by these Regulations. 5 The time limit referred to in paragraph (4)(c) shall not expire before the end of the period in which an appeal may be brought. If an appeal is brought, the information requested need not be provided pending the determination or withdrawal of the appeal. 6 In an urgent case, the Commissioner may include in the notice— a a statement that the case is urgent; and b a statement of his reasons for reaching that conclusion, in which case paragraph (5) shall not apply. 7 Where paragraph (6) applies, the communications provider shall have a minimum of 7 days (beginning on the day on which the notice is served) to provide the information requested. 8 A person shall not be required by virtue of this regulation to disclose any information in respect of— a any communication between a professional legal adviser and the adviser’s client in connection with the giving of legal advice with respect to the client’s obligations, liabilities or rights under these Regulations, or b any communication between a professional legal adviser and the adviser’s client, or between such an adviser or the adviser’s client and any other person, made in connection with or in contemplation of proceedings under or arising out of these Regulations (including proceedings before the Tribunal) and for the purposes of such proceedings. Enforcement: appeals 31B 1 A communications provider on whom a third party information notice has been served may appeal to the Tribunal against the notice. 2 Appeals shall be determined in accordance with section 49 of and Schedule 6 to the Data Protection Act 1998 as modified by Schedule 1 to these Regulations. 13 After regulation 36 insert— Review of implementation 37 1 Before the end of each review period, the Secretary of State must— a carry out a review of the implementation in the United Kingdom of the Directive; b set out the conclusions of the review in a report; and c publish the report. 2 In carrying out the review the Secretary of State must, so far as is reasonable, have regard to how the Directive is implemented in other member States. 3 The report must in particular— a set out the objectives intended to be achieved by the implementation in the United Kingdom of the Directive; b assess the extent to which those objectives are achieved; and c assess whether those objectives remain appropriate and, if so, the extent to which they could be achieved with a system that imposes less regulation. 4 “Review period” means— a the period of five years beginning with the 26th May 2011; and b subject to paragraph (5), each successive period of 5 years. 5 If a report under this regulation is published before the last day of the review period to which it relates, the following review period is to being with the day on which that report is published. 14 Schedule 1 to the 2003 Regulations is amended as follows— a In the title of the Schedule, after “Part V” insert “and sections 55A to 55E”; b After paragraph 2 insert “2A. Sections 41A to 41C shall be omitted.”; c In paragraph 4, at the end of the substituted subparagraph (c) for “; and” and paragraph (d) there shall be substituted— d in subsection (8), for “under this Act” there shall be substituted “under the Privacy and Electronic Communications (EC Directive) Regulations 2003”; e in subsection (8B), for “under this Act (other than an offence under section 47)” there shall be substituted “under the Privacy and Electronic Communications (EC Directive) Regulations 2003”; and f subsection (10) shall be omitted. ; d For paragraph 6 there shall be substituted— 6 In section 47— a in subsection (1), “special information notice” there shall be substituted “third party information notice”; and b in subsection (2), for “special information notice” there shall be substituted “third party information notice”. ; e After paragraph 8, insert— 8A In section 55A— a in subsection (1)— i for “data controller” there shall be substituted “person”, and ii for “of section 4(4) by the data controller” there shall be substituted “of the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003”; b in subsection (3), for “data controller” there shall be substituted “person”; c subsection (3A) shall be omitted; d in subsection (4), for “data controller” there shall be substituted “person”; e in subsection (9), the definition of “data controller” shall be omitted. 8B. In section 55B, for the words “data controller” (in subsections (1), (3) and (4)), there shall be substituted the word “person”. ; f In paragraph 9, for “Schedule (6)” substitute “Schedule 6”; g In paragraph 10 at the end of subparagraph (a) omit “; and” and subparagraph (b) and replace with— b in subparagraph (1A) for “data controller” there shall be substituted “person”, and for “requirement imposed by an assessment notice” there shall be substituted “the audit provisions in regulations 5 and 5B of the 2003 Regulations”; c in subparagraph (1B)— i for “data controller” there shall be substituted “person”; ii for “data protection principles” there shall be substituted “the requirements of the 2003 Regulations”; iii for “assessment notice” there shall be substituted “audit notice”; and iv the words “subparagraph (2) and” shall be omitted; d subparagraph (2) shall be omitted; e in subparagraphs (3)(d)(ii) and (3)(f) for the words “data controller” there shall be substituted “person”, and for the words “the data protection principles” there shall be substituted “the requirements of the 2003 Regulations”. ; h After paragraph 10 insert— 10A In paragraph 2(1A) of Schedule 9 for “assessment notice” there shall be substituted “audit notice”. Amendment of the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 15 The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 are amended as follows— a in regulation 3(1) omit “or implied”; b at the end of regulation 3(3) insert “as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws .”. Amendment of the Enterprise Act 2002 16 The Enterprise Act 2002 is amended as follows— a in section 213(5A), after paragraph (i) insert “(j) the Information Commissioner”; b in Schedule 13, after paragraph 11 insert— 12 Article 13 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications). . Amendment of the Enterprise Act 2002 (Part 8 Community Infringements Specified UK Laws) Order 2003 17 At the end of the Schedule to the Enterprise Act 2002 (Part 8 Community Infringements Specified UK Laws) Order 2003 insert— Article 13 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) Regulations 19 to 26 and 30 and 32 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 Ed Vaizey Parliamentary Under Secretary of State Department for Culture, Media and Sport 4th May 2011