United KingdomSecurity Duties of Providers of Public Electronic Communications Networks and Services
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- Applies to the provider of a public electronic communications network or a public electronic communications service in the United Kingdom (reached by declaring that you provide telecom services); a provider within these duties is outside the essential-service duties of the Network and Information Systems Regulations 2018.
- Take such measures as are appropriate and proportionate for the purposes of identifying the risks of security compromises occurring, reducing those risks, and preparing for the occurrence of security compromises (section 105A(1)).
- When a security compromise occurs, take appropriate and proportionate measures to prevent adverse effects arising from it, and to remedy or mitigate any adverse effect it has on the network or service (section 105C(2) and (3)).
- As a network provider, take appropriate and proportionate measures to ensure that the network is designed, constructed, redesigned and maintained in a manner which reduces the risks of security compromises occurring (Security Measures Regulations 2022, regulation 3(1)).
- As a network provider, make a written record of the risks identified at least once in any period of 12 months, and keep each record for at least 3 years (Security Measures Regulations 2022, regulation 3(3)(b) and (4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Penalty structure
Section 105T(1) applies section 96B(5) as if the maximum penalty were 100,000 pounds per day for a contravention of a security duty, other than the duty in section 105I, which carries 50,000 pounds per day under section 105T(2).
- Rule
- Per violation only
- As of
- Currency
- GBP
- Per violation unit
- Day
- Per violation amount
- 100,000
Over one month of continuous breach, GBP 3,044,000.
Who enforces it
Enforcement body
OFCOM, which must seek to ensure that providers comply with the security duties (section 105M) and enforces them through sections 96A to 100, 102 and 103 of the Communications Act 2003 as applied by section 105S, with penalties capped by section 105T.
Settledness
- As of
What this law does
Section 105A requires the provider of a public electronic communications network or a public electronic communications service to take such measures as are appropriate and proportionate for the purposes of identifying, reducing and preparing for the risks of security compromises occurring. Section 105C requires the provider to take appropriate and proportionate measures to prevent adverse effects arising from a security compromise that occurs.
Section 105B lets the Secretary of State require by regulations that specified measures be taken. The Electronic Communications (Security Measures) Regulations 2022 do so from . Under section 105W a person who sustains loss or damage from a breach of the section 105A to 105D duties may sue with the consent of OFCOM.
When LexLint raises it
When your app profile says your app provides telecom services.