United KingdomDuties of Public Electronic Communications Providers to Inform OFCOM and Users of Security Compromises
Communications Act 2003, c. 21, ss. 105J and 105K
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- Applies to the provider of a public electronic communications network or a public electronic communications service in the United Kingdom (reached by declaring that you provide telecom services), the same providers as the security duties of sections 105A to 105C.
- Inform OFCOM as soon as reasonably practicable of any security compromise that has a significant effect on the operation of the network or service, and of any security compromise that puts a person in a position to bring about a further security compromise with such an effect (section 105K(1)).
- In judging whether the effect is significant, take into account the length of the period of effect, the number of users affected, the size and location of the geographical area affected, and the extent to which users' activities are affected (section 105K(2)).
- Where there is a significant risk of a security compromise occurring, take reasonable and proportionate steps to bring the relevant information, in clear and plain language, to the attention of the users who may be adversely affected (section 105J(2)).
- Give users the existence of the risk, the nature of the security compromise, the technical measures they can reasonably take to prevent or mitigate its effect, and the name and contact details of a person who can give further information (section 105J(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 105T(1) applies section 96B(5) as if the maximum penalty were 100,000 pounds per day for a contravention of a security duty, other than the duty in section 105I, which carries 50,000 pounds per day under section 105T(2).
- Rule
- Per violation only
- As of
- Currency
- GBP
- Per violation unit
- Day
- Per violation amount
- 100,000
Over one month of continuous breach, GBP 3,044,000.
Who enforces it
Enforcement body
OFCOM, which must seek to ensure that providers comply with the security duties (section 105M) and enforces them through sections 96A to 100, 102 and 103 of the Communications Act 2003 as applied by section 105S, with penalties capped by section 105T.
Settledness
- As of
What this law does
Section 105K requires the provider of a public electronic communications network or a public electronic communications service to inform OFCOM as soon as reasonably practicable of any security compromise that has a significant effect on the operation of the network or service.
Section 105J requires the provider, where there is a significant risk of a security compromise occurring, to take reasonable and proportionate steps to bring the relevant information to the attention of the persons who use the network or service and may be adversely affected. The duties in sections 105J and 105K were inserted by the Telecommunications (Security) Act 2021 and took effect on .
When LexLint raises it
When your app profile says your app provides telecom services.