Telecommunications
Law (Jersey) Amendment Regulations 2024
Made 10 September 2024
Coming into
force in accordance with Regulation 19
1 Amendment of the Telecommunications (Jersey)
Law 2002
These Regulations amend the Telecommunications (Jersey)
Law 2002.
2 Article 1
(interpretation) amended
In Article 1(1), after
the definition “service” there is inserted –
“ “signal” includes –
(a) anything
comprising speech, music, sounds, visual images, or communications or data of
any description; and
(b) signals
serving for the impartation of anything between persons, between a person and a
thing or between things, or for the actuation or control of apparatus,
and references to the conveyance of signals include references to
the transmission or routing of signals or of parts of signals;”.
3 Article 7
(duties of Minister and Authority) amended
In Article 7(1)
“primary” is deleted.
4 Heading to Part 4 (notice,
consultation and appeals) amended
For the heading to Part 4
there is substituted –
“LICENCES: notice, consultation and appeals”.
5 Article 17 (licence
fees) amended
In Article 17(1), after
“the functions of the Authority under this Law” there is inserted “, other than
its functions under Part 5A”.
6 Article 22
(general role of Authority) amended
After Article 22(1)(a)
there is inserted –
“(aa) the
security of public electronic communications networks and public electronic
communications services (as defined in Article 24A(1));”.
7 Part 5A (security of public
electronic communications networks and services) Articles 24A
to 24J (interpretation and designated vendor
directions) inserted
After Article 24 there
is inserted –
“Part 5A
security of PUBLIC
ELECTRONIC COMMUNICATIONS NETWORKS AND SERVICES
division 1 – interpretation
24A Interpretation
of this Part
(1) In
this Part (including Schedules 1, 2 and 3) –
“associated facility” means a
facility, element or service that is available for use, or has the potential to
be used, in association with the use of an electronic communications network or
electronic communications service (whether or not a network or service provided
by the person making the facility, element or service available) for the
purpose of –
(a) making possible the
provision of that network or service;
(b) making possible the
provision of other services provided by means of that network or service; or
(c) supporting the provision
of those other services;
“communications provider” means –
(a) a provider of an
electronic communications network; or
(b) a provider of an
electronic communications service;
“content service” means so
much of any service as consists in one or both of the following –
(a) the provision of material
with a view to its being comprised in signals conveyed by means of an
electronic communications network;
(b) the exercise of editorial
control over the contents of signals conveyed by means of such a network;
“designated vendor” means a
person designated by a designation notice;
“designated vendor direction”
has the meaning given in Article 24D(1);
“designation notice” has the
meaning given in Article 24B(1);
“electronic communications network” means –
(a) a transmission system for
the conveyance, by the use of electrical, magnetic or electro-magnetic energy,
of signals of any description (and a “transmission system” includes a
transmission system consisting of no more than a transmitter used for the
conveyance of signals); and
(b) any of the following as
are used, by the person providing the system and in association with it, for
the conveyance of the signals –
(i) apparatus comprised in
the system,
(ii) apparatus used for the
switching or routing of the signals,
(iii) software and stored data,
(iv) other resources,
including network elements that are not active;
“electronic
communications service” means a service of
any of the following types provided by means of an electronic communications
network, except so far as it is a content service –
(a) an internet access
service;
(b) a number-based
interpersonal communications service;
(c) any other service
consisting in, or having as its principal feature, the conveyance of signals,
such as a transmission service used for machine-to-machine services;
“internet access service”
means a service that provides access to the internet and thereby connectivity
to virtually all end points of the internet, irrespective of the network
technology and terminal equipment used;
“interpersonal communications service”
means a service that enables direct interpersonal and interactive exchange of
information by means of electronic communications networks between a finite
number of persons, where the persons initiating or participating in the
communication determine its recipient;
“number-based interpersonal
communications service” means an interpersonal communications service that –
(a) connects with publicly
assigned numbering resources, namely a number or numbers in a national or
international numbering plan; or
(b) enables communication
with a number or numbers in a national or international numbering plan;
“public
communications provider” means –
(a) a provider of a public
electronic communications network;
(b) a provider of a public
electronic communications service; or
(c) a
person who makes available facilities that are associated facilities by
reference to a public electronic communications network or a public electronic
communications service;
“public
electronic communications network” means an
electronic communications network provided wholly or mainly for the purpose of
making electronic communications services available to members of the public;
“public
electronic communications service” means an
electronic communications service that is provided so as to be available for
use by members of the public;
“security compromise”, in
relation to a public electronic communications network or a public electronic
communications service, has the meaning given in Article 24K(2).
(a) reference to the
provision of an electronic communications network includes reference to its
establishment, maintenance or operation;
(b) if one or more persons
are employed or engaged to provide a network or service under the direction or
control of another person, then a reference to the person by whom an electronic
communications network or electronic communications service is provided is to
be construed as a reference to that other person only;
(c) if one or more persons
are employed or engaged to make facilities available under the direction or
control of another person, then a reference to the person by whom associated
facilities are made available is to be construed as a reference to that other
person only.
(1) The
Minister may issue a notice (a “designation notice”) designating one or more
persons for the purposes of Article 24D.
(2) The
Minister may issue a designation notice only if the Minister considers that the
notice is necessary in the interests of the security of Jersey.
(3) In
considering whether to designate a person under paragraph (1), the matters
to which the Minister may have regard include –
(a) the
nature of the goods, services or facilities that are or might be supplied,
provided or made available by the person;
(b) the
quality, reliability and security of those goods, services or facilities or any
component of them (including the quality, reliability and security of their
development or production, or of the manner in which they are supplied,
provided or made available);
(c) the
reliability of the supply of those goods, services or facilities;
(d) the
quality and reliability of the provision of maintenance or support for those
goods, services or facilities;
(e) the
extent to which and the manner in which goods, services or facilities supplied,
provided or made available by the person are or might be used in Jersey;
(f) the
extent to which and the manner in which goods, services or facilities supplied,
provided or made available by the person are or might be used in other
countries or territories;
(g) the
identity of the persons concerned with –
(i) the development or
production of goods, services or facilities supplied, provided or made
available by the person, or any component of those goods, services or
facilities,
(ii) supplying
or providing those goods or services or making those facilities available,
(iii) providing
maintenance or support for those goods, services or facilities;
(h) the
identity of the persons who own or control, or are associated with –
(i) the person being
considered for designation,
(ii) a
person described in sub-paragraph (g);
(i) the country or territory
in which the registered office or anything similar, or any place of business,
of any of the following is situated –
(i) the person being
considered for designation,
(ii) any
of the persons described in sub-paragraph (g) or (h);
(j) the
conduct of any of the persons described in sub-paragraph (i) as it affects or might affect the national security of
any country or territory;
(k) any
other connection between a country or territory and any of the persons
described in sub-paragraph (g), (h) or (i);
(l) the
degree to which any of the persons described in sub-paragraph (g), (h) or (i) might be susceptible to being influenced or required to
act contrary to the interests of the security of Jersey.
(4) Before
issuing a designation notice, the Minister must, so far as it is reasonably
practicable to do so, consult every person proposed to be designated in the
notice.
(5) A
designation notice must specify the reasons for the designation.
(6) The
requirements in paragraphs (4) and (5) do not apply if or to the extent
that the Minister considers that carrying out the consultation, or specifying
reasons in the notice, would be contrary to the interests of the security of
Jersey.
(7) If
a designation notice is issued the Minister must, if or to the extent that it
is reasonably practicable to do so, send a copy to every person designated in
the notice.
(8) A
reference in this Article to a facility includes a reference to a facility,
element or service that is an associated facility.
24C Review, variation and
revocation of designation notices
(1) The Minister must review a designation
notice from time to time.
(2) The Minister may (whether or not as a
result of a review under paragraph (1)) –
(a) vary
a designation notice;
(b) revoke
a designation notice either wholly or in part.
(3) The Minister may vary a designation notice
only if the Minister considers that the designation notice as varied is
necessary in the interests of the security of Jersey.
(4) Before varying a designation notice, the
Minister must, so far as it is reasonably practicable to do so, consult every
person proposed to be designated in the notice as varied.
(5) If the Minister varies a designation
notice, the Minister must, if or to the extent that it is reasonably
practicable to do so, give notice of the variation to –
(a) every
person designated by the designation notice as it had effect before the
variation; and
(b) every
person designated by the designation notice as varied.
(6) A notice given under paragraph (5)
must specify –
(a) how
the designation notice is varied;
(b) the
reasons for the variation; and
(c) when
the variation, or each of them, comes into force.
(7) The requirements in paragraphs (4) and
(6)(b) do not apply if or to the extent that the Minister considers that
carrying out the consultation, or specifying reasons in the notice, would be
contrary to the interests of the security of Jersey.
(8) If the Minister revokes a designation
notice, the Minister must, if or to the extent that it is reasonably
practicable to do so, give notice of the revocation to every person designated
by the designation notice as it had effect before the revocation.
(9) A notice given under paragraph (8)
must specify –
(a) when
the revocation comes into force; and
(b) if
the designation notice is partly revoked, what part of the notice is revoked.
(10) If
the Minister varies or revokes a designation notice, the Minister must review
any designated vendor direction relating to a person designated in the
designation notice before the revocation or variation.
24D Designated
vendor directions
(1) The
Minister may give a direction (a “designated vendor direction”) to a public
communications provider imposing requirements on the provider with respect to
the use, in connection with a purpose mentioned in paragraph (6), of
goods, services or facilities supplied, provided or made available by a
designated vendor.
(2) The
Minister may give a designated vendor direction only if
the Minister considers that –
(a) the
direction is necessary in the interests of the security of Jersey; and
(b) the
requirements imposed by the direction are proportionate to what is sought to be
achieved by the direction.
(3) A
designated vendor direction must specify –
(a) the
designated vendor to which it relates;
(b) the
public communications provider or providers to which the designated vendor
direction is given;
(c) the
reasons for the designated vendor direction; and
(d) when
the designated vendor direction comes into force.
(4) Before
giving a designated vendor direction the Minister must, so far as it is
reasonably practicable to do so, consult –
(a) the
public communications provider or providers to which the proposed designated
vendor direction would be given; and
(b) any
person who would be specified as a designated vendor in the proposed designated
vendor direction.
(5) The
requirements in paragraphs (3)(c) and (4) do not apply if or to the extent
that the Minister considers that specifying reasons in the designated vendor
direction, or carrying out a consultation, would be contrary to the interests
of the security of Jersey.
(6) The
purposes referred to in paragraph (1) are –
(a) in
the case of a provider of a public electronic communications network, the
provision of that network;
(b) in
the case of a provider of a public electronic communications service, the
provision of that service;
(c) in
the case of a person who makes available facilities that are associated
facilities by reference to a public electronic communications network or public
electronic communications service, the making available of those facilities; or
(d) in
the case of a provider of a public electronic communications network or public
electronic communications service, enabling persons to make use of that network
or service.
(7) A
designated vendor direction –
(a) may
impose requirements that apply generally, or in specified circumstances;
(b) may
provide for exceptions to a requirement; and
(c) if
it imposes a requirement to do a thing, must specify the period within which
the thing must be done, which must be a period that appears to the Minister to
be reasonable.
(8) The
requirements that may be imposed by a designated vendor direction include
requirements –
(a) prohibiting
or restricting the use of goods, services or facilities supplied, provided or
made available by a designated vendor specified in the direction;
(b) prohibiting
the installation of those goods or the taking up of those services or
facilities;
(c) about
removing, disabling or modifying those goods or facilities;
(d) about
modifying those services;
(e) about
the manner in which those goods, services or facilities may be used.
(9) A
requirement imposed by a designated vendor direction may, among other things –
(a) relate
to the use of goods, services or facilities in connection with a specified
function of –
(i) the public electronic
communications network provided by the provider,
(ii) the
public electronic communications service provided by the provider, or
(iii) an
associated facility made available by the provider that is an associated
facility by reference to such a network or service;
(b) relate
to the use of goods, services or facilities in a specified part of –
(i) the public electronic
communications network provided by the provider,
(ii) the
public electronic communications service provided by the provider, or
(iii) an
associated facility made available by the provider that is an associated
facility by reference to such a network or service.
(10) A
requirement imposed by a designated vendor direction may make provision by
reference to, among other matters –
(a) the
source of goods, services or facilities that are supplied, provided or made
available by a designated vendor specified in the direction;
(b) when
goods, services or facilities were developed or produced (which may be before
the coming into force of this Article);
(c) when
goods, services or facilities were procured by, or supplied, provided or made
available to, the public communications provider (which may be before the coming
into force of this Article).
(11) A
public communications provider to which a designated vendor direction is given
must comply with the direction.
(12) In
this Article –
(a) reference
to a facility includes reference to a facility, element or service that is an
associated facility;
(b) “specified”
means specified in a designated vendor direction.
24E Review,
variation and revocation of designated vendor directions
(a) vary
a designated vendor direction;
(b) revoke
a designated vendor direction, whether wholly or in part.
(3) The
Minister may vary a designated vendor direction only if the Minister
considers that –
(a) the
direction as varied is necessary in the interests of the security of Jersey;
and
(b) the
requirements imposed by the direction as varied are proportionate to what is
sought to be achieved by the direction.
(4) Before
varying a designated vendor direction the Minister must, so far as it is
reasonably practicable to do so, consult –
(a) the
public communications provider or providers that would be subject to the
direction as proposed to be varied; and
(b) every
person who would be affected, as a designated vendor, by the direction as
proposed to be varied.
(5) If
the Minister varies a designated vendor direction, the Minister must give
notice to every public communications provider subject to the direction as
varied specifying –
(a) how
the designated vendor direction is varied;
(b) the
reasons for the variation; and
(c) when
the variation, or each of them, comes into force.
(6) The
requirements in paragraphs (4) and (5)(b) do not apply if or to the extent
that the Minister considers that carrying out a consultation, or specifying
reasons in the notice of variation, would be contrary to the interests of the
security of Jersey.
(7) If
the Minister revokes a designated vendor direction, the Minister must give
notice of the revocation to every public communications provider that was subject
to the direction as it had effect before the revocation, specifying –
(a) when
the revocation comes into force; and
(b) if
the designated vendor direction is partly revoked, what part of the direction
is revoked.
(1) The
Minister must, if or to the extent that it is reasonably practicable to do so –
(a) if a designated vendor
direction is given, send a copy of the direction to every designated vendor
specified in the direction;
(b) if notice of the
variation of a designated vendor direction is given, send a copy of the notice
to every designated vendor specified in the direction as varied;
(c) if a notice of the
revocation of a designated vendor direction is given, send a copy of the notice
to every designated vendor specified in the direction as it had effect before
the revocation.
(2) The
requirements in paragraph (1) do not apply in the case of a designated
vendor if the Minister considers that sending a copy of the direction, notice
of variation, or notice of revocation to that designated vendor would be
contrary to the interests of the security of Jersey.
(3) The
Minister may exclude from the copy of a direction or notice sent under
paragraph (1) anything the disclosure of which the Minister considers –
(a) would, or would be likely
to, prejudice to an unreasonable degree the commercial interests of any person;
or
(b) would be contrary to the
interests of the security of Jersey.
24G Laying before States Assembly
(1) The
Minister must lay a copy of the following before the States Assembly –
(a) a designated vendor
direction;
(b) a designation notice;
(c) a notice of the variation
or revocation of a designated vendor direction;
(d) a notice of the variation
or revocation of a designation notice.
(2) The
requirement in paragraph (1) does not apply if the Minister considers that
laying a copy of the direction or notice before the States Assembly would be
contrary to the interests of the security of Jersey.
(3) The
Minister may exclude from what is laid before the States Assembly anything that
the Minister considers if published –
(a) would, or would be likely
to, prejudice to an unreasonable degree the commercial interests of any person;
or
(b) would be contrary to the
interests of the security of Jersey.
24H Compliance with and enforcement of provisions
relating to designated vendor directions
Schedule 1 contains compliance and enforcement provisions in
relation to designated vendor directions, including in relation to Articles 24I and 24J.
(1) The
Minister may require a person listed in column 1 of the following table
not to disclose a matter listed in the corresponding row of column 2 of
the table to any other person without the permission of the Minister.
|
|
|
|
A public communications provider that
has been given a designated vendor direction
|
The contents of the designated
vendor direction, or of a part of the designated vendor direction specified
by the Minister
|
|
A designated vendor that has been
sent a copy of a designated vendor direction under Article 24F
|
The contents of the designated
vendor direction, or of a part of the designated vendor direction specified
by the Minister
|
|
A designated vendor
|
The contents of the designation
notice, or of a part of the designation notice specified by the Minister
|
|
A public communications provider that
has been given a notification of contravention under paragraph 5 or 11
of Schedule 1
|
The existence or contents of the
notification of contravention, or of a part of the notification of
contravention specified by the Minister
|
|
A public communications provider that
has been given a confirmation decision under paragraph 6 or 12 of
Schedule 1
|
The existence or contents of the
confirmation decision, or of a part of the confirmation decision specified by
the Minister
|
|
A person who has been given an
urgent enforcement direction under paragraph 15 of Schedule 1
|
The existence or contents of the
urgent enforcement direction, or of a part of the urgent enforcement
direction specified by the Minister
|
|
A person who has been given a
notice under paragraph 16(4)(a) or (7) of Schedule 1 in relation to the
confirmation of an urgent enforcement direction
|
The existence or contents of the
notice, or of a part of the notice specified by the Minister
|
|
A person consulted under Article 24B(4), 24C(4), 24D(4) or 24E(4)
|
The existence of the consultation
and any information disclosed to the person in the consultation, or of a part
of the consultation specified by the Minister and any information disclosed
to the person in that part of the consultation
|
(2) The
Minister may impose a requirement under paragraph (1)
not to disclose a matter only if the Minister considers that it would be
contrary to the interests of the security of Jersey for the matter to be
disclosed except as permitted by the Minister.
(3) If
a person (“P”) is subject to a requirement under paragraph (1) not to
disclose a matter, disclosure of that matter by an employee of P or a person
engaged in P’s business is to be regarded as a disclosure by P, unless P can
show that they took all reasonable steps to prevent that disclosure.
24J Power
of Minister to require information etc.
(a) to produce, generate or
obtain information for the purpose of providing it under paragraph (1);
(b) to collect or retain
information that the person would not otherwise collect or retain for the
purpose of providing it under paragraph (1);
(c) to process, collate or
analyse any information held by the person (including information the person
has been required to collect or retain) for the purpose of producing or
generating information to be provided under paragraph (1).
(3) The
persons falling within this paragraph are –
(a) a person who is or has
been a public communications provider;
(b) a person not falling
within paragraph (a) who appears to the Minister to have information
relevant to the exercise of the Minister’s functions under Articles 24B to 24G and 24I, and Schedule 1.
(4) The
information that may be required under paragraph (1) includes, in
particular, information about –
(a) the use, or proposed use,
of goods, services or facilities supplied, provided or made available by a
particular person or a particular description of person;
(b) goods, services or
facilities proposed to be supplied, provided or made available by a particular
person or a particular description of person;
(c) goods, services or
facilities proposed to be supplied, provided or made available by a person who
has not, or has not recently, supplied, provided or made available for use in
Jersey –
(i) goods, services or
facilities of that description, or
(ii) any goods, services or
facilities;
(d) the manner in which –
(i) a public electronic
communications network or a public electronic communications service is, or is
proposed to be, provided, or
(ii) facilities that are
associated facilities by reference to such a network or service are, or are
proposed to be, made available;
(e) future developments of a public
electronic communications network or a public electronic communications service
or associated facilities.
(5) The
Minister may require a person to provide information under this Article only by
serving a notice on the person that –
(a) describes the required
information; and
(b) sets out the Minister’s
reasons for requiring it.
(6) The
Minister may impose a requirement on a person under paragraph (2) only by
serving a notice on the person that –
(a) sets out the requirement;
and
(b) sets out the Minister’s
reasons for imposing it.
(7) The
requirements in paragraphs (5)(b) and (6)(b) do not apply if or to the
extent that the Minister considers that setting out reasons in the notice would
be contrary to the interests of the security of Jersey.
(8) The
Minister must not require the provision of information under this Article unless
the making of a demand for the information is proportionate to the use to which
the information is to be put in the carrying out of the Minister’s functions
under Articles 24B to 24G
and 24I, and Schedule 1.
(9) The
Minister must not impose a requirement on a person under paragraph (2) unless
the imposition of the requirement is proportionate to the use to which the
information required to be produced, generated, obtained, collected or retained
(including information required to be produced or generated by processing,
collating or analysing) is to be put in the carrying out of the Minister’s
functions under Articles 24B to 24G and 24I, and Schedule 1.
(10) The
Minister may require a person to provide information under this Article at the
times or in the circumstances specified by the Minister.
(11) A
person must comply with a requirement imposed under this Article in the manner
and within a reasonable period specified by the Minister.
(12) A
requirement to provide information under this Article does not require a person
to disclose information in respect of which a claim to legal professional
privilege could be maintained in legal proceedings.
(13) In
this Article –
(a) a reference to a facility
includes a reference to a facility, element or service that is an associated
facility;
(b) “specified” means
specified in a notice given by the Minister under this Article.”.
8 Part 5A (security of public
electronic communications networks and services) Articles 24K
to 24Z (security duties on
providers of public electronic communications networks and services) inserted
After Article 24J, as inserted by these Regulations, there is
inserted –
(1) The
provider of a public electronic communications network or a public electronic
communications service must take measures that are appropriate and
proportionate for the purposes of –
(a) identifying the risks of
security compromises occurring;
(b) reducing the risks of
security compromises occurring; and
(c) preparing for the
occurrence of security compromises.
(2) A
“security compromise”, in relation to a
public electronic communications network or a public electronic communications
service, means any of the following, unless it occurs as a result of conduct
described in paragraph (3) –
(a) anything that compromises
the availability, performance or functionality of the network or service;
(b) any unauthorised access
to, interference with, or exploitation of the network or service, or anything
that enables such access, interference or exploitation;
(c) anything that compromises
the confidentiality of signals conveyed by means of the network or service;
(d) anything that causes
signals conveyed by means of the network or service to be –
(i) lost,
(ii) unintentionally altered,
or
(iii) altered otherwise than by
or with the permission of the provider of the network or service;
(e) anything that occurs in
connection with the network or service and compromises the confidentiality of
data stored by electronic means;
(f) anything that occurs in
connection with the network or service and causes data stored by electronic
means to be –
(i) lost,
(ii) unintentionally altered,
or
(iii) altered otherwise than by
or with the permission of the person holding the data;
(g) anything that occurs in
connection with the network or service and causes a connected security
compromise.
(3) Conduct
described in this paragraph is conduct that –
(a) is required or authorised
under –
(b) is required or authorised
under any other enactment (whenever passed or made) that –
(i) makes provision that is
in the interests of the security of Jersey,
(ii) has
effect for the purpose of preventing or detecting crime, or of preventing
disorder, or
(iii) makes
provision that is in the interests of the economic well-being of Jersey so far
as those interests are also relevant to the interests of the security of Jersey;
(c) is
undertaken for the purpose of assisting a person in giving effect to a warrant
or authorisation that has been issued or given under any enactment (whenever
passed or made) that is described in sub-paragraph (b); or
(d) is undertaken for the
purpose of assisting –
(4) For
the purposes of paragraph (2)(g), “connected security compromise” –
(a) in relation to a public
electronic communications network, means a security compromise that occurs in
relation to another public electronic communications network or a public
electronic communications service;
(b) in relation to a public
electronic communications service, means a security compromise that occurs in
relation to a public electronic communications network or another public
electronic communications service.
24L Duty
to take specified security measures
(1) The
Minister may by Order provide that a provider of a public electronic
communications network or a public electronic communications service must take
specified measures.
(2) A
measure may only be specified if the Minister considers that taking that
measure would be appropriate and proportionate for a purpose mentioned in
Article 24K(1).
(3) In
this Article, “specified” means specified in an Order under paragraph (1).
(4) Nothing
in this Article or an Order under paragraph (1) affects the duty imposed under
Article 24K.
24M Duty to
take measures in response to security compromise
If a security compromise occurs in relation to a public electronic
communications network or a public electronic communications service –
(a) the provider of the
network or service must take any measures that are appropriate and
proportionate for the purpose of preventing adverse effects, on the network or
service or otherwise, arising from the security compromise; and
(b) if the security
compromise has an adverse effect on the network or service, the provider of the
network or service must take any measures that are appropriate and
proportionate for the purpose of remedying or mitigating that adverse effect.
24N Duty to
take specified measures in response to security compromise
(1) The
Minister may by Order provide that, if a security compromise of a specified
description occurs in relation to a public electronic communications network or
a public electronic communications service, the provider of the network or
service must take specified measures.
(2) The
Minister may by Order provide that, if a security compromise occurs in relation
to a public electronic communications network or a public electronic
communications service and has an adverse effect of a specified description on
the network or service, the provider of the network or service must take
specified measures.
(3) An
Order must not specify a measure –
(a) under paragraph (1) unless
the Minister considers that taking that measure would be appropriate and
proportionate for the purpose of preventing adverse effects, on the network or
service or otherwise, arising from a security compromise of the specified
description;
(b) under paragraph (2) unless
the Minister considers that taking that measure would be appropriate and
proportionate for the purpose of remedying or mitigating an adverse effect of
the specified description.
(4) In
this Article, “specified” means specified in an Order under paragraph (1)
or (2).
(5) Nothing
in this Article or an Order under paragraph (1) or (2) affects the duty
imposed under Article 24M.
24O Power
to issue code of practice
(a) issue one or more codes
of practice giving guidance about the measures to be taken under Articles 24K to 24N by the provider of a
public electronic communications network or a public electronic communications
service; and
(b) revise a code of practice
issued under this paragraph and issue the code of practice as revised.
(2) Before
issuing a code of practice the Minister must –
(a) publish a draft of the
code or a draft of the revisions of the existing code (as the case may be); and
(b) consult the following
about the draft –
(3) After
carrying out the consultation, and before issuing the code of practice, the
Minister must lay a copy of the code of practice before the States Assembly.
(4) If
the Minister issues a code of practice, the Minister must publish it.
(5) A
code of practice –
(a) may include transitional
and saving provisions;
(b) may specify the time of
its commencement, and may specify different commencement times for different
purposes; and
(c) if no time is specified
in accordance with sub-paragraph (b), comes into force at the time of its
publication under paragraph (4).
(6) The
Minister must publish a draft code of practice and a code of practice under
this Article in a manner that the Minister considers appropriate for bringing
it to the attention of the persons who, in the opinion of the Minister, are likely
to be affected by it.
24P Withdrawal
of code of practice
(a) publish notice of the
proposal to withdraw the code of practice; and
(b) consult the following
about the proposal –
(i) the Authority,
(ii) providers of public
electronic communications networks and providers of public electronic
communications services to which the code applies, and
(iii) any other persons that
the Minister considers appropriate.
(3) If
the Minister withdraws a code of practice the Minister must –
(a) publish a notice of the
withdrawal of the code; and
(b) lay a copy of that notice
before the States Assembly.
(4) A
notice of withdrawal –
(a) may include savings
provisions;
(b) may specify when the
withdrawal of the code of practice has effect, and may specify different
withdrawal times for different purposes; and
(c) if no time is specified
in accordance with sub-paragraph (b), has effect at the time of its
publication under paragraph (3)(a).
(5) The
Minister must publish a notice under this Article in a manner that the Minister
considers appropriate for bringing it to the attention of the persons who, in
the opinion of the Minister, are likely to be affected by it.
24Q Effect
of code of practice
(1) A
failure by the provider of a public electronic communications network or a
public electronic communications service to act in accordance with a provision
of a code of practice issued under Article 24O does
not of itself make the provider liable to legal proceedings before a court.
(2) In
any legal proceedings before a court, the court must take into account a
provision of a code of practice in determining any question arising in the
proceedings if –
(a) the question relates to a
time when the provision was in force; and
(b) the provision appears to
the court to be relevant to the question.
(3) The
Authority must take into account a provision of a code of practice in
determining any question arising in connection with the carrying out by the
Authority of a relevant function if –
(a) the question relates to a
time when the provision was in force; and
(b) the provision appears to
the Authority to be relevant to the question.
(4) For
the purposes of paragraph (3), a “relevant function” means a function conferred
on the Authority under Article 24V or any of paragraphs 1,
and 4 to 11, of Schedule 2.
24R Duty to
explain failure to act in accordance with code of practice
(1) Paragraph (2)
applies if the Authority has reasonable grounds for suspecting that the
provider of a public electronic communications network or a public electronic
communications service is failing, or has failed, to act in accordance with a
provision of a code of practice issued under Article 24O.
(2) If
this paragraph applies, the Authority may give a notification to the
provider –
(a) specifying the provision
of the code of practice;
(b) specifying the respects
in which the provider is suspected to be failing, or to have failed, to act in
accordance with that provision; and
(c) directing the provider to
give the Authority a statement that complies with paragraph (3) within a
reasonable period.
(3) A
statement complies with this paragraph if it –
(a) confirms that the
provider is failing, or has failed, to act in accordance with the provision of
the code of practice as specified in the notification, and explains the reasons
for the failure; or
(b) states that the provider
is not failing, or has not failed, to act in accordance with the provision of
the code of practice as specified in the notification, and explains the reasons
for that statement.
(4) A
provider given a direction under paragraph (2)(c) must comply with it within
the reasonable period specified in the notification.
(a) take
any steps as are reasonable and proportionate for the purpose of bringing the
relevant information, expressed in clear and plain language, to the attention
of persons who use the network or service and may be adversely affected by the
security compromise; and
(b) notify
the Authority of the relevant information.
(3) For
the purposes of paragraph (2), “relevant information” is –
(a) the existence of the risk
of the security compromise occurring;
(b) the nature of the
security compromise;
(c) the technical measures
that it may be reasonably practicable for persons who use the network or
service to take for the purposes of –
(i) preventing the security
compromise adversely affecting those persons,
(ii) remedying or mitigating
the adverse effect that the security compromise has on those persons; and
(d) the name and contact
details of a person from whom further information may be obtained about the
security compromise.
(4) The
Minister may by Order amend this Article to specify a time within which the provider
of a network or service must comply with that paragraph.
24T Duty
to inform of occurrence of security compromise
(1) The
provider of a public electronic communications network or a public electronic
communications service must inform the Authority as soon as reasonably
practicable of –
(a) every security compromise
that has a significant effect on the operation of the network or service;
(b) every security compromise
within Article 24K(2)(b) that puts any person in
a position to be able to bring about a further security compromise that would
have a significant effect on the operation of the network or service.
(2) In
determining for the purposes of this Article whether the effect that a security
compromise has, or would have, on the operation of a network or service is
significant, the following matters in particular must be taken into
account –
(a) the length of the period
during which the operation of the network or service is or would be affected;
(b) the number of persons who
use the network or service that are or would be affected by the effect on the
operation of the network or service;
(c) the size and location of
the geographical area within which persons who use the network or service are
or would be affected by the effect on the operation of the network or service;
(d) the extent to which
activities of persons who use the network or service are or would be affected
by the effect on the operation of the network or service.
(3) The
Minister may by Order amend this Article to specify a time within which the provider
of a public electronic communications network or a public electronic
communications service must comply with that paragraph.
24U Authority to inform others of
occurrence or risk of security compromise
(1) This
Article applies if the Authority considers that –
(a) there is a risk of a
security compromise occurring in relation to a public electronic communications
network or public electronic communications service; or
(b) a security compromise has
occurred in relation to a public electronic communications network or public
electronic communications service.
(2) The
Authority must inform the Minister of the risk or occurrence (as the case may
be) of the security compromise if the Authority considers that the security
compromise could result, or has resulted, in –
(a) a serious threat to the
safety of the public, to public health or to the security of Jersey;
(b) serious economic or
operational problems for persons who are communications providers or persons
who make associated facilities available; or
(c) serious economic or
operational problems for persons who use electronic communications networks,
electronic communications services or associated facilities.
(3) In
a case where the duty in paragraph (2) does not arise, the Authority may
inform the Minister of the risk or occurrence (as the case may be) of the
security compromise.
(4) The
Authority may inform any of the following about the risk or occurrence (as the
case may be) of the security compromise –
(a) a person who uses or has
used the network or service;
(b) a communications
provider;
(c) a person who makes
associated facilities available;
(d) an overseas regulator;
(e) the relevant department
of the Government of the United Kingdom;
(f) the European Union
Agency for Cybersecurity.
(5) In
paragraph (4)(d), “overseas regulator” means a person who, under the law
of a country or territory outside Jersey, has functions in relation to public
electronic communications networks or public electronic communications services
that correspond to functions that the Authority has in relation to such
networks or services.
(6) The
Authority may inform any person who uses or has used the network or service of
the technical measures that may be taken by that person for the purposes
of –
(a) preventing the security
compromise adversely affecting that person; or
(b) remedying or mitigating
the adverse effect that the security compromise has on that person.
(7) The
Authority may direct the provider of the network or service to take steps
specified in the direction for the purposes of –
(a) informing persons who use
or have used the network or service of the risk or occurrence (as the case may
be) of the security compromise;
(b) informing persons who use
or have used the network or service of the technical measures that may be taken
by those persons for a purpose mentioned in paragraph (6)(a) or (b).
(8) The
Authority may if it considers it to be in the public interest –
(a) inform the public of the
risk or occurrence (as the case may be) of the security compromise;
(b) inform the public of the
technical measures that may be taken by members of the public for a purpose
mentioned in paragraph (6)(a) or (b);
(c) direct the provider of
the network or service to do anything that the Authority could do under
sub-paragraph (a) or (b).
(9) The
provider of the network or service must comply with a direction given under paragraph (7)
or (8)(c) within the reasonable period specified in the direction.
24V General
duty of Authority to ensure compliance with security duties
24W Civil
liability for breach of security duties
(1) A
duty imposed under any of Articles 24K to 24N and 24S(2)(a) on a provider of a public electronic
communications network or a public electronic communications service is a duty
owed to every person who may be affected by a contravention of the duty.
(2) If
a duty is owed to a person under paragraph (1), the following are
actionable at the suit or instance of that person –
(a) a breach of the duty that
causes that person to sustain loss or damage;
(b) an
act that, by inducing a breach of the duty or interfering with its
performance, causes that person to sustain loss or damage;
(c) an act that is done
wholly or partly for achieving the result in sub-paragraph (b).
(3) If
a person brings proceedings under this Article, the person must notify the
Authority when proceedings are commenced.
(4) In
proceedings brought against a provider of a public electronic communications
network or a public electronic communications service under paragraph (2)(a),
it is a defence for the provider to show that it took all reasonable steps and
exercised all due diligence to avoid contravening the duty in question.
24X Limits
on duty to comply with security duties
A security duty imposed on a provider of a public electronic
communications network or a public electronic communications service under any
of Articles 24K to 24N, 24R to 24T, 24U(7),
(8)(c) and (9), and paragraphs 1(2)(a), (3), (4), (5) and (7) and 11 of
Schedule 2 does not apply in so far as compliance with the duty
would –
(a) result in a failure by
the provider to comply with a duty or prohibition imposed under an enactment
mentioned or described in Article 24K(3);
(b) prevent the provider from
giving effect to a warrant or authorisation that has been issued or given under
an enactment mentioned or described in Article 24K(3);
(c) prevent the provider from
assisting a person in giving effect to a warrant or authorisation that has been
issued or given under an enactment mentioned or described in Article 24K(3); or
(d) prevent the provider from
assisting a person in exercising a power conferred under Rules under Article 29
of the Prison
(Jersey) Law 1957.
(1) The
Authority must prepare a report (a “security report”) in respect of each of its
financial years, containing any information and advice that the Authority
considers may best assist the Minister in the formulation of policy in relation
to the security of public electronic communications networks and public
electronic communications services.
(2) The
Authority must send a security report to the Minister as soon as practicable
after the end of the financial year to which it relates and no later than 4 months
after the end of that year.
(3) Paragraphs (1)
and (2) apply in relation to the first security report prepared under this
Article with the modifications that the first security report must –
(a) relate to the financial
year in which this Article comes into force, and to the financial year
immediately following (“Y2”); and
(b) be sent to the Minister
as soon as practicable after the end of Y2 and no
later than 4 months after the end of Y2.
(4) Paragraph (3) and this paragraph expire at
the end of the financial year immediately following Y2.
(5) A
security report must in particular include –
(a) information about the
extent to which providers of public electronic communications networks and
public electronic communications services have complied during the reporting
period with the duties imposed on them under Articles 24K
to 24N, 24R to 24T, and paragraph 1(2)(a), (3), (4), (5) and (7) of
Schedule 2;
(b) information about the
extent to which providers of public electronic communications networks and
public electronic communications services have acted during the reporting
period in accordance with codes of practice issued under Article 24O;
(c) information about the
security compromises that the Authority has been informed of during the
reporting period under Article 24T;
(d) information about the
action taken by the Authority during the reporting period in response to
security compromises it has been informed of under Article 24T;
(e) information about the
extent to which and manner in which the Authority has exercised the functions
conferred on it under Articles 24R, 24U and 24V and Schedule 2
during the reporting period;
(f) information about any
particular risks to the security of public electronic communications networks
and public electronic communications services that the Authority has become
aware of during the reporting period;
(g) a statement of the number
of occasions during the financial year to which the report relates on which
premises have been entered in pursuance of a duty imposed under paragraph 1(3)(d)
of Schedule 2;
(h) any other information of
a kind specified in a direction given by the Minister.
(6) A
security report must not include personal data within the meaning given in
Article 2 of the Data Protection
(Jersey) Law 2018.
(7) The
Minister must lay a copy of a security report before the States Assembly as
soon as practicable after the Minister receives the report.
(8) The
Minister may –
(a) publish a security report
or any part of it in a manner that the Minister considers appropriate; or
(b) disclose a security
report or any part of it to any person performing functions of a public nature
for the purpose of enabling or assisting the performance of those functions.
(9) In
laying a copy of a security report before the States Assembly, and in publishing
or disclosing a security report or any part of a security report, the Minister –
(a) may
exclude anything that the Minister considers if published would be contrary to
the interests of the security of Jersey; and
(b) must
have regard to the need to exclude from publication or disclosure, so far as is
practicable, the matters that are confidential in
accordance with paragraph (10).
(10) A
matter is confidential under this paragraph if –
(a) it relates to the affairs
of a particular person; and
(b) publication or disclosure
of that matter would or might, in the Minister’s opinion, seriously and
prejudicially affect the interests of that person.
9 Part 5A (security of public
electronic communications networks and services) Articles 24ZA
to 24ZI (appeals, fees,
information and advice, directions and orders) inserted
“division 4 – appeals
24ZA Right of appeal
(1) A
person affected by a decision of the Authority under this Part, other
than a decision mentioned in paragraph (2), may appeal against
that decision to the Court.
(2) The
decisions in this paragraph are decisions –
(a) to initiate, bring or
carry on civil proceedings;
(b) to take preliminary steps
for the purpose of enabling criminal or civil proceedings to be initiated;
(c) relating to the making or
revision of a statement of policy under Article 24Y;
(d) relating to the making of
a security report under Article 24Z;
(e) relating to the making or
revision of a statement of policy under Article 24ZE;
(f) to require information
for the purpose of preparing a report under paragraph 2 of Schedule 1;
(g) to impose a duty by an
inspection notice under paragraph 4 of Schedule 1;
(h) to include an urgency
statement in an assessment notice given under paragraph 1 of Schedule 2.
(3) A
person who is required, by a confirmation decision given under paragraph 12
of Schedule 1, to pay a penalty, may appeal to the Court against the Minister’s
decision to impose that penalty.
(4) An
appeal under this Article must be made by sending the Court a notice of appeal –
(a) in accordance with Rules
of Court; and
(b) no later than 28 days
after the day on which the decision is made.
(5) A
notice of appeal must set out –
(a) the provision under which
the decision appealed against was taken; and
(b) the grounds of appeal,
which must be set out in sufficient detail to indicate –
(i) to what extent (if any)
the appellant contends that the decision appealed against was based on an error
of fact or was wrong in law or both, and
(ii) to what extent (if any)
the appellant is appealing against the exercise of a discretion by the
Authority.
(a) confirm
the decision appealed against;
(b) quash
the decision appealed against in whole or in part;
(c) if
it quashes the whole or part of the decision –
(i) remit the matter back to
the decision-maker with a direction to reconsider and make a new decision in
accordance with the ruling of the Court, or
(ii) substitute
for the decision any decision the decision-maker could have made.
(7) The
Court may make any orders that it thinks appropriate, including ancillary
orders and orders as to costs.
(8) The
power of the Court to make Rules of Court under Article 13 of the Royal Court
(Jersey) Law 1948 includes power to make rules dealing generally with all
matters of procedure and incidental matters arising in relation to appeals
under this Article.
(1) The
States may by Regulations amend this Part to provide for the Authority to
require public communications providers to pay fees to the Authority.
(2) Regulations
under paragraph (1) may in particular amend this Law to –
(a) provide for the Minister
by Order to specify –
(i) the total amount of fees
that may be required by the Authority from public communications providers in a
specified period,
(ii) that the total amount of
fees payable by public communications providers must be calculated by reference
to the Authority’s costs of performing its functions under this Part in
relation to a specified period (whether those costs are actual, projected,
direct or apportioned),
(iii) the amount of a fee to be
paid by a public communications provider,
(iv) how the amount of a fee
to be paid by a public communications provider must be calculated;
(b) specify the public
communications providers, or class of public communications provider, that may
be required to pay fees;
(c) specify the times at
which and the manner in which a fee must be paid;
(d) provide that a fee
required to be paid is recoverable as a civil debt due to the Authority.
(1) The
Authority may require a person falling within paragraph (3) to provide it
with any information that it reasonably requires for the purposes of carrying
out its functions under this Part including, in particular, information it
requires –
(a) for the purposes of
establishing whether a person, other than the Authority or the Minister, has
breached a requirement under this Part;
(b) for the purposes of
assessing the risk of a security compromise occurring in relation to a public
electronic communications network or a public electronic communications
service;
(c) for the purposes of
giving a notification under Article 24R;
(d) as a result of a
notification given under Article 24S or 24T;
(e) for the purposes of
preparing a report under Article 24Z;
(f) for the purposes of
carrying out its functions under paragraph 2 or 4 of Schedule 1;
(g) for the purposes of an
assessment under paragraph 1 of Schedule 2; or
(h) for the purposes of
carrying out its functions under paragraphs 4 to 11 of Schedule 2.
(2) The
Authority may require a person falling within paragraph (3) –
(a) to produce, generate or
obtain information for the purpose of providing it under paragraph (1);
(b) to collect or retain
information that the person would not otherwise collect or retain for the
purpose of providing it under paragraph (1);
(c) to process, collate or
analyse any information held by the person (including information the person
has been required to collect or retain) for the purpose of producing or
generating information to be provided under paragraph (1).
(3) The
persons falling within this paragraph are –
(a) a
person who is or has been a public communications provider;
(b) a person who supplies, or
has supplied, electronic communication apparatus;
(c) a person who makes, or
has made, any associated facilities available to others;
(d) a person not falling
within paragraph (a), (b) or (c) who appears to the Authority to have
information relevant to the exercise of its functions under this Part.
(4) The
information that may be required under paragraph (1) includes, in
particular, information about –
(a) the use, or proposed use,
of goods, services or facilities supplied, provided or made available by a
particular person or a particular description of person;
(b) goods, services or
facilities proposed to be supplied, provided or made available by a particular
person or a particular description of person;
(c) goods, services or
facilities proposed to be supplied, provided or made available by a person who
has not, or has not recently, supplied, provided or made available for use in
Jersey –
(i) goods, services or
facilities of that description, or
(ii) any goods, services or
facilities;
(5) The
Authority may require a person to provide information under this Article only by
serving a notice on the person that –
(a) describes the required
information; and
(b) sets out the Authority’s
reasons for requiring it.
(6) The
Authority may impose a requirement on a person under paragraph (2) only by
serving a notice on the person that –
(a) sets out the requirement;
and
(b) sets out the Authority’s
reasons for imposing it.
(7) The
requirements in paragraphs (5)(b) and (6)(b) do not apply if or to the extent
that the Authority considers that setting out reasons in the notice would be
contrary to the interests of the security of Jersey.
(8) The
Authority must not require the provision of information under this Article unless
the making of a demand for the information is proportionate to the use to which
the information is to be put in the carrying out of its functions under this
Part.
(9) The
Authority must not impose a requirement on a person under paragraph (2) unless
the imposition of the requirement is proportionate to the use to which the
information required to be produced, generated, obtained, collected or retained
(including information required to be produced or generated by processing,
collating or analysing) is to be put in the carrying out of its functions under
this Part.
(10) The
Authority may require a person to provide information under this Article at the
times or in the circumstances as it may specify.
(11) A
person must comply with a requirement imposed under this Article in the manner
and within the reasonable period that the Authority specifies.
(12) A
requirement to provide information under this Article does not require a person
to disclose information in respect of which a claim to legal professional
privilege could be maintained in legal proceedings.
(13) In
this Article –
(a) a reference to a facility
includes a reference to a facility, element or service that is an associated
facility;
(b) “specified” means
specified in a notice given by the Authority under this Article.
Schedule 3 contains compliance and enforcement provisions in
relation to the power of the Authority to require information under Article 24ZC.
24ZE Power of Authority to require information: statement
of policy
24ZF Information and advice in relation to this
Part
(1) The
Authority may publish any information and advice in relation to this Part as it
considers expedient for –
(2) Paragraph (1)
does not affect the requirement to publish a statement of policy under –
(a) Article 24Y;
(b) Article 24ZE.
(3) Publication
under paragraph (1) may be in such manner as the Authority considers
appropriate.
24ZG Power of Minister and Authority to disclose
documents and information obtained under this Part
(1) The
Minister may, for the purpose of the Minister’s functions under this Part, disclose
any document or information obtained in the exercise of the Minister’s functions
under this Part –
(a) to the Attorney General;
(b) to a member of the States
of Jersey Police Force or the Honorary Police;
(c) to the Authority;
(d) to a law officer of the
Crown for Guernsey or of the Crown for the Isle of Man;
(e) to
a department of the Government of the United Kingdom or the Government of any
other country or territory;
(f) to the Office of
Communications (“OFCOM”) established under the Communications Act 2003 of the
United Kingdom;
(g) with a view to
instituting, or otherwise for the purposes of, proceedings for an offence under
this Law; or
(h) with the consent of a
person who, in their own right, is entitled to the information or to possession
of the document, copy or extract, to a third party.
(a) to the Minister;
(b) to a member of the States
of Jersey Police Force or the Honorary Police;
(c) to a department of the
Government of the United Kingdom or the Government of any other country or
territory;
(d) to a public authority,
within the meaning given in Article 1(1) of the Data Protection
(Jersey) Law 2018, not falling within sub-paragraph (a) or (b);
(e) to OFCOM, and to any
other regulator in any other country or territory that appears to the Authority
to perform a similar function;
(f) with a view to
instituting, or otherwise for the purposes of, proceedings for an offence under
this Law; or
(g) with the consent of a
person who, in their own right, is entitled to the information or to possession
of the document, copy or extract, to a third party.
(3) But
the Minister and the Authority may only disclose information under paragraph (1)
or (2) if –
(a) the person disclosing the
information considers the disclosure is necessary –
(i) in the interests of the
security of Jersey, or
(ii) for purposes related to
the prevention or detection of crime, the investigation of an offence, or the
conduct of a prosecution; and
(b) the disclosure is
relevant and proportionate for the purposes of sub-paragraph (a).
(4) Disclosure
under this Article is not to be treated as a breach of any restriction imposed
by contract, enactment or otherwise.
(5) However,
nothing in this Article authorises disclosure that –
24ZH Power of Minister to give directions in
relation to this Part
(1) The
Minister may give written directions to the Authority in relation to the performance
by the Authority of its functions under this Part.
(2) The
Minister must not give a direction under paragraph (1) unless the Minister
considers that –
(a) the direction is
necessary in the interests of the security of Jersey; and
(b) the requirements imposed
by the direction are proportionate to what is sought to be achieved by the
direction.
(3) The
Authority must comply with a direction given under paragraph (1).
24ZI Orders in relation to calculation of maximum amount
of penalty under this Part
(1) The
Minister may by Order specify the manner in which the turnover of a person’s
business is to be calculated for the purposes of determining the maximum amount
of penalty that may be specified in a notification of contravention given under –
(a) paragraphs 5 and 11 of
Schedule 1;
(b) paragraph 4 of Schedule
2;
(c) paragraph 1 of Schedule
3.
(2) An
Order under paragraph (1) may specify any matter the Minister considers
appropriate, including –
(a) the business by reference
to which the turnover is to be calculated; and
(b) the time at which, or the
period for which, the turnover is to be calculated.”.
10 Article 54 (false
information) amended
In Article 54 –
(a) in paragraph (1) –
(i) in the opening words,
after “the Authority” there is inserted “, the Minister”,
(ii) in sub-paragraph (b),
for “the Authority for the purpose of carrying out its functions” there is substituted
“the Authority or the Minister for the purpose of carrying out their functions”;
(b) in paragraph (2),
after “the Authority” there is inserted “, the Minister”.
11 Article 60 (exclusion
of personal material in publications and annual reports) amended
In Article 60(1), for
“shall ensure the exclusion from” there is substituted “must ensure the
exclusion from any report prepared under Article 24Z,”.
12 Article 61 (limit on
disclosure in general) amended
In Article 61 –
(a) after paragraph (3)(c)
there is inserted –
“(ca) to enable the provider of a
public electronic communications network or a public electronic communications
service (as defined in Article 24A(1)) to
provide that network or service;”;
(b) after paragraph (4)
there is inserted –
“(5) This
Article does not apply in relation to disclosure by the Minister or the
Authority of any document or information obtained in the exercise of their
functions under Part 5A.”.
13 Article 66 (savings
and transitional and consequential provisions) amended
For the text of Article 66
there is substituted –
“Schedule 4 contains savings, transitional and consequential
provisions.”.
14 Schedule 1 (compliance
and enforcement in relation to designated vendor directions) inserted
After Article 67
there is inserted –
(1) If
the Minister has given a designated vendor direction to a public communications
provider and the direction has not been revoked, the Minister may from time to
time require the provider –
(a) to
prepare a plan setting out –
(i) the steps that the
public communications provider intends to take to comply with any requirements
imposed by the direction that the Minister specifies, and
(ii) the
timing of those steps;
(b) to
provide the plan to the Minister; and
(c) to
provide the plan to the Authority.
(2) The
Minister may specify the period within which a plan required under
sub-paragraph (1) must be provided to the Minister or the Authority, which
must be a period that appears to the Minister to be reasonable.
(3) A
public communications provider that is required by the Minister to prepare or
provide a plan in accordance with sub-paragraph (1) must comply with the
requirement.
(1) The
Minister may give the Authority a direction (a “monitoring direction”)
requiring it –
(a) to obtain information
relating to a specified public communications provider’s compliance with a
designated vendor direction;
(b) to prepare and send a
report to the Minister based on that information; and
(c) to provide to the
Minister on request the information on which a report falling within clause (b)
is based.
(2) The
Minister may give the Authority more than one monitoring direction in relation
to a designated vendor direction.
(3) The
information that the Authority may be required to obtain under sub-paragraph (1)(a)
is –
(a) information that would
assist the Minister in determining whether the provider has complied, is
complying or is preparing to comply with –
(i) the designated vendor
direction, or
(ii) a specified requirement
imposed by the designated vendor direction;
(b) information about a
specified matter that is relevant to compliance with a requirement imposed by
the designated vendor direction;
(c) if the provider has been
required to provide a plan under paragraph 1, information about whether
the provider is acting in accordance with the plan.
(4) A
monitoring direction may –
(a) require the Authority to
give the Minister separate reports on different matters;
(b) make provision about the
time or times at which the Authority must report to the Minister, including
provision requiring the Authority to give reports at specified intervals.
(5) A
monitoring direction may –
(a) make provision about the
form and content of a report; and
(b) in particular, require a
report to include –
(i) the Authority’s analysis
of information gathered by it, and
(ii) an explanation of that
analysis.
(6) The
Authority may exercise its powers to obtain information in a manner that it
considers appropriate for the purposes of preparing a report required by a
monitoring direction.
(7) The
Minister may vary or revoke a monitoring direction.
(8) The
Minister must consult the Authority before giving or varying a monitoring
direction.
(9) In
this paragraph, “specified” means specified in a monitoring direction.
(a) it relates to the affairs
of a person, and publication or disclosure of the matter would or might, in the
Minister’s opinion, seriously and prejudicially affect the interests of that person;
(b) it relates to the private
affairs of an individual, and publication or disclosure of the matter would or
might, in the Minister’s opinion, seriously and prejudicially affect the
interests of that individual.
(1) This
paragraph applies if the Minister has given the Authority a monitoring
direction and the monitoring direction has not been revoked.
(2) The
Authority may give a notice to the public communications provider to which the
monitoring direction relates (an “inspection notice”) for the purpose of
obtaining any of the information mentioned in sub-paragraph (3).
(3) The
information referred to in sub-paragraph (2) is information, in any form –
(a) that would assist the
Minister in determining whether the provider has complied or is complying with –
(i) the designated vendor
direction, or
(ii) a specified requirement
imposed by the designated vendor direction;
(b) about a specified matter that
is relevant to whether the provider has complied or is complying with a
requirement imposed by the designated vendor direction;
(c) that would assist the
Minister in determining whether the provider has complied or is complying with
a plan prepared in accordance with paragraph 1.
(4) An
inspection notice may require the public communications provider to take any of
the following actions –
(a) carry out surveys of a
specified description of –
(i) the public electronic
communications network provided by the provider,
(ii) the public electronic communications service provided by
the provider, or
(iii) the associated facilities
made available by the provider that are associated facilities by reference to the
public electronic communications network or public electronic communications
service provided by it;
(b) make arrangements of a
specified description for another person to carry out surveys of a specified
description of the network, service or associated facilities;
(c) make available for
interview specified persons or persons of a specified description who are
involved in the provision of the network or service or the making available of
the associated facilities and who are willing to be interviewed;
(d) permit an authorised
person to enter specified premises;
(e) permit an authorised
person to observe any operation taking place on the premises that relates to
the network, service or associated facilities;
(f) direct an authorised
person to equipment or other material on the premises that is of a specified
description;
(g) direct an authorised
person to documents on the premises that are of a specified description;
(h) assist an authorised
person to view information of a specified description that is capable of being
viewed using equipment on the premises;
(i) comply with a request
from an authorised person for a copy of the documents to which the person is
directed and a copy of the information the person is assisted to view;
(j) permit an authorised
person to inspect or examine the documents, information, equipment or material
to which the person is directed or that the person is assisted to view;
(k) provide an authorised
person with an explanation of those documents, information, equipment or
material.
(5) An
inspection notice must not require the public communications provider –
(a) to permit an authorised
person to enter domestic premises;
(b) to do anything that would
result in –
(i) the disclosure of
documents or information in respect of which a claim to legal professional
privilege could be maintained in legal proceedings, or
(ii) a disclosure of
documents or information that is prohibited under an enactment mentioned or
described in Article 24K(3).
(6) An
inspection notice must –
(a) in relation to each
requirement to take an action imposed by the notice, specify the time or times at
which, or period or periods within which, the action must be taken;
(b) provide information about
the consequences of failing to comply with a requirement imposed by the notice.
(7) A
time or period specified under sub-paragraph (6)(a) must not be a time
that falls or a period that begins before the end of the period of 28 days
beginning with the day on which the inspection notice is given.
(8) If
an inspection notice is given to a public communications provider, the provider
must not act in a way that defeats the purpose of the inspection notice.
(9) If
an inspection notice is given to a public communications provider, the provider
must pay the costs reasonably incurred by the Authority in connection with
obtaining information by means of the inspection notice.
(10) Any
costs payable under sub-paragraph (9) are recoverable as a civil debt due
to the Authority.
(11) The
Authority may, by giving a further notice to the public communications
provider –
(a) revoke an inspection
notice;
(b) vary an inspection notice
to make it less onerous.
(12) The
Authority must prepare a report in respect of each of its financial years,
containing a statement of the number of occasions during the financial year to
which the report relates on which premises have been entered in pursuance of a
duty imposed under sub-paragraph (4)(d).
(13) A
report under sub-paragraph (12) must be sent to the Minister as soon as
practicable after the end of the financial year to which it relates and no
later than 4 months after the end of that year.
(14) Sub-paragraphs (12)
and (13) apply in relation to the first report under sub-paragraph (12)
with the modifications that the first report must –
(a) relate to the financial
year in which this paragraph comes into force, and to the financial year
immediately following (“Y2”); and
(b) be sent to the Minister
as soon as practicable after the end of Y2 and no
later than 4 months after the end of Y2.
(15) Paragraph
(14) and this paragraph expire at the end of the financial year immediately
following Y2.
(16) The
Minister must lay a copy of a report under sub-paragraph (12) before the
States Assembly as soon as practicable after the Minister receives the report.
(17) In
this paragraph –
“authorised person” means an employee of, or person authorised by,
the Authority;
“domestic premises” means premises,
or a part of premises, used as a dwelling;
“financial year” has the meaning given in the Competition
Regulatory Authority (Jersey) Law 2001;
“specified” means specified in an inspection notice.
5 Notifications of
contravention
(1) The
Authority may give a public communications provider a notification (a
“notification of contravention”) if the Authority determines that there are reasonable
grounds for believing that the provider is contravening, or has contravened, a
duty imposed by an inspection notice or a duty imposed under paragraph 4(8).
(2) A
notification of contravention must –
(a) set out the Authority’s
determination;
(b) specify the duty and
contravention in respect of which that determination has been made;
(c) specify the period during
which the provider has an opportunity to make representations;
(d) specify the steps that
the Authority considers should be taken by the provider to –
(i) comply with the duty,
(ii) remedy the consequences of the
contravention;
(e) specify any penalty that
the Authority is minded to impose; and
(f) if the contravention is
serious, specify any direction that the Authority is minded to give under
paragraph 9.
(3) A
notification of contravention may be given in respect of more than one
contravention.
(4) If
a notification of contravention relates to more than one contravention, a
separate penalty may be specified under sub-paragraph (2)(e) in respect of
each contravention.
(5) If
a notification of contravention is given in respect of a continuing
contravention, it may be given in respect of any period during which the
contravention has continued.
(6) If
a notification of contravention relates to a continuing contravention, no more
than one penalty may be specified under sub-paragraph (2)(e) in respect of
the period of contravention specified in the notification of contravention.
(7) Despite
sub-paragraph (6), in relation to a continuing contravention, a penalty
may be specified in respect of each day on which the contravention continues
after –
(a) the giving of a
confirmation decision under paragraph 6(2) that requires immediate action;
or
(b) the expiry of a period
specified in the confirmation decision for complying with a requirement being
contravened.
(8) If
a notification of contravention has been given to a provider in respect of a
contravention of a duty (an “earlier notification”), the Authority may give a
further notification of contravention in respect of the same contravention of
that duty (a “subsequent notification”) only if –
(a) the contravention occurs
after the time the earlier notification is given;
(b) the contravention is a
continuing contravention and the subsequent notification is in respect of so
much of a period as falls after a period to which the earlier notification
relates; or
(c) the earlier notification
has been withdrawn without a penalty having been imposed in respect of the
contravention in respect of which the earlier notification was given.
(9) The
amount of a penalty that may be specified in a notification of contravention is
the amount that the Authority determines to be appropriate and proportionate to
the contravention in respect of which it is imposed, but must not exceed the
maximum amount specified in sub-paragraph (10).
(10) The maximum amount –
(a) in
the case of a penalty other than one specified in relation to a continuing
contravention under sub-paragraph (7) is 10% of the turnover of the public
communications provider’s business;
(b) in
the case of a penalty specified in relation to a continuing contravention under
sub-paragraph (7) is £10,000 per day.
(11) The
States may by Regulations amend the maximum amounts specified in sub-paragraph (10).
6 Notifications of
contravention: confirmation and enforcement
(1) This
paragraph applies if –
(a) a provider has been given
a notification of contravention under paragraph 5;
(b) the Authority has allowed
the provider an opportunity to make representations about the matters notified;
and
(c) the period allowed for
the making of representations has expired.
(a) give the provider a
decision confirming the imposition of requirements on the provider, or the
giving of a direction to the person, or both, in accordance with the
notification of contravention (a “confirmation decision”); or
(b) inform the provider no
further action will be taken in relation to the contravention specified in the
notification of contravention.
(3) The
Authority must not give the provider a confirmation decision unless, after
considering any representations, it is satisfied that the provider has
contravened a duty specified in the notification of contravention in one or
more of the ways specified in the notification of contravention.
(4) A
confirmation decision must be given to the provider without delay and must
include reasons for the Authority’s decision.
(5) A
confirmation decision may –
(a) require immediate action
by the provider –
(i) to comply with a requirement specified in
the notification of contravention, and
(ii) to remedy the
consequences of the contravention; or
(b) specify a period within
which the provider must comply with those requirements and remedy those
consequences.
(6) A
confirmation decision may –
(a) require the provider to
pay –
(i) the penalty specified in the notification
of contravention, or
(ii) a lesser penalty that
the Authority considers appropriate in the light of representations made by the
provider, and steps taken by the provider to comply with the duty specified in
the notification of contravention or to remedy the consequences of the
contravention; and
(b) specify the period within which the
penalty must be paid.
(7) The
provider must comply with a requirement imposed by a confirmation decision.
(8) The
Authority may enforce the provider’s duty under sub-paragraph (7) in civil
proceedings –
(a) for an injunction;
(b) for specific performance;
or
(c) for any other appropriate
remedy or relief.
(a) the
provider required to pay the penalty; or
(b) if
the provider is a body corporate, or association with separate legal
personality, a shareholder or officer of the entity whose actions led to the
imposition of the penalty.
7 Directions in urgent
cases
(1) The
Authority may give a direction to a provider if the Authority determines –
(a) that it is entitled to
give a notification of contravention under paragraph 5 to the provider;
(b) that there are reasonable
grounds for suspecting that the case is an urgent case; and
(c) that the urgency of the
case makes it appropriate for the Authority to take action under this
paragraph.
(2) A
case is an urgent case for the purposes of this paragraph if the contravention
has resulted in, or creates an immediate risk of –
(a) a serious threat to the
safety of the public, to public health or to the security of Jersey;
(b) serious economic or
operational problems for persons (other than the contravening provider) who are
communications providers or persons who make associated facilities available;
or
(c) serious economic or
operational problems for persons who make use of electronic communications
networks, electronic communications services or associated facilities.
(3) A
direction under sub-paragraph (1) may –
(4) A
direction under sub-paragraph (1) –
(a) must specify the
networks, services and facilities to which it relates; and
(b) unless it provides
otherwise, takes effect for an indefinite period beginning when it is given to
the provider.
(5) A
direction under sub-paragraph (1) –
(a) in providing for the
effect of a suspension or restriction to be postponed, may provide for it to
take effect only at a time determined by or in accordance with the terms of the
direction; and
(b) in connection with the
suspension or restriction contained in the direction or with the postponement
of its effect, may impose any conditions on the provider that appear to the
Authority to be appropriate for the purpose of protecting the provider’s
customers.
(6) Conditions
imposed under sub-paragraph (5)(b) may include a condition requiring the
making of payments to the provider’s customers –
(a) by way of compensation
for loss or damage suffered by them as a result of the direction; or
(b) in respect of annoyance,
inconvenience or anxiety to which they have been put in consequence of the
direction.
(7) The
Authority may revoke a direction under sub-paragraph (1) –
(a) with effect from the time
that the Authority directs;
(b) subject to compliance
with any requirements that the Authority specifies; and
(c) to the extent and in
relation to the networks, services or facilities, or parts of a network,
service or facility, that the Authority determines.
8 Directions in urgent
cases: confirmation
(1) As
soon as reasonably practicable after giving a direction under paragraph 7(1),
the Authority must give the provider –
(a) an opportunity to make
representations about the grounds on which the direction was given and its
effect; and
(b) an opportunity to propose
steps to remedy the situation.
(2) As
soon as practicable after the end of the period allowed by the Authority under
sub-paragraph (1) for making representations has ended, and in any event
by no later than the end of the period mentioned in sub-paragraph (3), the
Authority must determine –
(a) whether the contravention
providing the grounds for the giving of the direction did occur; and
(b) whether the circumstances
made it an urgent case justifying the giving of the direction.
(a) the period of 3 months
beginning with the day on which the direction was given; or
(b) if the Authority requires
a longer period to consider representations received or decides that it is
necessary to obtain additional information from the provider to make its
determination, a longer period, not exceeding 6 months beginning with the
day on which the direction was given, that the Authority determines.
(4) If
the Authority determines that the contravention did occur and that the
direction was justified, it may confirm the direction.
(5) If
the Authority determines that the direction was not justified, it must revoke
the direction.
(6) As
soon as reasonably practicable after making a determination described in
sub-paragraph (4) or (5), the Authority must notify the provider of its
determination.
(7) Conditions
imposed under paragraph 7(5)(b) have effect only if the direction is
confirmed under sub-paragraph (4).
9 Directions suspending
or restricting service provision
(1) The
Authority may give a direction to a provider –
(a) suspending the provision
of electronic communications networks or electronic communications services, or
the making available of associated facilities, by the provider (either
generally or in relation to particular networks, services or facilities); or
(b) restricting that provision
or making available of associated facilities in the respects set out in the
direction.
(2) A
direction under sub-paragraph (1) may only be given if –
(a) either Condition A or
Condition B is satisfied in relation to the provider; and
(b) the giving of a direction
is appropriate and proportionate to the contravention in respect of which it is
imposed.
(3) Condition
A is that –
(a) the provider is in
serious contravention of a duty mentioned in paragraph 5(1); and
(b) the proposed direction
has been notified to the provider under paragraph 5(2)(f) and confirmed by
a confirmation decision under paragraph 6.
(4) Condition
B is that –
(a) the provider has
repeatedly contravened a duty mentioned in paragraph 5(1); and
(b) an attempt by the
Authority to secure compliance with that duty, by the imposition of penalties
or the giving of notifications under paragraph 5 and confirmation
decisions under paragraph 6, or both, has failed.
(a) notified the provider of
the proposed direction and of the conditions (if any) that it is proposing to
impose by that direction;
(b) given the provider an
opportunity to make representations about the proposals and to propose steps to
remedy the situation; and
(c) considered every
representation and proposal made to it during the reasonable period that the
Authority determines to allow for the provider to take advantage of that
opportunity.
(a) as soon as practicable
after giving a direction under sub-paragraph (1) the Authority must give
the provider an opportunity to –
(i) make representations about the effect of
the direction and of any of its conditions, and
(ii) propose steps to remedy
the situation;
(b) as soon as practicable
after the period allowed by the Authority under clause (a) for making
representations has ended (and in any event within 3 months beginning with
the day on which the direction was given), the Authority must determine –
(i) whether the contravention providing the
grounds for the giving of the direction did occur, and
(ii) whether the circumstances
made it an urgent case justifying the giving of the direction.
(9) The
period of 3 months mentioned in sub-paragraph (8)(b) may be extended
by up to 3 months if the Authority requires additional time to consider
representations received or decides that it is necessary to obtain additional
information from the provider to make a determination under sub-paragraph (8)(b).
(10) A
case is an urgent case for the purposes of this paragraph if the
Authority –
(a) considers that it would
be inappropriate to allow time for the making and consideration of
representations, before giving a direction under sub-paragraph (1),
because the contraventions in question have resulted in, or create an immediate
risk of –
(i) a serious threat to the safety of the
public, to public health or to the security of Jersey,
(ii) serious economic or
operational problems for persons (apart from the contravening provider or
contravening supplier) who are communications providers or persons who make
associated facilities available, or
(iii) serious economic or
operational problems for persons who make use of electronic communications
networks, electronic communications services or associated facilities; and
(b) decides for that reason
to act in accordance with sub-paragraph (8), instead of sub-paragraph (7).
(11) A
direction under sub-paragraph (1) –
(a) must specify the
networks, services and facilities to which it relates; and
(b) unless it provides otherwise,
takes effect for an indefinite period beginning when it is given to the
provider.
(12) A
direction under sub-paragraph (1) –
(a) in providing for the
effect of a suspension or restriction to be postponed, may provide for it to
take effect only at a time determined by or in accordance with the terms of the
direction; and
(b) in connection with the
suspension or restriction contained in the direction or with the postponement
of its effect, may impose any conditions on the provider that appear to the
Authority to be appropriate for the purpose of protecting that provider’s customers.
(13) The
conditions mentioned in sub-paragraph (12)(b) may include a condition
requiring the making of payments –
(a) by way of compensation
for loss or damage suffered by the provider’s customers as a result of the
direction; or
(b) in respect of annoyance,
inconvenience or anxiety to which they have been put in consequence of the
direction.
(14) If
the Authority considers it appropriate to do so (whether or not in consequence
of representations or proposals made to it), it may revoke a direction under
this paragraph or modify its conditions –
(a) with effect from the time
that the Authority directs;
(b) subject to compliance
with any requirements that it specifies; and
(c) to the extent and in
relation to the networks, services or facilities, or parts of a network,
service or facility, that the Authority determines.
(15) For
the purposes of this paragraph there are repeated contraventions by a provider
of duties mentioned in paragraph 5(1) to the extent that –
10 Enforcement of
directions under paragraphs 7 and 9
(1) A
person commits an offence if they provide an electronic communications network
or electronic communications service, or make available any associated facility, in
contravention of a suspension or restriction contained in a direction under
paragraph 7 or 9.
(2) A
person guilty of an offence under sub-paragraph (1) is liable to a fine.
(3) Paragraphs 5
to 8 apply in relation to a contravention of conditions imposed by a direction
under paragraph 7 or 9 as they apply in relation to a contravention of a
duty mentioned in paragraph 5(1).
(a) a
requirement imposed by a designated vendor direction; or
(b) a
requirement under paragraph 1.
(2) A
notification of contravention must –
(a) set
out the Minister’s determination;
(b) specify
the requirement and contravention in respect of which the determination is
made;
(c) specify
the period during which the provider has an opportunity to make
representations;
(d) specify
the steps that the Minister considers should be taken by the provider to –
(i) comply
with the requirement,
(ii) remedy
the consequences of the contravention;
(e) specify
the penalty that the Minister is minded to impose.
(3) A
notification of contravention may be given in respect of more than one
contravention.
(4) If
a notification of contravention relates to more than one contravention, a
separate penalty may be specified under sub-paragraph (2)(e) in respect of
each contravention.
(5) If
a notification of contravention is given in respect of a continuing
contravention, it may be given in respect of any period during which the
contravention has continued.
(6) If
a notification of contravention relates to a continuing contravention, no more
than one penalty may be specified under sub-paragraph (2)(e) in respect of
the period of contravention specified in the notification of contravention.
(7) Despite
sub-paragraph (6), in relation to a continuing contravention, a penalty
may be specified in respect of each day on which the contravention continues
after –
(a) the
giving of a confirmation decision that requires immediate action in respect of
that contravention; or
(b) the
expiry of a period specified in the confirmation decision for complying with the
requirement being contravened.
(8) If
a notification of contravention has been given in respect of a contravention of
a requirement (an “earlier notification”), the Minister may give a further
notification of contravention in respect of the same contravention of that
requirement (a “subsequent notification”) only if –
(a) the
contravention occurs after the time the earlier notification is given;
(b) the
contravention is a continuing contravention and the subsequent notification is
in respect of so much of a period as falls after a period to which the earlier
notification relates; or
(c) the
earlier notification has been withdrawn without a penalty having been imposed
in respect of the contravention in respect of which the earlier notification
was given.
(9) The
amount of a penalty that may be specified in a notification
of contravention is the amount that the Minister determines to be appropriate
and proportionate to the contravention in respect of which it is imposed, but must
not exceed the maximum amount specified in sub-paragraph (10).
(10) The
maximum amount –
(a) in
the case of a penalty other than one specified in relation to a continuing
contravention under sub-paragraph (7) is 10% of the turnover of the public
communications provider’s business;
(b) in
the case of a penalty specified in relation to a continuing contravention under
sub-paragraph (7) is £10,000 per day.
(1) This
paragraph applies if –
(a) a
public communications provider has been given a notification of contravention
under paragraph 11;
(b) the
Minister has allowed the provider an opportunity to make representations about
the matters notified; and
(c) the
period allowed for the making of representations has expired.
(a) give
the provider a decision confirming the imposition of requirements on the provider
in accordance with the notification of contravention (a “confirmation
decision”); or
(b) inform
the provider that no further action will be taken in relation to the
contravention specified in the notification of contravention.
(3) The
Minister must not give the provider a confirmation decision unless, after
considering any representations, the Minister is satisfied that the provider
has contravened a requirement specified in the notification of contravention in
one or more of the ways specified in the notification of contravention.
(4) A
confirmation decision must be given to the provider without delay and must
include reasons for the Minister’s decision.
(5) A
confirmation decision may –
(a) require
immediate action by the provider –
(i) to
comply with a requirement specified in the notification of contravention, and
(ii) to
remedy the consequences of the contravention; or
(b) specify
a period within which the provider must comply with that requirement and remedy
those consequences.
(6) A
confirmation decision may –
(a) require the provider to pay –
(b) specify the period within which the penalty must be paid.
(7) The
provider must comply with a requirement imposed by a confirmation decision.
(8) The
Minister may enforce a provider’s duty under sub-paragraph (7) in civil
proceedings –
(a) for
an injunction;
(b) for
specific performance; or
(c) for
any other appropriate remedy or relief.
(9) If
a sum payable to the Minister as a penalty under this paragraph is not paid by
the date specified, the Minister may apply to the Court for an order to enforce
payment of the penalty.
(10) The
order of the Court may provide for all of the costs of, or incidental to, the
application to be borne by all or any of the following –
(a) the
provider required to pay the penalty; or
(b) if the provider is a body corporate, or association with separate
legal personality, a shareholder or officer of the entity whose actions led to
the imposition of the penalty.
13 Requirement not to disclose under Article 24I
(1) Paragraphs
11 and 12 apply in relation to a contravention by a person of a requirement
under Article 24I not to disclose a matter as they apply in relation to a
contravention by a public communications provider of a requirement imposed by a
designated vendor direction or a requirement under paragraph 1, but with
the modifications set out in sub-paragraphs (2) and (3).
(2) Paragraph
11 applies as if –
(a) for
the text in sub-paragraph (2)(d)(i) there were substituted “bring the
contravention to an end,”; and
(b) for
the text in sub-paragraph (2)(d)(ii) there were substituted “limit the
consequences of the contravention;”.
(3) Paragraph 12
applies as if –
(a) in
sub-paragraph (5) –
(i) for the text in clause (a)(i) there were substituted
“to bring the contravention to an end, and”,
(ii) for
the text in clause (a)(ii) there were substituted “to limit the consequences
of the contravention;”,
(iii) for
the text in clause (b) there were substituted “specify a period within
which the provider must bring that contravention to an end and limit those
consequences”,
(iv) in
the words following clause (b) for “comply with that requirement or
remedy” there were substituted “bring that contravention to an end or limit”;
(b) in
sub-paragraph (6)(a)(ii), for “comply with the requirement specified in
the notification of contravention or to remedy” there were substituted “bring
the contravention to an end or to limit”.
14 Requirement to provide information under Article 24J
Paragraphs 11 and 12 apply in relation to a contravention by
a person of a requirement under Article 24J as they apply in relation to a
contravention by a public communications provider of a requirement imposed by a
designated vendor direction or a requirement under paragraph 1.
(1) The
Minister may give a direction under this paragraph (an “urgent enforcement
direction”) to a person if the Minister determines that –
(a) there are reasonable
grounds for believing that the person is contravening, or has
contravened –
(i) a requirement imposed by a designated
vendor direction, or
(ii) a requirement not to
disclose imposed under Article 24I;
(b) there are reasonable
grounds for suspecting that the case is an urgent case; and
(c) the urgency of the case
makes it appropriate for the Minister to take action under this paragraph.
(2) A
case is an urgent case for the purposes of this paragraph if the contravention
has resulted in, or creates an immediate risk of –
(a) a serious threat to the
security of Jersey; or
(b) significant harm to the
security of a public electronic communications network, a public electronic
communications service or a facility that is an associated facility by reference
to such a network or service.
(3) An
urgent enforcement direction must –
(a) specify the requirement
and contravention in respect of which it is given;
(b) require the person to
take any steps falling within sub-paragraph (4) that are specified in the
direction;
(c) specify a period within
which those steps must be taken; and
(d) specify the Minister’s
reasons for giving the direction.
(4) The
steps falling within this sub-paragraph are the steps that the Minister has
determined are appropriate –
(a) to comply with the
requirement; or
(b) to remedy the
consequences of the contravention.
(5) The
requirement in sub-paragraph (3)(d) does not apply if or to the extent
that the Minister considers that specifying reasons in the direction would be
contrary to the interests of the security of Jersey.
(1) As
soon as reasonably practicable after giving an urgent enforcement direction
under paragraph 15, the Minister must –
(a) confirm the direction; or
(b) revoke the direction.
(2) The
Minister may confirm an urgent enforcement direction with or without
modifications.
(3) The
Minister may confirm an urgent enforcement direction only if the Minister has
determined that –
(a) the person is
contravening, or has contravened –
(i) a requirement imposed by a designated
vendor direction, or
(ii) a requirement not to
disclose imposed under Article 24I;
(b) the contravention has
resulted in, or creates an immediate risk of, a threat or harm described in paragraph 15(2)(a)
or (b); and
(c) it is appropriate to
confirm the urgent enforcement direction, with any modifications, to prevent,
reduce or remove that threat or harm or immediate risk.
(4) Before
confirming an urgent enforcement direction, the Minister must –
(a) give notice to the person
to whom the direction was given that the Minister proposes to confirm the
direction; and
(b) give the person –
(i) an opportunity to make representations
about the grounds on which the direction was given and its effect, and
(ii) an opportunity to propose
steps to remedy the situation.
(5) The
notice under sub-paragraph (4)(a) must –
(a) state that the Minister
proposes to confirm the direction;
(b) specify any proposed
modifications of the direction;
(c) specify the Minister’s
reasons for confirming the direction and for any modifications; and
(d) specify a reasonable
period for making representations.
(6) The
requirement in sub-paragraph (5)(c) does not apply if or to the extent
that the Minister considers that specifying reasons in the notice would be
contrary to the interests of the security of Jersey.
(7) As
soon as reasonably practicable after determining whether to confirm the
direction, the Minister must give notice of that
determination to the person to whom the direction was given.
(8) A
person who is given an urgent enforcement direction that has not been revoked
must comply with it, whether or not it has been confirmed.
(9) The
duty in sub-paragraph (8) is enforceable in civil proceedings by the
Minister –
(a) for an injunction;
(b) for specific performance;
or
(c) for any other appropriate
remedy or relief.”.
15 Schedule 2 (compliance
and enforcement in relation to security duties) inserted
After Schedule 1 as
inserted by these Regulations there is inserted –
(1) The
Authority may carry out, or arrange for another person to carry out, an assessment
of whether the provider of a public electronic communications network or a
public electronic communications service is complying, or has complied, with a
duty imposed on the provider under any of Articles 24K to 24N, 24S and 24T.
(2) If
an assessment under this paragraph is carried out, the provider of the network
or service concerned must –
(a) co-operate with the
assessment; and
(b) pay the costs reasonably
incurred by the Authority in connection with the assessment.
(3) The
Authority may give a notice (an “assessment notice”) to a provider of a network
or service, for the purposes of an assessment under this paragraph, requiring
the provider to –
(a) carry out specified tests
or tests of a specified description in relation to the network or service;
(b) make arrangements of a
specified description for another person to carry out specified tests or tests
of a specified description in relation to the network or service;
(c) make available for
interview specified persons or persons of a specified description who are
involved in the provision of the network or service and who are willing to be
interviewed;
(d) permit an authorised
person to enter specified premises;
(e) permit an authorised
person to observe any operation taking place on the premises that relates to
the network or service;
(f) direct an authorised
person to equipment or other material on the premises that is of a specified
description;
(g) direct an authorised
person to documents on the premises that are of a specified description;
(h) assist an authorised
person to view information of a specified description that is capable of being
viewed using equipment on the premises;
(i) comply with a request
from an authorised person for a copy of the documents to which the person is directed
and a copy of the information the person is assisted to view;
(j) permit an authorised
person to inspect or examine the documents, information, equipment or material
to which the person is directed or that the person is assisted to view;
(k) provide an authorised
person with an explanation of those documents, information, equipment or
material.
(4) The
references in sub-paragraph (3)(a) and (b) to tests in relation to the
network or service include references to –
(a) tests in relation to premises
used in connection with the provision of the network or service;
(b) tests in relation to
persons involved in the provision of the network or service.
(5) An
assessment notice may impose on the provider a duty to carry out, or to make
arrangements for another person to carry out, a test in relation to the network
or service that risks causing a security compromise, loss to a person or damage
to property only if the test consists of the use of techniques that might be
expected to be used by a person seeking to cause a security compromise.
(6) An
assessment notice must not impose on the provider –
(a) a duty to permit an
authorised person to enter domestic premises;
(b) a duty to do anything
that would result in the disclosure of documents or information in respect of
which a claim to legal professional privilege could be maintained in legal
proceedings.
(7) An
assessment notice must, in relation to each duty imposed by it, specify the
time or times at which, or period or periods within which, the duty must be
complied with.
(8) A
time or period specified under sub-paragraph (7) must not be a time that
falls, or a period that begins, before the end of the period within which an
appeal under Article 24ZA can be brought in respect of the assessment
notice (ignoring any power to extend the period within which an appeal could be
brought).
(9) If
an appeal under Article 24ZA is brought in respect of an assessment notice
or any provision of an assessment notice, the provider is not required to
comply with any duty imposed by the notice or the provision pending the
determination or withdrawal of the appeal.
(10) An
assessment notice must provide information about –
(a) the consequences of
failing to comply with a duty imposed by the notice; and
(b) the right of appeal in
respect of the notice under Article 24ZA.
(11) Any
costs payable under sub-paragraph (2)(b) are recoverable as a civil debt
due to the Authority.
(12) The
Authority may, by giving a further notice to the provider –
(a) revoke an assessment
notice;
(b) vary an assessment notice
to make it less onerous.
(a) “authorised person” means
an employee of, or person authorised by, the Authority;
(b) “domestic premises” means premises, or a part of premises, used as a dwelling;
(c) “specified” means
specified in the assessment notice.
2 Assessment notices:
urgency statements
(1) The
Authority may include a statement (an “urgency statement”) in an assessment
notice under paragraph 1, stating that in the opinion of the Authority it
is necessary for the provider to comply urgently with a duty imposed by the
notice.
(2) If
an assessment notice includes an urgency statement, the assessment notice must
also include –
(a) the Authority’s reasons
for reaching that opinion; and
(b) information about the
right of the provider to make an application to the Court under paragraph 3.
(3) If
an assessment notice includes an urgency statement –
(a) sub-paragraphs (8)
and (9) of paragraph 1 do not apply in relation to the duty mentioned in
sub-paragraph (1); and
(b) the time or period
specified under sub-paragraph (7) of paragraph 1 in relation to that
duty must not be a time that falls, or a period that begins, before the end of
the period of 14 days beginning with the day the assessment notice is
given.
(4) Paragraph (5)
applies if –
(a) the duty mentioned in sub-paragraph (1) is a duty to do
something mentioned in paragraph 15(3)(d) to (k); and
(b) within the period of 14 days
beginning with the day the assessment notice is given, an appeal under Article 24ZA
is brought in respect of the assessment notice or the provision of the notice
that imposes that duty.
(5) If
this paragraph applies, the provider of the network or service is not required
to comply with the duty pending the determination or withdrawal of the appeal.
3 Applications in
respect of urgency statements
(1) If
an assessment notice given to a provider under paragraph 1 includes an
urgency statement under paragraph 2, the provider may apply to the Court
for either or both of the following –
(a) the disapplication of the
urgency statement in relation to some or all of the duties imposed by the
assessment notice;
(b) a change to when, or
period within which, a duty imposed by the assessment notice must be complied
with.
(2) When
it determines an application under this paragraph, the Court may do any of the
following –
(a) direct that the
assessment notice is to have effect as if it did not contain the urgency
statement;
(b) direct that the inclusion
of the urgency statement is not to have effect in relation to a duty imposed by
the assessment notice;
(c) vary the assessment
notice by changing when, or the period within which, a duty imposed by the
assessment notice must be complied with;
(d) vary the assessment
notice by making other changes required to give effect to a direction under
clause (a) or (b) or in consequence of a variation under clause (c).
(3) The
decision of the Court on an application under this paragraph is final.
(4) The
power of the Court to make Rules of Court under Article 13 of the Royal Court
(Jersey) Law 1948 includes power to make rules dealing generally with all
matters of procedure and incidental matters arising in relation to applications
under this paragraph.
(1) The Authority may give the provider of a
public electronic communications network or a public electronic communications
service a notification (a “notification of contravention”) if the Authority
determines that there are reasonable grounds for believing that the provider is
contravening, or has contravened, a duty imposed under any of Articles 24K
to 24N, 24R to 24T, 24U(7), (8)(c) and (9), and paragraph 1(2)(a), (3),
(4), (5) and (7).
(2) A notification of contravention must –
(a) set
out the Authority’s determination;
(b) specify
the duty and contravention in respect of which that determination has been
made;
(c) specify
the period during which the provider has an opportunity to make
representations;
(d) specify
the steps that the Authority considers should be taken by the provider
to –
(i) comply
with the duty,
(ii) remedy
the consequences of the contravention;
(e) specify
any penalty that the Authority is minded to impose; and
(f) if
the contravention is serious, specify any direction that the Authority is
minded to give under paragraph 8.
(3) A notification of contravention may be
given in respect of more than one contravention.
(4) If a notification of contravention relates
to more than one contravention, a separate penalty may be specified under
sub-paragraph (2)(e) in respect of each contravention.
(5) If a notification of contravention is given
in respect of a continuing contravention, it may be given in respect of any
period during which the contravention has continued.
(6) If a notification of contravention relates
to a continuing contravention, no more than one penalty may be specified under
sub-paragraph (2)(e) in respect of the period of contravention specified
in the notification of contravention.
(7) Despite sub-paragraph (6), in relation
to a continuing contravention, a penalty may be specified in respect of each
day on which the contravention continues after –
(a) the
giving of a confirmation decision under paragraph 5(2) that requires
immediate action under paragraph 5(5)(a); or
(b) the
expiry of a period specified in the confirmation decision for complying with a
requirement being contravened.
(8) If a notification of contravention has been
given to a provider in respect of a contravention of a security duty (an
“earlier notification”), the Authority may give a further notification of
contravention in respect of the same contravention of that security duty (a
“subsequent notification”) only if –
(a) the
contravention occurs after the time the earlier notification is given;
(b) the
contravention is a continuing contravention and the subsequent notification is
in respect of so much of a period as falls after a period to which the earlier
notification relates; or
(c) the
earlier notification has been withdrawn without a penalty having been imposed
in respect of the contravention in respect of which the earlier notification was
given.
(9) The amount of a penalty that may be
specified in a notification of contravention is the amount that the Authority
determines to be appropriate and proportionate to the contravention in respect
of which it is imposed, but must not exceed the maximum amount specified in
sub-paragraph (10).
(10) The maximum amount –
(a) in
the case of a penalty other than one specified in relation to a continuing
contravention under sub-paragraph (7) is 10% of the turnover of the
provider’s business;
(b) in
the case of a penalty specified in relation to a continuing contravention under
sub-paragraph (7) is £10,000 per day.
(11) The States may by Regulations amend the
maximum amounts specified in sub-paragraph (10).
5 Notifications of
contravention: confirmation and enforcement
(1) This paragraph applies if –
(a) a
provider has been given a notification of contravention under paragraph 4;
(b) the
Authority has allowed the provider an opportunity to make representations about
the matters notified; and
(c) the
period allowed for the making of representations has expired.
(a) give
the provider a decision confirming the imposition of requirements on the
provider, or the giving of a direction to the person, or both, in accordance
with the notification of contravention (a “confirmation decision”); or
(b) inform
the provider no further action will be taken in relation to the contravention
specified in the notification of contravention.
(3) The Authority must not give the provider a
confirmation decision unless, after considering any representations, it is
satisfied that the provider has contravened a duty specified in the
notification of contravention in one or more of the ways specified in the
notification of contravention.
(4) A confirmation decision must be given to
the provider without delay and must include reasons for the Authority’s
decision.
(5) A confirmation decision may –
(a) require
immediate action by the provider –
(i) to
comply with a requirement specified in the notification of contravention, and
(ii) to
remedy the consequences of the contravention; or
(b) specify
a period within which the provider must comply with those requirements and
remedy those consequences.
(6) A confirmation decision may –
(a) require the provider to
pay –
(i) the
penalty specified in the notification of contravention, or
(ii) a
lesser penalty that the Authority considers appropriate in the light of
representations made by the provider, and steps taken by the provider to comply
with the duty specified in the notification of contravention or to remedy the
consequences of the contravention; and
(b) specify the period
within which the penalty must be paid.
(7) The provider must comply with a requirement
imposed by a confirmation decision.
(8) The Authority may enforce the provider’s
duty under sub-paragraph (7) in civil proceedings –
(a) for
an injunction;
(b) for
specific performance; or
(c) for
any other appropriate remedy or relief.
(9) If a sum payable to the Authority as a
penalty under this Article is not paid by the date specified, the Authority may
apply to the Court for an order to enforce payment of the penalty.
(10) The order of the Court may provide for all of
the costs of, or incidental to, the application to be borne by all or any of
the following –
(a) the
provider required to pay the penalty; or
(b) if
the provider is a body corporate, or association with separate legal
personality, a shareholder or officer of the entity whose actions led to the
imposition of the penalty.
6 Directions in urgent
cases
(1) The Authority may give a direction to a
provider if the Authority determines –
(a) that
it is entitled to give a notification of contravention under paragraph 4
to the provider;
(b) that
there are reasonable grounds for suspecting that the case is an urgent case;
and
(c) that
the urgency of the case makes it appropriate for the Authority to take action
under this paragraph.
(2) A case is an urgent case for the purposes
of this paragraph if the contravention has resulted in, or creates an immediate
risk of –
(a) a
serious threat to the safety of the public, to public health or to the security
of Jersey;
(b) serious
economic or operational problems for persons (other than the contravening
provider) who are communications providers or persons who make associated
facilities available; or
(c) serious
economic or operational problems for persons who make use of electronic
communications networks, electronic communications services or associated
facilities.
(3) A direction under sub-paragraph (1)
may –
(a) suspend
the provision of electronic communications networks or electronic
communications services, or the making available of associated facilities, by
the provider (either generally or in relation to particular networks, services
or facilities); or
(b) restrict
that provision or making available of associated facilities in the respects set
out in the direction.
(4) A direction under sub-paragraph (1) –
(a) must
specify the networks, services and facilities to which it relates; and
(b) unless
it provides otherwise, takes effect for an indefinite period beginning when it
is given to the provider.
(5) A direction under sub-paragraph (1) –
(a) in
providing for the effect of a suspension or restriction to be postponed, may
provide for it to take effect only at a time determined by or in accordance
with the terms of the direction; and
(b) in
connection with the suspension or restriction contained in the direction or
with the postponement of its effect, may impose any conditions on the provider that
appear to the Authority to be appropriate for the purpose of protecting the
provider’s customers.
(6) Conditions imposed under sub-paragraph (5)(b)
may include a condition requiring the making of payments to the provider’s customers –
(a) by
way of compensation for loss or damage suffered by them as a result of the
direction; or
(b) in
respect of annoyance, inconvenience or anxiety to which they have been put in
consequence of the direction.
(7) The Authority may revoke a direction under
sub-paragraph (1) –
(a) with
effect from the time that the Authority directs;
(b) subject
to compliance with any requirements that the Authority specifies; and
(c) to
the extent and in relation to the networks, services or facilities, or parts of
a network, service or facility, that the Authority determines.
7 Directions in urgent
cases: confirmation
(1) As soon as reasonably practicable after
giving a direction under paragraph 6(1), the Authority must give the
provider –
(a) an
opportunity to make representations about the grounds on which the direction
was given and its effect; and
(b) an
opportunity to propose steps to remedy the situation.
(2) As soon as practicable after the end of the
period allowed by the Authority under sub-paragraph (1) for making
representations has ended, and in any event by no later than the end of the
period mentioned in sub-paragraph (3), the Authority must determine –
(a) whether
the contravention providing the grounds for the giving of the direction did
occur; and
(b) whether
the circumstances made it an urgent case justifying the giving of the
direction.
(a) the
period of 3 months beginning with the day on which the direction was
given; or
(b) if
the Authority requires a longer period to consider representations received or
decides that it is necessary to obtain additional information from the provider
to make its determination, a longer period, not exceeding 6 months
beginning with the day on which the direction was given, that the Authority
determines.
(4) If the Authority determines that the
contravention did occur and that the direction was justified, it may confirm
the direction.
(5) If the Authority determines that the
direction was not justified, it must revoke the direction.
(6) As soon as reasonably practicable after
making a determination described in sub-paragraph (4) or (5), the
Authority must notify the provider of its determination.
(7) Conditions imposed under paragraph 6(5)
have effect only if the direction is confirmed under sub-paragraph (4).
8 Directions suspending
or restricting service provision
(1) The Authority may give a direction to a
provider –
(a) suspending
the provision of electronic communications networks or electronic communications
services, or the making available of associated facilities, by the provider
(either generally or in relation to particular networks, services or
facilities); or
(b) restricting
that provision or making available of associated facilities in the respects set
out in the direction.
(2) A direction under sub-paragraph (1)
may only be given if –
(a) either
Condition A or Condition B is satisfied in relation to the provider; and
(b) the
giving of a direction is appropriate and proportionate to the contravention in
respect of which it is imposed.
(3) Condition A is that –
(a) the
provider is in serious contravention of a security duty mentioned in paragraph 4(1);
and
(b) the
proposed direction has been notified to the provider under paragraph 4(2)(f)
and confirmed by a confirmation decision under paragraph 5(2).
(4) Condition B is that –
(a) the
provider has repeatedly contravened a security duty mentioned in paragraph 4(1);
and
(b) an
attempt by the Authority to secure compliance with that duty, by the imposition
of penalties or the giving of notifications under paragraph 4 and
confirmation decisions under paragraph 5, or both, has failed.
(5) If Condition A is satisfied, the Authority
must give the direction after the Authority gives the confirmation decision
mentioned in sub-paragraph (3)(b).
(6) If Condition B is satisfied, the Authority
must give the direction in accordance with the procedure set out in
sub-paragraphs (7) to (9).
(7) If Condition B is satisfied and the case is
not an urgent case the Authority must not give a direction under sub-paragraph (1)
unless it has –
(a) notified
the provider of the proposed direction and of the conditions (if any) that it
is proposing to impose by that direction;
(b) given
the provider an opportunity to make representations about the proposals and to
propose steps to remedy the situation; and
(c) considered
every representation and proposal made to it during the reasonable period that
the Authority determines to allow for the provider to take advantage of that
opportunity.
(a) as
soon as practicable after giving a direction under sub-paragraph (1) the
Authority must give the provider an opportunity to –
(i) make
representations about the effect of the direction and of any of its conditions,
and
(ii) propose
steps to remedy the situation;
(b) as
soon as practicable after the period allowed by the Authority under clause (a)
for making representations has ended (and in any event within 3 months
beginning with the day on which the direction was given), the Authority must
determine –
(i) whether
the contravention providing the grounds for the giving of the direction did
occur, and
(ii) whether
the circumstances made it an urgent case justifying the giving of the
direction.
(9) The period of 3 months mentioned in
sub-paragraph (8)(b) may be extended by up to 3 months if the
Authority requires additional time to consider representations received or
decides that it is necessary to obtain additional information from the provider
to make a determination under sub-paragraph (8)(b).
(10) A case is an urgent case for the purposes of
this paragraph if the Authority –
(a) considers
that it would be inappropriate to allow time for the making and consideration
of representations, before giving a direction under sub-paragraph (1),
because the contraventions in question have resulted in, or create an immediate
risk of –
(i) a
serious threat to the safety of the public, to public health or to the security
of Jersey,
(ii) serious
economic or operational problems for persons (other than the contravening
provider) who are communications providers or persons who make associated
facilities available, or
(iii) serious
economic or operational problems for persons who make use of electronic
communications networks, electronic communications services or associated
facilities; and
(b) decides
for that reason to act in accordance with sub-paragraph (8), instead of
sub-paragraph (7).
(11) A direction under sub-paragraph (1) –
(a) must
specify the networks, services and facilities to which it relates; and
(b) unless
it provides otherwise, takes effect for an indefinite period beginning when it
is given to the provider.
(12) A direction under sub-paragraph (1) –
(a) in
providing for the effect of a suspension or restriction to be postponed, may
provide for it to take effect only at a time determined by or in accordance
with the terms of the direction; and
(b) in
connection with the suspension or restriction contained in the direction or
with the postponement of its effect, may impose any conditions on the provider that
appear to the Authority to be appropriate for the purpose of protecting that
provider’s customers.
(13) The conditions mentioned in sub-paragraph (12)(b)
may include a condition requiring the making of payments –
(a) by
way of compensation for loss or damage suffered by the provider’s customers as
a result of the direction; or
(b) in
respect of annoyance, inconvenience or anxiety to which they have been put in
consequence of the direction.
(14) If the Authority considers it appropriate to
do so (whether or not in consequence of representations or proposals made to
it), it may revoke a direction under this paragraph or modify its
conditions –
(a) with
effect from the time that the Authority directs;
(b) subject
to compliance with any requirements that it specifies; and
(c) to
the extent and in relation to the networks, services or facilities, or parts of
a network, service or facility, that it determines.
(15) For the purposes of this paragraph there are
repeated contraventions by a provider of security duties to the extent
that –
(a) in
the case of a previous notification of contravention given to that provider
under paragraph 4, the Authority has given a confirmation decision to that
person under paragraph 5 in respect of the contravention;
(b) in
the period of 24 months following the giving of that confirmation
decision, one or more further confirmation decisions have been given to the
provider in respect of contraventions of a security duty mentioned in paragraph 4(1);
and
(c) the
previous confirmation decision and the subsequent ones all relate to contraventions
of the same security duty (whether the same contravention or different
contraventions).
9 Enforcement of
directions under paragraphs 6 and 8
(1) A person commits an offence if they provide
an electronic communications network or electronic communications service, or
make available any associated facility, in contravention of a suspension
or restriction contained in a direction under paragraph 6 or 8.
(2) A person guilty of an offence under
sub-paragraph (1) is liable to a fine.
(3) Paragraphs 4 to 7 apply in relation to
a contravention of conditions imposed by a direction under paragraph 6 or
8 as they apply in relation to a contravention of a security duty mentioned in
paragraph 4(1).
10 Enforcement of security duties:
proposal for interim steps
(1) This
paragraph applies if –
(a) the Authority determines
that there are reasonable grounds for believing that the provider of a public
electronic communications network or a public electronic communications service
is contravening or has contravened a duty imposed under any of Articles 24K
to 24N;
(b) the Authority either has
not commenced, or has commenced but not completed, enforcement action in
connection with the contravention;
(c) the Authority determines
that there are reasonable grounds for believing that either or both of the
following conditions are met –
(i) a security compromise has occurred as a
result of the contravention,
(ii) there is an imminent
risk of a security compromise or (as the case may be) a further security
compromise occurring as a result of the contravention; and
(d) the Authority determines
that, having regard to the seriousness or likely seriousness of the security
compromise or security compromises mentioned in clause (c), it is
reasonable to require the provider to take interim steps pending the completion
by the Authority of enforcement action in connection with the contravention.
(2) The
Authority may give a notification to the provider that –
(a) sets out the
determinations mentioned in sub-paragraph (1);
(b) specifies the interim
steps that the Authority considers the provider should be required to take
pending the completion by the Authority of enforcement action in connection
with the contravention; and
(c) specifies the period
during which the provider has an opportunity to make representations about the
matters notified.
(3) In
this paragraph and paragraph 11 –
(a) references to the
commencement by the Authority of enforcement action in connection with a
contravention are to the giving of a notification of contravention under
paragraph 4 in respect of the contravention; and
(b) references to the
completion by the Authority of enforcement action in connection with a
contravention are to the giving of a confirmation decision, or informing the
provider that no further action will be taken, in relation to the contravention
under paragraph 5(2).
(4) In
this paragraph “interim steps” means –
(a) in a case where the
Authority determines that there are reasonable grounds for believing that the
condition in sub-paragraph (1)(c)(i) is met, steps to –
(i) prevent adverse effects (on the network or
service or otherwise) arising from the security compromise,
(ii) remedy or mitigate any
adverse effects on the network or service arising from the security compromise;
(b) in a case where the
Authority determines that there are reasonable grounds for believing that the
condition in sub-paragraph (1)(c)(ii) is met, steps to –
(i) eliminate or reduce the risk of the
security compromise or (as the case may be) the further security compromise
occurring,
(ii) prevent adverse effects,
on the network or service or otherwise, arising from the security compromise or
(as the case may be) the further security compromise in the event it occurs.
11 Enforcement of security
duties: direction to take interim steps
(1) This
paragraph applies if –
(a) the provider of a public
electronic communications network or a public electronic communications service
has been given a notification under paragraph 10(2);
(b) the Authority has allowed
the provider an opportunity to make representations about the matters notified;
and
(c) the period allowed for
the making of representations has expired.
(a) direct the provider to
take all or any of the interim steps specified in the notification; or
(b) inform the provider that
a direction under clause (a) will not be given.
(3) The
Authority may give a direction under sub-paragraph (2)(a) only if, after
considering any representations, it is satisfied –
(a) that there are reasonable
grounds for believing that the contravention on the basis of which the
notification was given occurred;
(b) that there are reasonable
grounds for believing that either or both of the following conditions are
met –
(i) a security compromise has occurred as a
result of the contravention,
(ii) there is an imminent
risk of a security compromise or (as the case may be) a further security
compromise occurring as a result of the contravention; and
(c) that, having regard to
the seriousness or likely seriousness of the security compromise or security
compromises mentioned in sub-paragraph (b), it is reasonable to give the
direction.
(4) A
direction under sub-paragraph (2)(a) must –
(a) include a statement of
the Authority’s reasons for giving the direction; and
(b) in relation to each
interim step specified in the direction, specify the period within which the
step must be taken.
(5) A
direction under sub-paragraph (2)(a) is ineffective in so far as it would
require interim steps to be taken after the completion by the Authority of
enforcement action in connection with the contravention concerned.
(6) If
a direction under sub-paragraph (2)(a) has been given and has not been
revoked, the Authority must as soon as reasonably practicable –
(a) commence enforcement action
in connection with the contravention concerned, unless enforcement action was
commenced by the Authority before the direction was given; and
(b) complete enforcement
action in connection with the contravention concerned.
(7) A
direction under sub-paragraph (2)(a) may at any time –
(a) be revoked by the
Authority; or
(b) be varied by the
Authority to make it less onerous.
(8) A
provider of a public electronic communications network or a public electronic
communications service who is given a direction under sub-paragraph (2)(a)
must comply with it.
(9) The
duty in sub-paragraph (8) is enforceable in civil proceedings by the
Authority –
(a) for an injunction;
(b) for specific performance;
or
(c) for any other appropriate
remedy or relief.”.
16 Schedule 3 (compliance
and enforcement in relation to the power of Authority to
require information) inserted
After Schedule 2 as
inserted by these Regulations there is inserted –
“Schedule 3
(Article 24ZD)
COMPLIANCE AND ENFORCEMENT IN RELATION TO the power of the Authority
to require information under article 24zc
1 Notifications of
contravention
(1) The
Authority may give a person a notification (a “notification of contravention”) if
the Authority determines that there are reasonable grounds for believing that
the person is contravening, or has contravened, a
requirement imposed under Article 24ZC.
(2) A
notification of contravention must –
(a) set out the Authority’s
determination;
(b) specify the requirement
and contravention in respect of which that determination has been made;
(c) specify the period during
which the person has an opportunity to make representations;
(d) specify the steps that
the Authority considers should be taken by the person to comply with the requirement;
(e) specify any penalty that the Authority is minded to impose; and
(f) if the contravention is
serious, specify any direction that the Authority is minded to give under
paragraph 5.
(3) A
notification of contravention may be given in respect of more than one
contravention.
(4) If
a notification of contravention relates to more than one contravention, a
separate penalty may be specified under sub-paragraph (2)(e) in respect of
each contravention.
(5) If
a notification of contravention is given in respect of a continuing
contravention, it may be given in respect of any period during which the
contravention has continued.
(6) If
a notification of contravention relates to a continuing contravention, no more
than one penalty may be specified under sub-paragraph (2)(e) in respect of
the period of contravention specified in the notification of contravention.
(7) Despite
sub-paragraph (6), in relation to a continuing contravention, a penalty
may be specified in respect of each day on which the contravention continues
after –
(a) the giving of a
confirmation decision under paragraph 2(2) that requires immediate action
under paragraph 2(5)(a); or
(b) the expiry of a period
specified in the confirmation decision for complying with a requirement being
contravened.
(8) If
a notification of contravention has been given to a person in respect of a
contravention of a requirement imposed under Article 24ZC (an “earlier
notification”), the Authority may give a further notification of contravention
in respect of the same contravention of that requirement (a “subsequent
notification”) only if –
(a) the contravention occurs
after the time the earlier notification is given;
(b) the contravention is a
continuing contravention and the subsequent notification is in respect of so
much of a period as falls after a period to which the earlier notification
relates; or
(c) the earlier notification
has been withdrawn without a penalty having been imposed in respect of the
contravention in respect of which the earlier notification was given.
(9) The
amount of a penalty that may be specified in a notification of contravention is
the amount that the Authority determines to be appropriate and proportionate to
the contravention in respect of which it is imposed, but must not exceed the
maximum amount specified in sub-paragraph (10).
(10) The
maximum amount –
(a) in the case of a penalty
other than one specified in relation to a continuing contravention under
sub-paragraph (7) is 10% of the turnover of the person’s business;
(b) in the case of a penalty
specified in relation to a continuing contravention under sub-paragraph (7)
is £10,000 per day.
(11) The
States may by Regulations amend the maximum amounts specified in sub-paragraph (10).
2 Notifications of
contravention: confirmation and enforcement
(1) This
paragraph applies if –
(a) a person has been given a
notification of contravention under paragraph 1;
(b) the Authority has allowed
the person an opportunity to make representations about the matters notified;
and
(c) the period allowed for the
making of representations has expired.
(a) give the person a
decision confirming the imposition of requirements on the person, or the giving
of a direction to the person, or both, in accordance with the notification of
contravention (a “confirmation decision”); or
(b) inform the person no
further action will be taken in relation to the contravention specified in the
notification of contravention.
(3) The
Authority must not give the person a confirmation decision unless, after
considering any representations, it is satisfied that the person has
contravened a requirement specified in the notification of contravention in one
or more of the ways specified in the notification of contravention.
(4) A
confirmation decision must be given to the person without delay and must
include reasons for the Authority’s decision.
(5) A
confirmation decision may –
(a) require immediate action
by the person to
comply with a requirement specified in the notification of contravention; or
(b) specify a period within
which the person must comply with a requirement.
(6) A
confirmation decision may –
(a) require the person to
pay –
(i) the penalty specified in the notification
of contravention, or
(ii) a lesser penalty that
the Authority considers appropriate in the light of representations made by the
person, and steps taken by the person to comply with the requirement specified
in the notification of contravention; and
(b) specify the period
within which the penalty must be paid.
(7) The
person must comply with any requirement imposed by a confirmation decision.
(8) The
Authority may enforce the person’s duty under sub-paragraph (7) in civil
proceedings –
(a) for an injunction;
(b) for specific performance;
or
(c) for any other appropriate
remedy or relief.
(9) If
a sum payable to the Authority as a penalty under this Article is not paid by
the date specified, the Authority may apply to the Court for an order to
enforce payment of the penalty.
(10) The
order of the Court may provide for all of the costs of, or incidental to, the
application to be borne by all or any of the following –
(a) the person required to
pay the penalty; or
(b) if the person is a body
corporate, or association with separate legal personality, a shareholder or
officer of the entity whose actions led to the imposition of the penalty.
3 Directions in urgent
cases
(1) The
Authority may give a direction to a person if the Authority determines –
(a) that it is entitled to
give a notification of contravention under paragraph 1 to the person;
(b) that there are reasonable
grounds for suspecting that the case is an urgent case; and
(c) that the urgency of the
case makes it appropriate for the Authority to take action under this
paragraph.
(2) A
case is an urgent case for the purposes of this paragraph if the contravention
has resulted in, or creates an immediate risk of –
(a) a serious threat to the
safety of the public, to public health or to the security of Jersey;
(b) serious economic or operational
problems for persons (other than the contravening person) who are
communications providers or persons who make associated facilities available;
or
(c) serious economic or
operational problems for persons who make use of electronic communications
networks, electronic communications services or associated facilities.
(3) A
direction under sub-paragraph (1) may –
(a) suspend the provision of electronic
communications networks or electronic communications services, or the making
available of associated facilities, by the person (either generally or in
relation to particular networks, services or facilities); or
(b) restrict that provision or
making available of associated facilities in the respects set out in the
direction.
(4) A
direction under sub-paragraph (1) –
(a) must specify the
networks, services and facilities to which it relates; and
(b) unless it provides
otherwise, takes effect for an indefinite period beginning when it is given to
the person.
(5) A
direction under sub-paragraph (1) –
(a) in providing for the
effect of a suspension or restriction to be postponed, may provide for it to
take effect only at a time determined by or in accordance with the terms of the
direction; and
(b) in connection with the
suspension or restriction contained in the direction or with the postponement
of its effect, may impose any conditions on the person that appear to the
Authority to be appropriate for the purpose of protecting the person’s
customers.
(6) Conditions
imposed under sub-paragraph (5)(b) may include a condition requiring the
making of payments to the person’s customers –
(a) by way of compensation
for loss or damage suffered by them as a result of the direction; or
(b) in respect of annoyance,
inconvenience or anxiety to which they have been put in consequence of the
direction.
(7) The
Authority may revoke a direction under sub-paragraph (1) –
(a) with effect from the time
that the Authority directs;
(b) subject to compliance
with any requirements that the Authority specifies; and
(c) to the extent and in
relation to the networks, services or facilities, or parts of a network,
service or facility, that the Authority determines.
4 Directions in urgent
cases: confirmation
(1) As
soon as reasonably practicable after giving a person a direction under paragraph 3(1),
the Authority must give the person –
(a) an opportunity to make
representations about the grounds on which the direction was given and its
effect; and
(b) an opportunity to propose
steps to remedy the situation.
(2) As
soon as practicable after the end of the period allowed by the Authority under
sub-paragraph (1) for making representations has ended, and in any event
by no later than the end of the period mentioned in sub-paragraph (3), the
Authority must determine –
(a) whether the contravention
providing the grounds for the giving of the direction did occur; and
(b) whether the circumstances
made it an urgent case justifying the giving of the direction.
(a) the period of 3 months
beginning with the day on which the direction was given; or
(b) if the Authority requires
a longer period to consider representations received or decides that it is
necessary to obtain additional information from the person to make its
determination, a longer period, not exceeding 6 months beginning with the
day on which the direction was given, that the Authority determines.
(4) If
the Authority determines that the contravention did occur and that the
direction was justified, it may confirm the direction.
(5) If
the Authority determines that the direction was not justified, it must revoke
the direction.
(6) As
soon as reasonably practicable after making a determination described in
sub-paragraph (4) or (5), the Authority must notify the person of its
determination.
(7) Conditions
imposed under paragraph 3(5)(b) have effect only if the direction is
confirmed under sub-paragraph (4).
5 Directions suspending
or restricting service provision
(1) The
Authority may give a direction to a person who is a communications provider or
who makes associated facilities available –
(a) suspending the provision
of electronic communications networks or electronic communications services, or
the making available of associated facilities, by the person (either generally
or in relation to particular networks, services or facilities); or
(b) restricting that
provision or making available of associated facilities in the respects set out
in the direction.
(2) A
direction under sub-paragraph (1) may only be given if the Authority is
satisfied –
(a) that the person is or has
been in serious or repeated contravention of requirements imposed under Article 24ZC;
(b) in the case of a repeated
contravention, that an attempt by the Authority to secure compliance with the
contravened requirements, by the imposition of penalties or the giving of
notifications under paragraph 1 and confirmation decisions under paragraph 2,
or both, has failed.
(c) the giving of a direction
is appropriate and proportionate to the contravention in respect of which it is
given.
(3) If
the case is not an urgent case, the Authority must not give a direction under
sub-paragraph (1) unless it has –
(a) notified the person of
the proposed direction and of the conditions (if any) that it is proposing to
impose by that direction;
(b) given the person an
opportunity to make representations about the proposals and to propose steps to
remedy the situation; and
(c) considered every
representation and proposal made to it during the reasonable period that the
Authority determines to allow for the person to take advantage of that
opportunity.
(a) as soon as practicable
after giving a direction under sub-paragraph (1) the Authority must give
the person an opportunity to –
(i) make representations about the effect of
the direction and of any of its conditions, and
(ii) propose steps to remedy
the situation;
(b) as soon as practicable
after the period allowed by the Authority under clause (a) for making
representations has ended (and in any event within 3 months beginning with
the day on which the direction was given), the Authority must determine –
(i) whether the contravention providing the
grounds for the giving of the direction did occur, and
(ii) whether the circumstances
made it an urgent case justifying the giving of the direction.
(5) The
period of 3 months mentioned in sub-paragraph (4)(b) may be extended
by up to 3 months if the Authority requires additional time to consider
representations received or decides that it is necessary to obtain additional
information from the person to make a determination under sub-paragraph (4)(b).
(6) A
case is an urgent case for the purposes of this paragraph if the
Authority –
(a) considers that it would
be inappropriate to allow time for the making and consideration of
representations, before giving a direction under sub-paragraph (1),
because the contraventions in question have resulted in, or create an immediate
risk of –
(i) a serious threat to the safety of the
public, to public health or to the security of Jersey,
(ii) serious economic or
operational problems for persons (other than the contravening person) who are
communications providers or persons who make associated facilities available,
or
(iii) serious economic or
operational problems for persons who make use of electronic communications
networks, electronic communications services or associated facilities; and
(b) decides for that reason
to act in accordance with sub-paragraph (4), instead of sub-paragraph (3).
(7) A
direction under sub-paragraph (1) –
(a) must specify the
networks, services and facilities to which it relates; and
(b) unless it provides otherwise,
takes effect for an indefinite period beginning when it is given to the person.
(8) A
direction under sub-paragraph (1) –
(a) in providing for the
effect of a suspension or restriction to be postponed, may provide for it to
take effect only at a time determined by or in accordance with the terms of the
direction; and
(b) in connection with the
suspension or restriction contained in the direction or with the postponement
of its effect, may impose any conditions on the person that appear to the
Authority to be appropriate for the purpose of protecting that person’s
customers.
(9) The
conditions mentioned in sub-paragraph (8)(b) may include a condition
requiring the making of payments –
(a) by way of compensation
for loss or damage suffered by the person’s customers as a result of the
direction; or
(b) in respect of annoyance,
inconvenience or anxiety to which those customers have been put in consequence
of the direction.
(10) If
the Authority considers it appropriate to do so (whether or not in consequence
of representations or proposals made to it), it may revoke a direction under
this paragraph or modify its conditions –
(a) with effect from the time
that the Authority directs;
(b) subject to compliance
with any requirements that it specifies; and
(c) to the extent and in
relation to the networks, services or facilities, or parts of a network,
service or facility, that it determines.
(a) in the case of a previous
notification of contravention given to that person under paragraph 1, the
Authority has given a confirmation decision to that person under paragraph 2
in respect of the contravention;
(b) in the period of 24 months
following the giving of that confirmation decision, one or more further
confirmation decisions have been given to the person in respect of
contravention of a requirement imposed under Article 24ZC; and
(c) the previous confirmation
decision and the subsequent ones all relate to contraventions of requirements
imposed under Article 24ZC, whether or not the same contravention of the
same requirement.
6 Enforcement of
directions under paragraph 5
(1) A
person commits an offence if they provide an electronic communications network
or electronic communications service, or make available any associated facility,
in contravention of a suspension or restriction contained in a direction under
paragraph 5.
(2) A
person guilty of an offence under sub-paragraph (1) is liable to a fine.
(3) Paragraphs 1
to 4 apply in relation to a contravention of conditions imposed by a direction
under paragraph 5 as they apply in relation to a contravention of a requirement
under Article 24ZC.”.
17 Schedule (savings and
transitional and consequential provisions) renumbered
For the heading to the
Schedule there is substituted –
18 Consequential amendments
The States may by
Regulations amend any enactment (other than the Telecommunications
(Jersey) Law 2002) to make provision that they consider necessary or
expedient in consequence of the coming into force of these Regulations.
19 Citation and commencement
These Regulations may be
cited as the Telecommunications Law (Jersey) Amendment Regulations 2024 and
come into force on a day to be specified by the Minister for Sustainable Economic
Development by Order.