acthub.

The Privacy and Electronic Communications (EC Directive) Regulations 2003

Sections96
2003 No. 2426

ELECTRONIC COMMUNICATIONS

The Privacy and Electronic Communications (EC Directive) Regulations 2003

Made18th September 2003
Laid before Parliament18th September 2003
Coming into force11th December 2003
The Secretary of State, being a Minister designated M1 for the purposes of section 2(2) of the European Communities Act 1972 M2 in respect of matters relating to electronic communications, in exercise of the powers conferred upon her by that section, hereby makes the following Regulations:C1C2

1 Citation and commencement

These Regulations may be cited as the Privacy and Electronic Communications (EC Directive) Regulations 2003 and shall come into force on 11th December 2003.

2 Interpretation

1 In these Regulations—
  • “bill” includes an invoice, account, statement or other document of similar character and “billing” shall be construed accordingly;
  • “call” means a connection established by means of a telephone service available to the public allowing two-way communication in real time , and a reference to making a call includes a reference to attempting to establish such a connection;
  • “communication” means any information transmitted to a finite number of parties by means of a public electronic communications service, but does not include information transmitted as part of a programme service, except to the extent that such information can be related to the identifiable subscriber or user receiving the information;
  • “communications provider” has the meaning given by section 405 of the Communications Act 2003 M3;
  • “consent” by a user or subscriber corresponds to the data subject’s consent in the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018);
  • “corporate subscriber” means a subscriber who is—
    1. a company within the meaning of section 735(1) of the Companies Act 1985 M4;
    2. a company incorporated in pursuance of a royal charter or letters patent;
    3. a partnership in Scotland;
    4. a corporation sole; or
    5. any other body corporate or entity which is a legal person distinct from its members;
  • “direct marketing” means the communication (by whatever means) of advertising or marketing material which is directed to particular individuals;
  • “the Directive” means Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) M5;
  • “electronic communications network” has the meaning given by section 32 of the Communications Act 2003 M6;
  • “electronic communications service” has the meaning given by section 32 of the Communications Act 2003;
  • “electronic mail” means any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient and includes messages sent using a short message service;
  • “enactment” includes an enactment comprised in, or in an instrument made under, an Act of the Scottish Parliament;
  • “individual” means a living individual and includes an unincorporated body of such individuals;
  • “the Information Commissioner” and “the Commissioner” both mean the Commissioner appointed under the Data Protection Act 2018;
  • “information society service” has the meaning given in regulation 2(1) of the Electronic Commerce (EC Directive) Regulations 2002 M7;
  • “location data” means any data processed in an electronic communications network or by an electronic communications service indicating the geographical position of the terminal equipment of a user of a public electronic communications service, including data relating to—
    1. the latitude, longitude or altitude of the terminal equipment;
    2. the direction of travel of the user; or
    3. the time the location information was recorded;
  • “OFCOM” means the Office of Communications as established by section 1 of the Office of Communications Act 2002 M8;
  • “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a public electronic communications service;
  • “programme service” has the meaning given in section 201 of the Broadcasting Act 1990 M9;
  • “public communications provider” means a provider of a public electronic communications network or a public electronic communications service;
  • “public electronic communications network” has the meaning given in section 151 of the Communications Act 2003 M10;
  • “public electronic communications service” has the meaning given in section 151 of the Communications Act 2003;
  • “subscriber” means a person who is a party to a contract with a provider of public electronic communications services for the supply of such services;
  • “traffic data” means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing in respect of that communication and includes data relating to the routing, duration or time of a communication;
  • “user” means any individual using a public electronic communications service; and
  • “value added service” means any service which requires the processing of traffic data or location data beyond that which is necessary for the transmission of a communication or the billing in respect of that communication.
1A In the application of these Regulations in relation to—
a information that is sent but not received,
b a communication that is transmitted but not received,
c an electronic mail that is sent but not received, or
d an unsuccessful attempt to make a call,
a reference to the recipient of the information, communication, electronic mail or call is to be read as a reference to the intended recipient.
2 Expressions used in these Regulations that are not defined in paragraph (1) and are defined in the Data Protection Act 1998 shall have the same meaning as in that Act.
F453 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4 Any reference in these Regulations to a line shall F53... be construed as including a reference to anything that performs the function of a line, and “connected”, in relation to a line, is to be construed accordingly.
5 References in these Regulations to a period expressed in hours, days, weeks, months or years are to be interpreted in accordance with Article 3 of the Periods of Time Regulation, except that Article 3(4) of that Regulation does not apply to the interpretation of a reference to a period in regulation 16A.
6 In paragraph (5), “the Periods of Time Regulation” means Regulation (EEC, Euratom) No. 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits.

3 Revocation of the Telecommunications (Data Protection and Privacy) Regulations 1999

The Telecommunications (Data Protection and Privacy) Regulations 1999 M11 and the Telecommunications (Data Protection and Privacy) (Amendment) Regulations 2000 M12 are hereby revoked.

4 Relationship between these Regulations and the data protection legislation

1 Nothing in these Regulations shall relieve a person of his obligations under the data protection legislation in relation to the processing of personal data.
2 In this regulation—
  • “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act);
  • “personal data” and “processing” have the same meaning as in Parts 5 to 7 of that Act (see section 3(2), (4) and (14) of that Act).
3 Regulation 2(2) and (3) (meaning of certain expressions) do not apply for the purposes of this regulation.

5 Security of public electronic communications services

1 Subject to paragraph (2), a provider of a public electronic communications service (“the service provider”) shall take appropriate technical and organisational measures to safeguard the security of that service.
1A The measures referred to in paragraph (1) shall at least—
a ensure that personal data can be accessed only by authorised personnel for legally authorised purposes;
b protect personal data stored or transmitted against accidental or unlawful destruction, accidental loss or alteration, and unauthorised or unlawful storage, processing, access or disclosure; and
c ensure the implementation of a security policy with respect to the processing of personal data.
2 If necessary, the measures required by paragraph (1) may be taken by the service provider in conjunction with the provider of the electronic communications network by means of which the service is provided, and that network provider shall comply with any reasonable requests made by the service provider for these purposes.
3 Where, notwithstanding the taking of measures as required by paragraph (1), there remains a significant risk to the security of the public electronic communications service, the service provider shall inform the subscribers concerned of—
a the nature of that risk;
b any appropriate measures that the subscriber may take to safeguard against that risk; and
c the likely costs to the subscriber involved in the taking of such measures.
4 For the purposes of paragraph (1), a measure shall only be taken to be appropriate if, having regard to—
a the state of technological developments, and
b the cost of implementing it,
it is proportionate to the risks against which it would safeguard.
5 Information provided for the purposes of paragraph (3) shall be provided to the subscriber free of any charge other than the cost to the subscriber of receiving or collecting the information.
F696 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5A Personal data breach

1 In this regulation and in regulations 5B and 5C, “service provider” has the meaning given in regulation 5(1).
2 If a personal data breach occurs, the service provider shall, without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify that breach to the Information Commissioner.
3 Subject to paragraph (6), if a personal data breach is likely to adversely affect the personal data or privacy of a subscriber or user, the service provider shall also, without undue delay, notify that breach to the subscriber or user concerned.
3A Where notification under paragraph (2) is not made within 72 hours, it must be accompanied by reasons for the delay.
4 The notification referred to in paragraph (2) shall contain at least a description of—
a the nature of the breach;
b the consequences of the breach; and
c the measures taken or proposed to be taken by the provider to address the breach.
5 The notification referred to the paragraph (3) shall contain at least—
a a description of the nature of the breach;
b information about contact points within the service provider’s organisation from which more information may be obtained; and
c recommendations of measures to allow the subscriber to mitigate the possible adverse impacts of the breach.
6 The notification referred to in paragraph (3) is not required if the service provider has demonstrated, to the satisfaction of the Information Commissioner that—
a it has implemented appropriate technological protection measures which render the data unintelligible to any person who is not authorised to access it, and
b that those measures were applied to the data concerned in that breach.
7 If the service provider has not notified the subscriber or user in compliance with paragraph (3), the Information Commissioner may, having considered the likely adverse effects of the breach, require it to do so.
8 Service providers shall maintain an inventory of personal data breaches comprising —
a the facts surrounding the breach,
b the effects of that breach, and
c remedial action taken
which shall be sufficient to enable the Information Commissioner to verify compliance with the provisions of this regulation. The inventory shall only include information necessary for this purpose.
F519 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F705B Personal data breach: audit

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

5C Personal data breach: enforcement

1 If a service provider fails to comply with the notification requirements of regulation 5A, the Information Commissioner may issue a fixed monetary penalty notice in respect of that failure.
2 The amount of a fixed monetary penalty under this regulation shall be £1,000.
3 Before serving such a notice, the Information Commissioner must serve the service provider with a notice of intent.
4 The notice of intent must—
a state the name and address of the service provider;
b state the nature of the breach;
c indicate the amount of the fixed monetary penalty;
d include a statement informing the service provider of the opportunity to discharge liability for the fixed monetary penalty;
e indicate the date on which the Information Commissioner proposes to serve the fixed monetary penalty notice; and
f inform the service provider that he may make written representations in relation to the proposal to serve a fixed monetary penalty notice within the period of 21 days beginning when the notice of intent is served.
5 A service provider may discharge liability for the fixed monetary penalty if he pays to the Information Commissioner the amount of £800 within the period of 21 days beginning when the notice of intent is received.
6 The Information Commissioner may not serve a fixed monetary penalty notice until the time within which representations may be made has expired.
7 The fixed monetary penalty notice must state—
a the name and address of the service provider;
b details of the notice of intent served on the service provider;
c whether there have been any written representations;
d details of any early payment discounts;
e the grounds on which the Information Commissioner imposes the fixed monetary penalty;
f the date by which the fixed monetary penalty is to be paid; and
g details of, including the time limit for, the service provider’s right of appeal against the imposition of the fixed monetary penalty.
8 A service provider on whom a fixed monetary penalty is served may appeal to the Tribunal against the issue of the fixed monetary penalty notice.
9 Any sum received by the Information Commissioner by virtue of this regulation must be paid into the Consolidated Fund.
10 In England and Wales F71..., the penalty is recoverable—
a if the county court so orders, as if it were payable under an order of that court;
b if the High Court so orders, as if it were payable under an order of that court.
11 In Scotland, the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom in Scotland.
12 In Northern Ireland, the penalty is recoverable—
a if a county court so orders, as if it were payable under an order of that court;
b if the High Court so orders, as if it were payable under an order of that court.
13 The Secretary of State may by regulations made by statutory instrument amend this regulation so as to substitute a different amount for the amount for the time being specified in paragraph (2) or (5).
14 Regulations under paragraph (13) may make transitional provision.
15 Before making regulations under paragraph (13), the Secretary of State must consult—
a the Information Commissioner, and
b such other persons as the Secretary of State considers appropriate.
16 A statutory instrument containing regulations under this regulation may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

6 Storing information in the terminal equipment of a subscriber or user

1 Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.
2 In paragraph (1) and Schedule A1—
a a reference (however expressed) to storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user includes a reference to instigating the storage or access, and
b except as otherwise provided, a reference (however expressed) to gaining access to information stored in the terminal equipment of a subscriber or user includes a reference to collecting or monitoring information automatically emitted by the terminal equipment.

6A Power to provide exceptions to regulation 6(1)

1 The Secretary of State may by regulations made by statutory instrument—
a amend these Regulations—
i by adding an exception to the prohibition in regulation 6(1), or
ii by omitting or varying an exception to that prohibition, and
b make consequential, supplementary, incidental, transitional, transitory or saving provision, including provision amending these Regulations.
2 Regulations under paragraph (1) may make different provision for different purposes.
3 Before making regulations under paragraph (1), the Secretary of State must consult—
a the Information Commissioner, and
b such other persons as the Secretary of State considers appropriate.
4 A statutory instrument containing regulations under paragraph (1) may not be made unless a draft of the instrument has been laid before, and approved by a resolution of, each House of Parliament.

7 Restrictions on the processing of certain traffic data

1 Subject to paragraphs (2) and (3), traffic data relating to subscribers or users which are processed and stored by a public communications provider shall, when no longer required for the purpose of the transmission of a communication, be—
a erased;
b in the case of an individual, modified so that they cease to constitute personal data of that subscriber or user; or
c in the case of a corporate subscriber, modified so that they cease to be data that would be personal data if that subscriber was an individual.
2 Traffic data held by a public communications provider for purposes connected with the payment of charges by a subscriber or in respect of interconnection payments may be processed and stored by that provider until the time specified in paragraph (5).
3 Traffic data relating to a subscriber or user may be processed and stored by a provider of a public electronic communications service if—
a such processing and storage are for the purpose of marketing electronic communications services, or for the provision of value added services to that subscriber or user; and
b the subscriber or user to whom the traffic data relate has previously notified the provider that he consents to such processing or storage; and
c such processing and storage are undertaken only for the duration necessary for the purposes specified in subparagraph (a).
4 Where a user or subscriber has given his consent in accordance with paragraph (3), he shall be able to withdraw it at any time.
5 The time referred to in paragraph (2) is the end of the period during which legal proceedings may be brought in respect of payments due or alleged to be due or, where such proceedings are brought within that period, the time when those proceedings are finally determined.
6 Legal proceedings shall not be taken to be finally determined—
a until the conclusion of the ordinary period during which an appeal may be brought by either party (excluding any possibility of an extension of that period, whether by order of a court or otherwise), if no appeal is brought within that period; or
b if an appeal is brought, until the conclusion of that appeal.
7 References in paragraph (6) to an appeal include references to an application for permission to appeal.

8 Further provisions relating to the processing of traffic data under regulation 7

1 Processing of traffic data in accordance with regulation 7(2) or (3) shall not be undertaken by a public communications provider unless the subscriber or user to whom the data relate has been provided with information regarding the types of traffic data which are to be processed and the duration of such processing and, in the case of processing in accordance with regulation 7(3), he has been provided with that information before his consent has been obtained.
2 Processing of traffic data in accordance with regulation 7 shall be restricted to what is required for the purposes of one or more of the activities listed in paragraph (3) and shall be carried out only by the public communications provider or by a person acting under his authority.
3 The activities referred to in paragraph (2) are activities relating to—
a the management of billing or traffic;
b customer enquiries;
c the prevention or detection of fraud;
d the marketing of electronic communications services; or
e the provision of a value added service.
4 Nothing in these Regulations shall prevent the furnishing of traffic data to a person who is a competent authority for the purposes of any provision relating to the settling of disputes (by way of legal proceedings or otherwise) which is contained in, or made by virtue of, any enactment.

9 Itemised billing and privacy

1 At the request of a subscriber, a provider of a public electronic communications service shall provide that subscriber with bills that are not itemised.
2 OFCOM shall have a duty, when exercising their functions under Chapter 1 of Part 2 of the Communications Act 2003, to have regard to the need to reconcile the rights of subscribers receiving itemised bills with the rights to privacy of calling users and called subscribers, including the need for sufficient alternative privacy-enhancing methods of communications or payments to be available to such users and subscribers.

10 Prevention of calling line identification – outgoing calls

1 This regulation applies, subject to regulations 15 and 16, to outgoing calls where a facility enabling the presentation of calling line identification is available.
2 The provider of a public electronic communications service shall provide users originating a call by means of that service with a simple means to prevent presentation of the identity of the calling line on the connected line as respects that call.
3 The provider of a public electronic communications service shall provide subscribers to the service, as respects their line and all calls originating from that line, with a simple means of preventing presentation of the identity of that subscriber’s line on any connected line.
4 The measures to be provided under paragraphs (2) and (3) shall be provided free of charge.

11 Prevention of calling or connected line identification – incoming calls

1 This regulation applies to incoming calls.
2 Where a facility enabling the presentation of calling line identification is available, the provider of a public electronic communications service shall provide the called subscriber with a simple means to prevent, free of charge for reasonable use of the facility, presentation of the identity of the calling line on the connected line.
3 Where a facility enabling the presentation of calling line identification prior to the call being established is available, the provider of a public electronic communications service shall provide the called subscriber with a simple means of rejecting incoming calls where the presentation of the calling line identification has been prevented by the calling user or subscriber.
4 Where a facility enabling the presentation of connected line identification is available, the provider of a public electronic communications service shall provide the called subscriber with a simple means to prevent, without charge, presentation of the identity of the connected line on any calling line.
5 In this regulation “called subscriber” means the subscriber receiving a call by means of the service in question whose line is the called line (whether or not it is also the connected line).

12 Publication of information for the purposes of regulations 10 and 11

Where a provider of a public electronic communications service provides facilities for calling or connected line identification, he shall provide information to the public regarding the availability of such facilities, including information regarding the options to be made available for the purposes of regulations 10 and 11.

13 Co-operation of communications providers for the purposes of regulations 10 and 11

For the purposes of regulations 10 and 11, a communications provider shall comply with any reasonable requests made by the provider of the public electronic communications service by means of which facilities for calling or connected line identification are provided.

14 Restrictions on the processing of location data

1 This regulation shall not apply to the processing of traffic data.
2 Location data relating to a user or subscriber of a public electronic communications network or a public electronic communications service may only be processed—
a where that user or subscriber cannot be identified from such data; or
b where necessary for the provision of a value added service, with the consent of that user or subscriber.
3 Prior to obtaining the consent of the user or subscriber under paragraph (2)(b), the public communications provider in question must provide the following information to the user or subscriber to whom the data relate—
a the types of location data that will be processed;
b the purposes and duration of the processing of those data; and
c whether the data will be transmitted to a third party for the purpose of providing the value added service.
4 A user or subscriber who has given his consent to the processing of data under paragraph (2)(b) shall—
a be able to withdraw such consent at any time, and
b in respect of each connection to the public electronic communications network in question or each transmission of a communication, be given the opportunity to withdraw such consent, using a simple means and free of charge.
5 Processing of location data in accordance with this regulation shall—
a only be carried out by—
i the public communications provider in question;
ii the third party providing the value added service in question; or
iii a person acting under the authority of a person falling within (i) or (ii); and
b where the processing is carried out for the purposes of the provision of a value added service, be restricted to what is necessary for those purposes.

15 Tracing of malicious or nuisance calls

1 A communications provider may override anything done to prevent the presentation of the identity of a calling line where—
a a subscriber has requested the tracing of malicious or nuisance calls received on his line; and
b the provider is satisfied that such action is necessary and expedient for the purposes of tracing such calls.
2 Any term of a contract for the provision of public electronic communications services which relates to such prevention shall have effect subject to the provisions of paragraph (1).
3 Nothing in these Regulations shall prevent a communications provider, for the purposes of any action relating to the tracing of malicious or nuisance calls, from storing and making available to a person with a legitimate interest data containing the identity of a calling subscriber which were obtained while paragraph (1) applied.

16 Emergency calls

1 For the purposes of this regulation, “emergency calls” means calls to either the national emergency call number 999 or the single European emergency call number 112.
2 In order to facilitate responses to emergency calls—
a all such calls shall be excluded from the requirements of regulation 10;
b no person shall be entitled to prevent the presentation on the connected line of the identity of the calling line; and
c the restriction on the processing of location data under regulation 14(2) shall be disregarded.

16A Emergency alerts

1 A relevant public communications provider (P) may, for the purpose of providing an emergency alert service, disregard the restrictions on the processing of data relating to users or subscribers set out in paragraph (2) if the conditions set out in paragraph (3) are met.
2 The restrictions are—
a the restrictions on the processing of traffic data under regulations 7(1) and 8(2); and
b the restrictions on the processing of location data under regulations 14(2) and 14(5).
3 The conditions are—
a P is notified by a relevant public authority that—
i an emergency within the meaning of section 1(1) of the Civil Contingencies Act 2004 has occurred, is occurring or is about to occur; and
ii it is expedient to use an emergency alert service;
b P is directed by the relevant public authority to convey a specified communication over a specified time period to users or subscribers of P’s public electronic communications network whom P considers—
i are in one or more specified places in the United Kingdom which is or may be affected by the emergency; or
ii have been in a specified place affected by the emergency since the emergency occurred but are no longer in the place; and
c P complies with that direction.
4 P may, for the purpose of testing an emergency alert service, disregard the restrictions on the processing of data relating to users or subscribers set out in paragraph (2) if the conditions set out in paragraph (5) are met.
5 The conditions are—
a P is notified by a Minister of the Crown that, in the Minister’s opinion, it is necessary to test an emergency alert service for the purpose of ensuring that the service is maintained in good working order and is an effective means of communicating with users and subscribers in an emergency;
b the Minister gives directions as to how the test is to be conducted; and
c P complies with the directions in sub-paragraph (b).
6 Traffic data or location data which relate to users or subscribers of a public electronic communications network and are processed in accordance with this regulation must, within the period of 7 days beginning with the day on which the time period specified by the relevant public authority pursuant to paragraph (3)(b) expires or, as the case may be, within 48 hours of receipt of the Minister’s directions pursuant to paragraph (5)(b), be—
a erased; or
b
i in the case of an individual, modified so that they cease to constitute personal data of that user or subscriber; or
ii in the case of a corporate subscriber, modified so that they cease to be data that would be personal data if that user or subscriber was an individual.
7 The processing of traffic data or location data in accordance with this regulation shall be carried out only by P or by a person acting under P’s authority.
8 For the purposes of this regulation—
a “emergency alert service” means a service comprising one or more communications to mobile telecommunications devices over a public electronic communications network to warn, advise or inform users or subscribers in relation to an aspect or effect of an emergency which may affect or have affected them by reason of their location;
b “relevant public authority” means—
i a Minister of the Crown;
ii the Scottish Ministers;
iii the Welsh Ministers;
iv a Northern Ireland department;
v a chief officer of police within the meaning of section 101(1) of the Police Act 1996;
vi the chief constable of the Police Service of Scotland;
vii the chief constable of the Police Service of Northern Ireland;
viii the chief constable of the British Transport Police Force;
ix the Environment Agency;
x the Scottish Environment Protection Agency;
xi the Natural Resources Body for Wales;
c “relevant public communications provider” means a person who—
i provides a public electronic communications network;
ii provides cellular mobile electronic communications services; and
iii holds a wireless telegraphy licence granted under section 8 of the Wireless Telegraphy Act 2006.

17 Termination of automatic call forwarding

1 Where—
a calls originally directed to another line are being automatically forwarded to a subscriber’s line as a result of action taken by a third party, and
b the subscriber requests his provider of electronic communications services (“the subscriber’s provider”) to stop the forwarding of those calls,
the subscriber’s provider shall ensure, free of charge, that the forwarding is stopped without any avoidable delay.
2 For the purposes of paragraph (1), every other communications provider shall comply with any reasonable requests made by the subscriber’s provider to assist in the prevention of that forwarding.

18 Directories of subscribers

1 This regulation applies in relation to a directory of subscribers, whether in printed or electronic form, which is made available to members of the public or a section of the public, including by means of a directory enquiry service.
2 The personal data of an individual subscriber shall not be included in a directory unless that subscriber has, free of charge, been—
a informed by the collector of the personal data of the purposes of the directory in which his personal data are to be included, and
b given the opportunity to determine whether such of his personal data as are considered relevant by the producer of the directory should be included in the directory.
3 Where personal data of an individual subscriber are to be included in a directory with facilities which enable users of that directory to obtain access to that data solely on the basis of a telephone number—
a the information to be provided under paragraph (2)(a) shall include information about those facilities; and
b for the purposes of paragraph (2)(b), the express consent of the subscriber to the inclusion of his data in a directory with such facilities must be obtained.
4 Data relating to a corporate subscriber shall not be included in a directory where that subscriber has advised the producer of the directory that it does not want its data to be included in that directory.
5 Where the data of an individual subscriber have been included in a directory, that subscriber shall, without charge, be able to verify, correct or withdraw those data at any time.
6 Where a request has been made under paragraph (5) for data to be withdrawn from or corrected in a directory, that request shall be treated as having no application in relation to an edition of a directory that was produced before the producer of the directory received the request.
7 For the purposes of paragraph (6), an edition of a directory which is revised after it was first produced shall be treated as a new edition.
8 In this regulation, “telephone number” has the same meaning as in section 56(5) of the Communications Act 2003 M13 but does not include any number which is used as an internet domain name, an internet address or an address or identifier incorporating either an internet domain name or an internet address, including an electronic mail address.

19 Use of automated calling systems

1 A person shall neither transmit, nor instigate the transmission of, communications comprising recorded matter for direct marketing purposes by means of an automated calling or communication system except in the circumstances referred to in paragraph (2).
2 Those circumstances are where—
a the called line is that of a subscriber who has previously notified the caller that for the time being he consents to such communications being sent by, or at the instigation of, the caller on that line; and
b the person transmitting, or instigating the transmission of, such communications—
i does not prevent presentation of the identity of the calling line on the called line; or
ii presents the identity of a line on which he can be contacted.
3 A subscriber shall not permit his line to be used in contravention of paragraph (1).
4 For the purposes of this regulation, an automated calling system is a system which is capable of—
a automatically initiating a sequence of calls to more than one destination in accordance with instructions stored in that system; and
b transmitting sounds which are not live speech for reception by persons at some or all of the destinations so called.

20 Use of facsimile machines for direct marketing purposes

1 A person shall neither transmit, nor instigate the transmission of, unsolicited communications for direct marketing purposes by means of a facsimile machine where the called line is that of—
a an individual subscriber, except in the circumstances referred to in paragraph (2);
b a corporate subscriber who has previously notified the caller that such communications should not be sent on that line; or
c a subscriber and the number allocated to that line is listed in the register kept under regulation 25.
2 The circumstances referred to in paragraph (1)(a) are that the individual subscriber has previously notified the caller that he consents for the time being to such communications being sent by, or at the instigation of, the caller.
3 A subscriber shall not permit his line to be used in contravention of paragraph (1).
4 A person shall not be held to have contravened paragraph (1)(c) where the number allocated to the called line has been listed on the register for less than 28 days preceding that on which the communication is made.
5 Where a subscriber who has caused a number allocated to a line of his to be listed in the register kept under regulation 25 has notified a caller that he does not, for the time being, object to such communications being sent on that line by that caller, such communications may be sent by that caller on that line, notwithstanding that the number allocated to that line is listed in the said register.
6 Where a subscriber has given a caller notification pursuant to paragraph (5) in relation to a line of his—
a the subscriber shall be free to withdraw that notification at any time, and
b where such notification is withdrawn, the caller shall not send such communications on that line.
7 The provisions of this regulation are without prejudice to the provisions of regulation 19.

21  Calls for direct marketing purposes

A1 A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making calls (whether solicited or unsolicited) for direct marketing purposes except where that person—
a does not prevent presentation of the identity of the calling line on the called line; or
b presents the identity of a line on which he can be contacted.
1 A person shall neither use, nor instigate the use of, a public electronic communications service for the purposes of making unsolicited calls for direct marketing purposes where—
a the called line is that of a subscriber who has previously notified the caller that such calls should not for the time being be made on that line; or
b the number allocated to a subscriber in respect of the called line is one listed in the register kept under regulation 26.
2 A subscriber shall not permit his line to be used in contravention of paragraphs (A1) or (1).
3 A person shall not be held to have contravened paragraph (1)(b) where the number allocated to the called line has been listed on the register for less than 28 days preceding that on which the call is made.
4 Where a subscriber who has caused a number allocated to a line of his to be listed in the register kept under regulation 26 has notified a caller that he does not, for the time being, object to such calls being made on that line by that caller, such calls may be made by that caller on that line, notwithstanding that the number allocated to that line is listed in the said register.
5 Where a subscriber has given a caller notification pursuant to paragraph (4) in relation to a line of his—
a the subscriber shall be free to withdraw that notification at any time, and
b where such notification is withdrawn, the caller shall not make such calls on that line.
6 Paragraph (1) does not apply to a case falling within regulation 21A or 21B.

21A Calls for direct marketing of claims management services

1 A person must not use, or instigate the use of, a public electronic communications service to make unsolicited calls for the purposes of direct marketing in relation to claims management services except in the circumstances referred to in paragraph (2).
2 Those circumstances are where the called line is that of a subscriber who has previously notified the caller that for the time being the subscriber consents to such calls being made by, or at the instigation of, the caller on that line.
3 A subscriber must not permit the subscriber's line to be used in contravention of paragraph (1).
4 In this regulation, “claims management services” means the following services in relation to the making of a claim—
a advice;
b financial services or assistance;
c acting on behalf of, or representing, a person;
d the referral or introduction of one person to another;
e the making of inquiries.
5 In paragraph (4), “claim” means a claim for compensation, restitution, repayment or any other remedy or relief in respect of loss or damage or in respect of an obligation, whether the claim is made or could be made—
a by way of legal proceedings,
b in accordance with a scheme of regulation (whether voluntary or compulsory), or
c in pursuance of a voluntary undertaking.

21B Calls for direct marketing in relation to pension schemes

1 A person must not use, or instigate the use of, a public electronic communications service to make unsolicited calls to an individual for the purpose of direct marketing in relation to occupational pension schemes or personal pension schemes, except where paragraph (2) or (3) applies.
2 This paragraph applies where—
a the caller is an authorised person or a person who is the trustee or manager of an occupational pension scheme or a personal pension scheme; and
b the called line is that of an individual who has previously notified the caller that for the time being the individual consents to such calls being made by the caller on that line.
3 This paragraph applies where—
a the caller is an authorised person or a person who is the trustee or manager of an occupational pension scheme or a personal pension scheme;
b the recipient of the call has an existing client relationship with the caller on the line and the relationship is such that the recipient might reasonably envisage receiving unsolicited calls for the purpose of direct marketing in relation to occupational pension schemes or personal pension schemes; and
c the recipient of the call has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of the recipient’s contact details for the purpose of such direct marketing, at the time that the details were initially collected and, where the recipient did not initially refuse the use of the details, at the time of each subsequent communication.
4 A subscriber must not permit the subscriber’s line to be used in contravention of paragraph (1).
5 In this regulation—
a “authorised person” has the meaning given in section 31 of the Financial Services and Markets Act 2000;
b “direct marketing in relation to occupational pension schemes or personal pension schemes” includes—
i the marketing of a product or service to be acquired using funds held, or previously held, in an occupational pension scheme or a personal pension scheme,
ii the offer of any advice or other service that promotes, or promotes the consideration of, the withdrawal or transfer of funds from an occupational pension scheme or a personal pension scheme, and
iii the offer of any advice or other service to enable the assessment of the performance of an occupational pension scheme or a personal pension scheme (including its performance in comparison with other forms of investment);
c “existing client relationship” does not include a relationship established at the instigation of the caller primarily for the purpose of avoiding the restriction in paragraph (1); and
d “occupational pension scheme” and “personal pension scheme” have the meanings given in section 1(1) of the Pension Schemes Act 1993.

22 Use of electronic mail for direct marketing purposes

1 This regulation applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers.
2 Except in the circumstances referred to in paragraph (3) or (3A), a person shall neither transmit, nor instigate the transmission of, unsolicited communications for the purposes of direct marketing by means of electronic mail unless the recipient of the electronic mail has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender.
3 A person may send or instigate the sending of electronic mail for the purposes of direct marketing where—
a that person has obtained the contact details of the recipient of that electronic mail in the course of the sale or negotiations for the sale of a product or service to that recipient;
b the direct marketing is in respect of that person’s similar products and services only; and
c the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of his contact details for the purposes of such direct marketing, at the time that the details were initially collected, and, where he did not initially refuse the use of the details, at the time of each subsequent communication.
3A A charity may send or instigate the sending of electronic mail for the purposes of direct marketing where—
a the sole purpose of the direct marketing is to further one or more of the charity’s charitable purposes;
b the charity obtained the contact details of the recipient of the electronic mail in the course of the recipient—
i expressing an interest in one or more of the purposes that were the charity’s charitable purposes at that time; or
ii offering or providing support to further one or more of those purposes; and
c the recipient has been given a simple means of refusing (free of charge except for the costs of the transmission of the refusal) the use of their contact details for the purposes of direct marketing by the charity, at the time that the details were initially collected, and, where the recipient did not initially refuse the use of the details, at the time of each subsequent communication.
4 A subscriber shall not permit his line to be used in contravention of paragraph (2).
5 In this regulation, “charity” means—
a a charity as defined in section 1(1) of the Charities Act 2011,
b a charity as defined in section 1(1) of the Charities Act (Northern Ireland) 2008 (c. 12 (N.I.)), including an institution treated as such a charity for the purposes of that Act by virtue of the Charities Act 2008 (Transitional Provision) Order (Northern Ireland) 2013 (S.R. (N.I.) 2013 No. 211), and
c a body entered in the Scottish Charity Register, other than a body which no longer meets the charity test in section 7 of the Charities and Trustee Investment (Scotland) Act 2005 (asp 10),
and, in relation to such a charity, institution or body, “charitable purpose” has the meaning given in the relevant Act.

23 Use of electronic mail for direct marketing purposes where the identity or address of the sender is concealed

A person shall neither transmit, nor instigate the transmission of, a communication for the purposes of direct marketing by means of electronic mail—
a where the identity of the person on whose behalf the communication has been sent has been disguised or concealed; F14...
b where a valid address to which the recipient of the communication may send a request that such communications cease has not been provided;
c where that electronic mail would contravene regulation 7 of the Electronic Commerce (EC Directive) Regulations 2002; or
d where that electronic mail encourages recipients to visit websites which contravene that regulation.

24 Information to be provided for the purposes of regulations 19 to 21A

1 Where a public electronic communications service is used for the transmission of a communication for direct marketing purposes the person using, or instigating the use of, the service shall ensure that the following information is provided with that communication—
a in relation to a communication to which regulations 19 (automated calling systems) and 20 (facsimile machines) apply, the particulars mentioned in paragraph (2)(a) and (b);
b in relation to a communication to which regulation 21 or 21A (telephone calls) applies, the particulars mentioned in paragraph (2)(a) and, if the recipient of the call so requests, those mentioned in paragraph (2)(b).
2 The particulars referred to in paragraph (1) are—
a the name of the person;
b either the address of the person or a telephone number on which he can be reached free of charge.

25 Register to be kept for the purposes of regulation 20

1 For the purposes of regulation 20 the Commissioner shall maintain and keep up-to-date, in printed or electronic form, a register of the numbers allocated to subscribers, in respect of particular lines, who have notified the Commissioner or, prior to 30thDecember 2016, OFCOM (notwithstanding, in the case of individual subscribers, that they enjoy the benefit of regulation 20(1)(a) and (2)) that they do not for the time being wish to receive unsolicited communications for direct marketing purposes by means of facsimile machine on the lines in question.
2 The Commissioner shall remove a number from the register maintained under paragraph (1) where the Commissioner has reason to believe that it has ceased to be allocated to the subscriber by whom the Commissioner was or, prior to 30th December 2016, OFCOM were notified pursuant to paragraph (1).
3 On the request of—
a a person wishing to send, or instigate the sending of, such communications as are mentioned in paragraph (1), or
b a subscriber wishing to permit the use of his line for the sending of such communications,
for information derived from the register kept under paragraph (1), the Commissioner shall, unless it is not reasonably practicable so to do, on the payment to the Commissioner of such fee as is, subject to paragraph (4), required by the Commissioner, make the information requested available to that person or that subscriber.
4 For the purposes of paragraph (3) the Commissioner may require different fees—
a for making available information derived from the register in different forms or manners, or
b for making available information derived from the whole or from different parts of the register,
but the fees required by the Commissioner shall be ones in relation to which the Secretary of State has notified the Commissioner that he is satisfied that they are designed to secure, as nearly as may be and taking one year with another, that the aggregate fees received, or reasonably expected to be received, equal the costs incurred, or reasonably expected to be incurred, by the Commissioner in discharging the Commissioner’s duties under paragraphs (1), (2) and (3).
5 The functions of the Commissioner under paragraphs (1), (2) and (3), other than the function of determining the fees to be required for the purposes of paragraph (3), may be discharged on the Commissioner’s behalf by some other person in pursuance of arrangements made by the Commissioner with that other person.

26 Register to be kept for the purposes of regulation 21

1 For the purposes of regulation 21 the Commissioner shall maintain and keep up-to-date, in printed or electronic form, a register of the numbers allocated to F3... subscribers, in respect of particular lines, who have notified the Commissioner or, prior to 30thDecember 2016, OFCOM that they do not for the time being wish to receive unsolicited calls for direct marketing purposes on the lines in question.
1A Notifications to the Commissioner made for the purposes of paragraph (1) by corporate subscribers shall be in writing.
2 The Commissioner shall remove a number from the register maintained under paragraph (1) where the Commissioner has reason to believe that it has ceased to be allocated to the subscriber by whom the Commissioner was or, prior to 30th December 2016, OFCOM were notified pursuant to paragraph (1).
2A Where a number allocated to a corporate subscriber is listed in the register maintained under paragraph (1), the Commissioner shall, within the period of 28 days following each anniversary of the date of that number being first listed in the register, send to the subscriber a written reminder that the number is listed in the register.
3 On the request of—
a a person wishing to make, or instigate the making of, such calls as are mentioned in paragraph (1), or
b a subscriber wishing to permit the use of his line for the making of such calls,
for information derived from the register kept under paragraph (1), the Commissioner shall, unless it is not reasonably practicable so to do, on the payment to the Commissioner of such fee as is, subject to paragraph (4), required by the Commissioner, make the information requested available to that person or that subscriber.
4 For the purposes of paragraph (3) the Commissioner may require different fees—
a for making available information derived from the register in different forms or manners, or
b for making available information derived from the whole or from different parts of the register,
but the fees required by the Commissioner shall be ones in relation to which the Secretary of State has notified the Commissioner that he is satisfied that they are designed to secure, as nearly as may be and taking one year with another, that the aggregate fees received, or reasonably expected to be received, equal the costs incurred, or reasonably expected to be incurred, by the Commissioner in discharging the Commissioner’s duties under paragraphs (1), (2) and (3).
5 The functions of the Commissioner under paragraphs (1), (2) , (2A) and (3), other than the function of determining the fees to be required for the purposes of paragraph (3), may be discharged on the Commissioner’s behalf by some other person in pursuance of arrangements made by the Commissioner with that other person.

27 Modification of contracts

To the extent that any term in a contract between a subscriber to and the provider of a public electronic communications service or such a provider and the provider of an electronic communications network would be inconsistent with a requirement of these Regulations, that term shall be void.

28 National security

1 Nothing in these Regulations shall require a communications provider to do, or refrain from doing, anything (including the processing of data) if exemption from the requirement in question is required for the purpose of safeguarding national security.
2 Subject to paragraph (4), a certificate signed by a Minister of the Crown certifying that exemption from any requirement of these Regulations is or at any time was required for the purpose of safeguarding national security shall be conclusive evidence of that fact.
3 A certificate under paragraph (2) may identify the circumstances in which it applies by means of a general description and may be expressed to have prospective effect.
4 Any person directly affected by the issuing of a certificate under paragraph (2) may appeal to the Tribunal against the issuing of the certificate.
5 If, on an appeal under paragraph (4), the Tribunal finds that, applying the principles applied by a court on an application for judicial review, the Minister did not have reasonable grounds for issuing the certificate, the Tribunal may allow the appeal and quash the certificate.
6 Where, in any proceedings under or by virtue of these Regulations, it is claimed by a communications provider that a certificate under paragraph (2) which identifies the circumstances in which it applies by means of a general description applies in the circumstances in question, any other party to the proceedings may appeal to the Tribunal on the ground that the certificate does not apply in those circumstances and, subject to any determination under paragraph (7), the certificate shall be conclusively presumed so to apply.
7 On any appeal under paragraph (6), the Tribunal may determine that the certificate does not so apply.
8 In this regulation—
a “the Tribunal”, in relation to any appeal under this regulation, means—
i the Upper Tribunal, in any case where it is determined by or under Tribunal Procedure Rules that the Upper Tribunal is to hear the appeal; or
ii the First-tier Tribunal, in any other case;
b Subsections (8), (9), (10) and (12) of section 28 of and Schedule 6 to that Act apply for the purposes of this regulation as they apply for the purposes of section 28;
c section 58 of that Act shall apply for the purposes of this regulation as if the reference in that section to the functions of the Tribunal under that Act included a reference to the functions of the Tribunal under paragraphs (4) to (7) of this regulation; and
d subsections (1), (2) and (5)(f) of section 67 of that Act shall apply in respect of the making of rules relating to the functions of the Tribunal under this regulation.

29 Legal requirements, law enforcement etc.

1 Nothing in these Regulations shall require a communications provider to do, or refrain from doing, anything (including the processing of data)—
a if compliance with the requirement in question—
i would be inconsistent with any requirement imposed by or under an enactment or by a court order; or
ii would be likely to prejudice the prevention or detection of crime or the apprehension or prosecution of offenders; or
b if exemption from the requirement in question—
i is required for the purposes of, or in connection with, any legal proceedings (including prospective legal proceedings);
ii is necessary for the purposes of obtaining legal advice; or
iii is otherwise necessary for the purposes of establishing, exercising or defending legal rights.

29A 

1 Where regulations 28 and 29 apply, communications providers must establish and maintain internal procedures for responding to requests for access to users’ personal data.
2 Communications providers shall on demand provide the Information Commissioner with information about—
a those procedures;
b the number of requests received;
c the legal justification for the request; and
d the communications provider’s response.

30 Proceedings for compensation for failure to comply with requirements of the Regulations

1 A person who suffers damage by reason of any contravention of any of the requirements of these Regulations by any other person shall be entitled to bring proceedings for compensation from that other person for that damage.
2 In proceedings brought against a person by virtue of this regulation it shall be a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the relevant requirement.
3 The provisions of this regulation are without prejudice to those of regulation 31.

31 Information Commissioner’s enforcement powers

1 Schedule 1 provides for certain provisions of Parts 5 to 7 of the Data Protection Act 2018 to apply with modifications for the purposes of enforcing these Regulations.
2 In regulations 32 and 33, “enforcement functions” means the functions of the Information Commissioner under those provisions, as applied by that Schedule.

F7831A Enforcement: third party information notices

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F7931B Enforcement: appeals

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

32 Request that the Commissioner exercise his enforcement functions

Where it is alleged that there has been a contravention of any of the requirements of these Regulations either OFCOM or a person aggrieved by the alleged contravention may request the Commissioner to exercise his enforcement functions in respect of that contravention, but those functions shall be exercisable by the Commissioner whether or not he has been so requested.

32A Codes of conduct

1 The Commissioner must encourage representative bodies to produce codes of conduct intended to contribute to compliance with these Regulations.
2 Under paragraph (1), the Commissioner must encourage representative bodies to produce codes which take account of, among other things, the specific features of different sectors.
3 A code of conduct described in paragraph (1) may, for example, make provision with regard to—
a rights and obligations under these Regulations;
b out-of-court proceedings and other dispute resolution procedures for resolving disputes arising in connection with these Regulations.
4 The Commissioner must encourage representative bodies to submit codes of conduct described in paragraph (1) to the Commissioner in draft.
5 Where a representative body does so, the Commissioner must—
a provide the representative body with an opinion on whether the code correctly reflects the requirements of these Regulations,
b decide whether to approve the code, and
c if the code is approved, register and publish the code.
6 The Commissioner may only approve a code if, among other things—
a the code contains a mechanism for monitoring whether persons who undertake to apply the code comply with its provisions, and
b in relation to persons other than public bodies, the mechanism involves monitoring by a body which is accredited for that purpose by the Commissioner under regulation 32B.
7 In relation to amendments of a code of conduct that is for the time being approved under this regulation—
a paragraphs (4) and (5) apply as they apply in relation to a code, and
b the requirements in paragraph (6) must be satisfied by the code as amended.
8 A code of conduct described in paragraph (1) may be contained in the same document as a code of conduct described in Article 40 of the UK GDPR (and a provision contained in such a document may be a provision of both codes).
9 In this regulation—
  • “public body” has the meaning given in section 7 of the Data Protection Act 2018 (for the purposes of the UK GDPR);
  • “representative body” means an association or other body representing categories of—
    1. communications providers, or
    2. other persons engaged in activities regulated by these Regulations;
  • “the UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

32B Accreditation of bodies monitoring compliance with codes of conduct

1 The Commissioner may, in accordance with this regulation, accredit a body for the purpose of monitoring whether persons other than public bodies comply with a code of conduct described in regulation 32A(1).
2 The Commissioner may accredit a body only where the Commissioner is satisfied that the body has—
a demonstrated its independence,
b demonstrated that it has an appropriate level of expertise in relation to the subject matter of the code,
c established procedures which allow it—
i to assess a person’s eligibility to apply the code,
ii to monitor compliance with the code, and
iii to review the operation of the code periodically,
d established procedures and structures to handle complaints about infringements of the code or about the manner in which the code has been, or is being, implemented by a person,
e made arrangements to publish information about the procedures and structures described in sub-paragraph (d), and
f demonstrated that it does not have a conflict of interest.
3 The Commissioner must prepare and publish guidance about how the Commissioner proposes to take decisions about accreditation under this regulation.
4 A body accredited under this regulation in relation to a code must take appropriate action where a person infringes the code.
5 If the action taken by a body under paragraph (4) consists of suspending or excluding a person from the code, the body must inform the Commissioner, giving reasons for taking that action.
6 The Commissioner must revoke the accreditation of a body under this regulation if the Commissioner considers that the body—
a no longer meets the requirements for accreditation, or
b has failed, or is failing, to comply with paragraph (4) or (5).
7 In this regulation, “public body” has the same meaning as in regulation 32A.

32C Effect of codes of conduct

Adherence to a code of conduct approved under regulation 32A may be used by a person as a means of demonstrating compliance with these Regulations.

33 Technical advice to the Commissioner

OFCOM shall comply with any reasonable request made by the Commissioner F80... for advice on technical and similar matters relating to electronic communications where the request is made in connection with—
a the Commissioner’s enforcement functions, or
b the Commissioner’s functions under regulation 32A or 32B (codes of conduct).

34 Amendment to the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000

In regulation 3 of the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 M14, for paragraph (3), there shall be substituted—
.

35 Amendment to the Electronic Communications (Universal Service) Order 2003

1 In paragraphs 2(2) and 3(2) of the Schedule to the Electronic Communications (Universal Service) Order 2003 M15, for the words “Telecommunications (Data Protection and Privacy) Regulations 1999” there shall be substituted “ Privacy and Electronic Communications (EC Directive) Regulations 2003 ”.
2 Paragraph (1) shall have effect notwithstanding the provisions of section 65 of the Communications Act 2003 M16 (which provides for the modification of the Universal Service Order made under that section).

36 Transitional provisions

The provisions in Schedule 2 shall have effect.

37 Review of implementation

1 Before the end of each review period, the Secretary of State must—
a carry out a review of the implementing provisions;
b set out the conclusions of the review in a report; and
c publish the report.
1A “The implementing provisions” means the provisions contained in or made under an Act that were relied on by the United Kingdom immediately before exit day to implement the Directive, so far as those provisions remain in force.
F492 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3 The report must in particular—
a set out the objectives intended to be achieved by the implementing provisions;
b assess the extent to which those objectives are achieved; and
c assess whether those objectives remain appropriate and, if so, the extent to which they could be achieved with a system that imposes less regulation.
4 “Review period” means—
a the period of five years beginning with the 26th May 2011; and
b subject to paragraph (5), each successive period of 5 years.
5 If a report under this regulation is published before the last day of the review period to which it relates, the following review period is to being with the day on which that report is published.

Schedule A1 

Storing information in the terminal equipment of a subscriber or user

Regulation 6

1 Interpretation

1 In this Schedule, “website” includes a mobile application and any other platform by means of which an information society service is provided.
2 For further provision about the interpretation of this Schedule, see regulation 6(2).

2 Consent

1 Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if the subscriber or user—
a is provided with clear and comprehensive information about the purpose of the storage or access, and
b gives consent to the storage or access.
2 Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user for the same purpose on more than one occasion, it is sufficient that the requirements of sub-paragraph (1) are met in respect of the initial use.
3 For the purposes of sub-paragraph (1)(b), the means by which the subscriber or user may signify consent include—
a amending or setting controls on the internet browser which the subscriber or user uses;
b using another application or programme.

3 Transmission of a communication over an electronic communications network

Regulation 6(1) does not apply to—
a technical storage of information in the terminal equipment of a subscriber or user, or
b technical access to information stored in such equipment,
for the sole purpose of carrying out the transmission of a communication over an electronic communications network.

4 Storage or access strictly necessary to provide an information society service

1 Regulation 6(1) does not apply to—
a technical storage of information in the terminal equipment of a subscriber or user, or
b technical access to information stored in such equipment,
where the storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.
2 For the purposes of this paragraph, the technical storage of, or technical access to, information is strictly necessary for the provision of an information society service requested by the subscriber or user if, for example, the storage or access is strictly necessary—
a to protect information provided in connection with, or relating to, the provision of the service requested,
b to ensure that the security of the terminal equipment of the subscriber or user is not adversely affected by the provision of the service requested,
c to prevent or detect fraud in connection with the provision of the service requested,
d to prevent or detect technical faults in connection with the provision of the service requested, or
e to enable either of the following things to be done where necessary for the provision of the service requested—
i automatically authenticating the identity of the subscriber or user, or
ii maintaining a record of selections made on a website, or information put into a website, by the subscriber or user.

5 Collecting information for statistical purposes

1 Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if—
a the person provides an information society service,
b the sole purpose of the storage or access is to enable the person—
i to collect information for statistical purposes about how the service is used with a view to making improvements to the service, or
ii to collect information for statistical purposes about how a website by means of which the service is provided is used with a view to making improvements to the website,
c any information that the storage or access enables the person to collect is not shared with any other person except for the purpose of enabling that other person to assist with making improvements to the service or website,
d the subscriber or user is provided with clear and comprehensive information about the purpose of the storage or access, and
e the subscriber or user is given a simple means of objecting, free of charge, to the storage or access and does not object.
2 In sub-paragraph (1), the reference to gaining access to information stored in the terminal equipment of a subscriber or user does not include a reference to collecting or monitoring information automatically emitted by the terminal equipment.
3 Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user for the same purpose on more than one occasion, it is sufficient that the requirements of sub-paragraph (1)(d) and (e) are met in respect of the initial use.

6 Website appearance etc

1 Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if—
a the person provides an information society service by means of a website,
b the sole purpose of the storage or access is—
i to enable the way the website appears or functions when displayed on, or accessed by, the terminal equipment to adapt to the preferences of the subscriber or user, or
ii to otherwise enable an enhancement of the appearance or functionality of the website when displayed on, or accessed by, the terminal equipment,
c the subscriber or user is provided with clear and comprehensive information about the purpose of the storage or access, and
d the subscriber or user is given a simple means of objecting, free of charge, to the storage or access and does not object.
2 Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user for the same purpose on more than one occasion, it is sufficient that the requirements of sub-paragraph (1)(c) and (d) are met in respect of the initial use.

7 Emergency assistance

Regulation 6(1) does not prevent a person storing information, or gaining access to information stored, in the terminal equipment of a subscriber or user if—
a the person receives a communication from the terminal equipment,
b the communication is a request from the subscriber or user for emergency assistance or otherwise indicates that the subscriber or user is in need of emergency assistance, and
c the sole purpose of the storage or access is to enable the geographical position of the subscriber or user to be ascertained with a view to the emergency assistance being provided.

SCHEDULE 1 

Information Commissioner’s enforcement powers

Regulation 31

1 Provisions applied for enforcement purposes

For the purposes of enforcing these Regulations, the following provisions of Parts 5 to 7 of the Data Protection Act 2018 apply with the modifications set out in paragraphs 2 to 29—
  • section 140 (publication by the Commissioner);
  • section 141A (notices from the Commissioner);
  • section 142 (information notices);
  • section 143 (information notices: restrictions);
  • section 144 (false statements made in response to an information notice);
  • section 145 (information orders);
  • section 146 (assessment notices);
  • section 146A (assessment notices: approval of person to prepare report);
  • section 147 (assessment notices: restrictions);
  • section 148 (destroying or falsifying information and documents etc);
  • section 148A (interview notices);
  • section 148B (interview notices: restrictions);
  • section 148C (false statements made in response to interview notices);
  • section 149 (enforcement notices);
  • section 150 (enforcement notices: supplementary);
  • section 152 (enforcement notices: restrictions);
  • section 153 (enforcement notices: cancellation and variation);
  • section 154 and Schedule 15 (powers of entry and inspection);
  • section 155 and Schedule 16 (penalty notices);
  • section 156 (penalty notices: restrictions);
  • section 157 (maximum amount of penalty);
  • section 159 (amount of penalties: supplementary);
  • section 160 (guidance about regulatory action);
  • section 161 (approval of first guidance about regulatory action);
  • section 162 (rights of appeal);
  • section 163 (determination of appeals);
  • section 164 (applications in respect of urgent notices);
  • section 180 (jurisdiction);
  • section 181 (interpretation of Part 6);
  • section 182 (regulations and consultation);
  • section 196 (penalties for offences);
  • section 197(1) and (2) (prosecution);
  • section 198 (liability of directors etc);
  • section 200 (guidance about PACE codes of practice);
  • section 202 (proceedings in the First-tier Tribunal: contempt);
  • section 203 (Tribunal Procedure Rules).

2 General modification of references to the Data Protection Act 2018

The provisions listed in paragraph 1 have effect as if—
a references to the Data Protection Act 2018 or to a Part of that Act were references to the provisions of that Act or that Part as applied by these Regulations;
b references to a particular provision of that Act were references to that provision as applied by these Regulations.

3 Modification of section 142 (information notices)

Section 142 has effect as if—
a in subsection (1), for paragraphs (a) and (b) there were substituted—
;
b in subsection (2)(a), for “(b)(i) or (b)(ii)” there were substituted “(b) or (c)”;
c after subsection (8) there were inserted—
;
d subsections (9) and (10) were omitted.

4 Modification of section 143 (information notices: restrictions)

1 Section 143 has effect as if subsections (1) and (9) were omitted.
2 In that section—
a subsections (3)(b) and (4)(b) have effect as if for “the data protection legislation” there were substituted “the PEC Regulations”;
b subsection (7)(a) has effect as if for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”;
c subsection (8) has effect as if for “this Act (other than an offence under section 144)” there were substituted “section 148 or 148C or paragraph 15 of Schedule 15”.

5 Modification of section 145 (information orders)

Section 145(2)(b) has effect as if for “section 142(2)(b)” there were substituted “section 142(2)”.

6 Modification of section 146 (assessment notices)

Section 146 has effect as if—
a in subsection (1)—
i for “a controller or processor” there were substituted “a person within subsection (1A)”;
ii for “the controller or processor” there were substituted “the person”;
iii for “the data protection legislation” there were substituted “the requirements of the PEC Regulations”;
b after subsection (1) there were inserted—
;
c in subsection (2)—
i for “controller or processor” there were substituted “person to whom it is given”;
ii in paragraph (h), for “the processing of personal data” there were substituted “any activity regulated by the PEC Regulations”;
iii in paragraph (i), for “process personal data on behalf of the controller” there were substituted “are involved in any such activity on behalf of the person to whom the notice is given”;
d in subsection (3A), for “controller or processor” there were substituted “person”;
e in subsection (7), for “controller or processor” there were substituted “person to whom the notice is given”;
f in subsection (8)—
i in paragraph (a), for “controller or processor” there were substituted “person to whom the notice is given”;
ii in the words after paragraph (c), for “controller or processor” there were substituted “person”;
g in subsection (9)—
i in paragraph (a), for the words from “a controller” to “this Act” there were substituted “the person to whom the notice is given has failed or is failing to comply with the requirements of the PEC Regulations or that an offence under section 144, 148 or 148C or paragraph 15 of Schedule 15”;
ii in paragraph (d), for “controller or processor” there were substituted “person”;
h in subsection (10), for “controller or processor” there were substituted “person”;
i subsection (11) were omitted;
j in subsection (11A)—
i for “controller or processor”, in the first place it occurs, there were substituted “person to whom it is given”;
ii for “controller or processor”, in the second place it occurs, there were substituted “the person”.

7 Modification of section 146A (assessment notices: approval of person to prepare report)

Section 146A has effect as if—
a in subsection (1), for “a controller or processor” there were substituted “a person (“P”)”;
b in subsection (2), for “The controller or processor” there were substituted “P”;
c in subsections (3) to (6), for “the controller or processor” (in each place) there were substituted “P”.

8 Modification of section 147 (assessment notices: restrictions)

1 Section 147 has effect as if subsection (5) were omitted.
2 In that section, subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “the PEC Regulations”.

9 Modification of section 148A (interview notices)

Section 148A has effect as if—
a in subsection (1)—
i for “a controller or processor” there were substituted “a person”;
ii in paragraph (a), for “as described in section 149(2)” there were substituted “to comply with a requirement of the PEC Regulations”;
iii in paragraph (b), for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”;
b in subsection (3)—
i in paragraph (a), for “the controller or processor” there were substituted “the person mentioned in subsection (1)”;
ii in paragraph (b), for “the controller or processor” there were substituted “that person”;
iii in paragraph (c), for “the controller or processor” there were substituted “that person”.

10 Modification of section 148B (interview notices: restrictions)

1 Section 148B has effect as if subsections (8) and (9) were omitted.
2 In that section—
a subsections (2)(b) and (3)(b) have effect as if for “the data protection legislation” there were substituted “the PEC Regulations”;
b subsection (6)(a) has effect as if for “this Act” there were substituted “section 144, 148 or 148C or paragraph 15 of Schedule 15”;
c subsection (7) has effect as if for “this Act (other than an offence under section 148C)” there were substituted “section 144 or 148 or paragraph 15 of Schedule 15”.

11 Modification of section 149 (enforcement notices)

1 Section 149 has effect as if subsections (2) to (5A) and (7) to (9) were omitted.
2 In that section—
a subsection (1) has effect as if—
i for “as described in subsections (2), (3), (4), (5) or (5A)” there were substituted “to comply with a requirement of the PEC Regulations”;
ii for “sections 150 and 151” there were substituted “section 150”;
b subsection (6) has effect as if the words “given in reliance on subsection (2), (3), (5) or (5A)” were omitted.

12 Modification of section 150 (enforcement notices: supplementary)

1 Section 150 has effect as if subsection (3) were omitted.
2 In that section, subsection (2) has effect as if the words “in reliance on section 149(2)” were omitted.

13 Modification of section 152 (enforcement notices: restrictions)

Section 152 has effect as if subsections (1), (2) and (4) were omitted.

14 Modification of Schedule 15 (powers of entry and inspection)

1 Schedule 15 has effect as if paragraph 3 were omitted.
2 Paragraph 1(1) of that Schedule (issue of warrants in connection with non-compliance and offences) has effect as if for paragraph (a) (but not the final “and”) there were substituted—
.
3 Paragraph 2 of that Schedule (issue of warrants in connection with assessment notices) has effect as if—
a in sub-paragraphs (1) and (2), for “controller or processor” there were substituted “person”;
b in sub-paragraph (2), for “the data protection legislation” there were substituted “the PEC Regulations”.
4 Paragraph 5 of that Schedule (content of warrants) has effect as if—
a in sub-paragraph (1)(c), for “the processing of personal data” there were substituted “an activity regulated by the PEC Regulations”;
b in sub-paragraph (2)(d), for the words from “controller or processor” to the end there were substituted “person mentioned in paragraph 1(1)(a) has failed or is failing to comply with a requirement of the PEC Regulations”;
c in sub-paragraph (3)(a) and (d)—
i for “controller or processor” there were substituted “person mentioned in paragraph 2(1)”;
ii for “the data protection legislation” there were substituted “the requirements of the PEC Regulations”.
5 Paragraph 11 of that Schedule (privileged communications) has effect as if, in sub-paragraphs (1)(b) and (2)(b), for “the data protection legislation” there were substituted “the PEC Regulations”.

15 Modification of section 155 (penalty notices)

Section 155 has effect as if—
a in subsection (1)—
i in paragraph (a), for “as described in section 149(2), (3), (4), (5) or (5A)” there were substituted “to comply with a requirement of the PEC Regulations”;
ii after paragraph (c), there were inserted
;
b after subsection (1) there were inserted—
;
c for subsection (2) there were substituted—
;
d in subsection (3)—
i for “the controller or processor” (in each place) there were substituted “the person”;
ii in paragraph (c), for the words from “data subjects” to the end there were substituted “subscribers or users”;
iii in paragraph (d), for the words “in accordance with section 57, 66, 103 or 107” there were substituted “with a view to securing compliance with the requirements of the PEC Regulations”;
iv paragraph (g) were omitted;
v in paragraph (j), the words “or certification mechanism” were omitted;
e subsection (4) were omitted;
f after subsection (4) there were inserted—
;
g subsections (6) to (8) were omitted.

16 Modification of Schedule 16 (penalties)

Schedule 16 has effect as if paragraphs 3(2)(b) and 5(2)(b) were omitted.

17 Modification of section 156 (penalty notices: restrictions)

1 Section 156 has effect as if subsections (1), (2), (4)(b) and (5) were omitted.
2 In that section, subsection (3) has effect as if for the words from “controller” to “determined by or” there were substituted “penalty notice to a person who acts”.

18 Modification of section 157 (maximum amount of penalty)

Section 157 has effect as if—
a subsection (1) were omitted;
b in subsection (2)—
i for “Part 3 of this Act” there were substituted “the PEC Regulations”;
ii in paragraph (a), for the words from “section 35” to “or 78” there were substituted “regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23 , 24 or 32B(4) or (5)”;
c subsections (3) and (4A) were omitted;
d after subsection (4A) there were inserted—

19 Modification of section 159 (amount of penalties: supplementary)

Section 159 has effect as if—
a in subsection (1), the words “Article 83 of the UK GDPR and” were omitted;
b in subsection (2), the words “Article 83 of the UK GDPR,” and “and section 158” were omitted.

20 Modification of section 160 (guidance)

Section 160 has effect as if, in subsection (4)(f), for “controllers and processors” there were substituted “persons”.

21 Modification of section 162 (rights of appeal)

Section 162 has effect as if subsection (4) were omitted.

22 Modification of section 163 (determination of appeals)

Section 163 has effect as if subsection (6) were omitted.

23 Modification of section 180 (jurisdiction)

1 Section 180 has effect as if subsections (2)(b), (c), (d) and (e) and (3) were omitted.
2 Subsection (1) of that section has effect as if for “subsections (3) and (4)” there were substituted “subsection (4)”.

24 Modification of section 181 (interpretation of Part 6)

Section 181 has effect as if the definition of “certification provider” were omitted.

25 Modification of section 182 (regulations and consultation)

1 Section 182 has effect as if subsections (3), (6), (8), (11), (12) and (14) were omitted.
2 Subsection (13) of that section has effect as if for “provision comes into force” there were substituted “coming into force of section 115 of the Data (Use and Access) Act 2025”.

26 Modification of section 196 (penalties for offences)

1 Section 196 has effect as if subsections (3) to (5) were omitted.
2 In that section—
a subsection (1) has effect as if the words “section 119 or 173 or” were omitted;
b subsection (2) has effect as if for “section 132, 144, 148, 148C, 170, 171 or 184” there were substituted “section 144, 148 or 148C”.

27 Modification of section 200 (guidance about PACE codes of practice)

Section 200 has effect as if, in subsection (1), for “this Act” there were substituted “section 144, 148 and 148C and paragraph 15 of Schedule 15”.

28 Modification of section 202 (proceedings in the First-tier Tribunal: contempt)

Section 202 has effect as if, in subsection (1)(a), for sub-paragraphs (i) and (ii) there were substituted “on an appeal under section 162”.

29 Modification of section 203 (tribunal procedure rules)

Section 203 has effect as if—
a in subsection (1), for paragraphs (a) and (b) there were substituted “the exercise of the rights of appeal conferred by section 162”;
b in subsection (2)—
i in paragraph (a), for “the processing of personal data” there were substituted “any activity regulated by the PEC Regulations”;
ii in paragraph (b), for “the processing of personal data” there were substituted “any such activity”.

30 Interpretation

In this Schedule, “the PEC Regulations” means these Regulations.

SCHEDULE 2 

Transitional provisions

Regulation 36

Interpretation

1In this Schedule “the 1999 Regulations” means the Telecommunications (Data Protection and Privacy) Regulations 1999 and “caller” has the same meaning as in regulation 21 of the 1999 Regulations.

Directories

2
1 Regulation 18 of these Regulations shall not apply in relation to editions of directories first published before 11th December 2003.
2 Where the personal data of a subscriber have been included in a directory in accordance with Part IV of the 1999 Regulations, the personal data of that subscriber may remain included in that directory provided that the subscriber—
a has been provided with information in accordance with regulation 18 of these Regulations; and
b has not requested that his data be withdrawn from that directory.
3 Where a request has been made under subparagraph (2) for data to be withdrawn from a directory, that request shall be treated as having no application in relation to an edition of a directory that was produced before the producer of the directory received the request.
4 For the purposes of subparagraph (3), an edition of a directory, which is revised after it was first produced, shall be treated as a new edition.

Notifications

3
1 A notification of consent given to a caller by a subscriber for the purposes of regulation 22(2) of the 1999 Regulations is to have effect on and after 11th December 2003 as a notification given by that subscriber for the purposes of regulation 19(2) of these Regulations.
2 A notification given to a caller by a corporate subscriber for the purposes of regulation 23(2)(a) of the 1999 Regulations is to have effect on and after 11th December 2003 as a notification given by that subscriber for the purposes of regulation 20(1)(b) of these Regulations.
3 A notification of consent given to a caller by an individual subscriber for the purposes of regulation 24(2) of the 1999 Regulations is to have effect on and after 11th December 2003 as a notification given by that subscriber for the purposes of regulation 20(2) of these Regulations.
4 A notification given to a caller by an individual subscriber for the purposes of regulation 25(2)(a) of the 1999 Regulations is to have effect on and after the 11th December 2003 as a notification given by that subscriber for the purposes of regulation 21(1) of these Regulations.

Registers kept under regulations 25 and 26

4
1 A notification given by a subscriber pursuant to regulation 23(4)(a) of the 1999 Regulations to the Director General of Telecommunications (or to such other person as is discharging his functions under regulation 23(4) of the 1999 Regulations on his behalf by virtue of an arrangement made under regulation 23(6) of those Regulations) is to have effect on or after 11th December 2003 as a notification given pursuant to regulation 25(1) of these Regulations.
2 A notification given by a subscriber who is an individual pursuant to regulation 25(4)(a) of the 1999 Regulations to the Director General of Telecommunications (or to such other person as is discharging his functions under regulation 25(4) of the 1999 Regulations on his behalf by virtue of an arrangement made under regulation 25(6) of those Regulations) is to have effect on or after 11th December 2003 as a notification given pursuant to regulation 26(1) of these Regulations.

References in these Regulations to OFCOM

5In relation to times before an order made under section 411 M17 of the Communications Act 2003 brings any of the provisions of Part 2 of Chapter 1 of that Act into force for the purpose of conferring on OFCOM the functions contained in those provisions, references to OFCOM in these Regulations are to be treated as references to the Director General of Telecommunications.

Footnotes

  1. M1
    S.I. 2001/3495.
  2. M2
    1972 c. 68.
  3. M3
    2003 c. 21; for the commencement of section 405, see section 411(2) and (3) of the same Act.
  4. M4
    1985 c. 6.
  5. M5
    OJ No L 201, 31.07.02, p. 37.
  6. M6
    For the commencement of section 32, see article 2(1) of S.I. 2003/1900 (C. 77).
  7. M7
    S.I. 2002/2013.
  8. M8
    2002 c. 11.
  9. M9
    1990 c. 42; section 201 was amended by section 148(1) of and paragraph 11 of Schedule 10 to the Broadcasting Act 1996 (c. 55).
  10. M10
    For the commencement of section 151, see article 2(1) of S.I. 2003/1900 (C. 77).
  11. M11
    S.I. 1999/2093.
  12. M12
    S.I. 2000/157.
  13. M13
    2003 c. 21; for the commencement of section 56(5), see article 2(1) of S.I. 2003/1900 (C. 77).
  14. M14
    S.I. 2000/2699.
  15. M15
    S.I. 2003/1094.
  16. M16
    2003 c. 21; for the commencement of section 65, see article 2(1) of S.I. 2003/1900 (C. 77).
  17. M17
    For the commencement of section 411, see section 411(2) and (3) of the Communications Act 2003 (c. 21).
  18. F1
    Reg. 26(1A) inserted (25.6.2004) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2004 (S.I. 2004/1039), regs. 1, 2(3)
  19. F2
    Reg. 26(2A) inserted (25.6.2004) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2004 (S.I. 2004/1039), regs. 1, 2(4)
  20. F3
    Word in reg. 26(1) omitted (25.6.2004) by virtue of The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2004 (S.I. 2004/1039), regs. 1, 2(2)
  21. F4
    Word in reg. 26(5) inserted (25.6.2004) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2004 (S.I. 2004/1039), regs. 1, 2(5)
  22. F5
    Reg. 28(8)(a) substituted (18.1.2010) by The Transfer of Tribunal Functions Order 2010 (S.I. 2010/22), art. 1(1), Sch. 3 para. 40
  23. F6
    Regs. 5A-5C inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 5
  24. F7
    Reg. 29A inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 10
  25. F8
    Reg. 37 inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 13
  26. F9
    Words in reg. 2 inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 3(a)
  27. F10
    Words in reg. 2 inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 3(b)
  28. F11
    Reg. 5(1A) inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 4(1)
  29. F12
    Words in reg. 7(3)(b) substituted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 7
  30. F13
    Words in reg. 19(1) inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 8
  31. F14
    Word in reg. 23(a) omitted (26.5.2011) by virtue of The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 9(1)
  32. F15
    Reg. 23(c)(d) inserted (26.5.2011) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 (S.I. 2011/1208), regs. 1(1), 9(2)
  33. F16
    Reg. 16A inserted (6.4.2015) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2015 (S.I. 2015/355), regs. 1, 2(2)
  34. F17
    Reg. 19(2) substituted (16.5.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2016 (S.I. 2016/524), regs. 1, 2(2)
  35. F18
    Reg. 21(A1) inserted (16.5.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2016 (S.I. 2016/524), regs. 1, 2(3)(a)
  36. F19
    Words in reg. 21 heading substituted (16.5.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2016 (S.I. 2016/524), regs. 1, 2(3)(c)
  37. F20
    Words in reg. 21(2) substituted (16.5.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2016 (S.I. 2016/524), regs. 1, 2(3)(b)
  38. F21
    Words in reg. 25 substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(a) (with reg. 3)
  39. F22
    Words in reg. 25(1) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(b) (with reg. 3)
  40. F23
    Words in reg. 25(2) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(c) (with reg. 3)
  41. F24
    Words in reg. 25(2) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(d) (with reg. 3)
  42. F25
    Words in reg. 25(3)(4) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(e) (with reg. 3)
  43. F26
    Words in reg. 25(4)(5) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(f) (with reg. 3)
  44. F27
    Words in reg. 26 substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(a) (with reg. 3)
  45. F28
    Words in reg. 26(1) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(b) (with reg. 3)
  46. F29
    Words in reg. 26(2) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(c) (with reg. 3)
  47. F30
    Words in reg. 26(2) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(d) (with reg. 3)
  48. F31
    Words in reg. 26(3)(4) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(e) (with reg. 3)
  49. F32
    Words in reg. 26(4)(5) substituted (30.12.2016) by The Privacy and Electronic Communications (EC Directive) (Amendment) (No. 2) Regulations 2016 (S.I. 2016/1177), regs. 1(1), 2(2)(f) (with reg. 3)
  50. C1
    Regulations power to apply (with modifications) conferred (10.5.2018) by Financial Guidance and Claims Act 2018 (c. 10), s. 21(d)
  51. C2
    Instrument applied (25.5.2018) by Data Protection Act 2018 (c. 12), ss. 122(a), 212(1) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(e)
  52. F33
    Words in reg. 2(1) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 292 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)
  53. F34
    Reg. 4(1): reg. 4 renumbered as reg. 4(1) (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 293(2) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)
  54. F35
    Reg. 4(2)(3) inserted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 293(4) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)
  55. F36
    Words in reg. 4 heading substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 293(5) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)
  56. F37
    Words in reg. 4(1) substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 293(3) (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g)
  57. F38
    Reg. 21A inserted (8.9.2018) by Financial Guidance and Claims Act 2018 (c. 10), ss. 35(3), 37(5); S.I. 2018/987, reg. 3 (with reg. 4)
  58. F39
    Reg. 21(6) inserted (8.9.2018) by Financial Guidance and Claims Act 2018 (c. 10), ss. 35(2), 37(5); S.I. 2018/987, reg. 3 (with reg. 4)
  59. F40
    Words in reg. 24 heading substituted (8.9.2018) by Financial Guidance and Claims Act 2018 (c. 10), ss. 35(4)(a), 37(5); S.I. 2018/987, reg. 3 (with reg. 4)
  60. F41
    Words in reg. 24(1)(b) inserted (8.9.2018) by Financial Guidance and Claims Act 2018 (c. 10), ss. 35(4)(b), 37(5); S.I. 2018/987, reg. 3 (with reg. 4)
  61. F42
    Reg. 21B inserted (9.1.2019) by The Privacy and Electronic Communications (Amendment) (No. 2) Regulations 2018 (S.I. 2018/1396), regs. 1(1), 2(3)
  62. F43
    Words in reg. 21(6) inserted (9.1.2019) by The Privacy and Electronic Communications (Amendment) (No. 2) Regulations 2018 (S.I. 2018/1396), regs. 1(1), 2(2)
  63. F44
    Words in reg. 2(1) inserted (29.3.2019) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), regs. 1(3), 8(2)
  64. F45
    Reg. 2(3) omitted (29.3.2019) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), regs. 1(3), 8(3)
  65. F46
    Words in reg. 2(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 3 para. 44 (with Sch. 3 para. 112); 2020 c. 1, Sch. 5 para. 1(1)
  66. F47
    Words in reg. 37(1)(a) substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 3(2); 2020 c. 1, Sch. 5 para. 1(1)
  67. F48
    Reg. 37(1A) inserted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 3(3); 2020 c. 1, Sch. 5 para. 1(1)
  68. F49
    Reg. 37(2) omitted (31.12.2020) by virtue of The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 3(4); 2020 c. 1, Sch. 5 para. 1(1)
  69. F50
    Words in reg. 37(3)(a) substituted (31.12.2020) by The Electronic Communications (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/919), regs. 1(2), 3(5); 2020 c. 1, Sch. 5 para. 1(1)
  70. F51
    Reg. 5A(9) omitted (14.10.2024) by virtue of Investigatory Powers (Amendment) Act 2024 (c. 9), ss. 11(5), 32(2); S.I. 2024/1021, reg. 2(k)
  71. F52
    Words in reg. 2(1) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 110(2)(c), 142(1); S.I. 2025/904, reg. 2(o)
  72. F53
    Words in reg. 2(4) omitted (20.8.2025) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 110(4), 142(1); S.I. 2025/904, reg. 2(o)
  73. F54
    Reg. 2(5)(6) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 110(5), 142(1); S.I. 2025/904, reg. 2(o)
  74. F55
    Reg. 5A(3A) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(1)(b), 142(1); S.I. 2025/904, reg. 2(p)
  75. F56
    Words in reg. 5A(2) inserted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(1)(a), 142(1); S.I. 2025/904, reg. 2(p)
  76. F57
    Words in reg. 5C(4)(f) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(2)(a), 142(1); S.I. 2025/904, reg. 2(p)
  77. F58
    Words in reg. 5C(5) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 111(2)(b), 142(1); S.I. 2025/904, reg. 2(p)
  78. F59
    Words in reg. 16A(6) substituted (20.8.2025) by Data (Use and Access) Act 2025 (c. 18), ss. 113, 142(1); S.I. 2025/904, reg. 2(q)
  79. F60
    Reg. 5C(12)-(16) inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 115(4)(b), 142(1)(2)(h) (with s. 115(10)); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  80. F61
    Reg. 6A inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 112(3), 142(1)(2)(h) (with s. 112(5)); S.I. 2026/82, reg. 2(w)
  81. F62
    Regs. 32A-32C inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 116(2), 142(1); S.I. 2026/82, reg. 2(z)
  82. F63
    Sch. 1 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 13; S.I. 2026/82, reg. 2(z14) (with regs. 8-11)
  83. F64
    Sch. A1 inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 12; S.I. 2026/82, reg. 2(z13)
  84. F65
    Word in reg. 2(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 110(2)(b)(ii), 142(1); S.I. 2026/82, reg. 2(v)
  85. F66
    Reg. 2(1A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 110(3), 142(1); S.I. 2026/82, reg. 2(v)
  86. F67
    Words in reg. 2(1) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 110(2)(a), 142(1); S.I. 2026/82, reg. 2(v)
  87. F68
    Words in reg. 2(1) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 110(2)(b)(i), 142(1); S.I. 2026/82, reg. 2(v)
  88. F69
    Reg. 5(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(2), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  89. F70
    Reg. 5B omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(3), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  90. F71
    Words in reg. 5C(10) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(4)(a)(i), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  91. F72
    Words in reg. 5C(10)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 115(4)(a)(ii), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  92. F73
    Reg. 6 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 112(2), 142(1); S.I. 2026/82, reg. 2(w)
  93. F74
    Reg. 22(3A) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 114(3), 142(1); S.I. 2026/82, reg. 2(x)
  94. F75
    Reg. 22(5) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 114(4), 142(1); S.I. 2026/82, reg. 2(x)
  95. F76
    Words in reg. 22(2) inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 114(2), 142(1); S.I. 2026/82, reg. 2(x)
  96. F77
    Reg. 31 substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 115(5), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  97. F78
    Reg. 31A omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(6), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  98. F79
    Reg. 31B omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 115(7), 142(1); S.I. 2026/82, reg. 2(y) (with regs. 8-11)
  99. F80
    Words in reg. 33 omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 116(3)(a), 142(1); S.I. 2026/82, reg. 2(z)
  100. F81
    Words in reg. 33 inserted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 116(3)(b), 142(1); S.I. 2026/82, reg. 2(z)
  101. F82
    Words in Sch. 1 para. 18(b)(ii) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 116(4), 142(1); S.I. 2026/82, reg. 2(z)