Cyber Laws Consulting Center » UNITED KINGDOM

Electronic Communications Act ,2000

admin — Thu, 20 Nov 2008 13:12:51 +0000

Electronic Communications Act 2000-U.K

An Act to make provision to facilitate the use of electronic communications and electronic data storage; to make provision about the modification of licences granted under section 7 of the Telecommunications Act 1984; and for connected purposes.

[25th May 2000]

Be it enacted by the Queen’s most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons, in this present Parliament assembled, and by the authority of the same, as follows:-

Part I

Cryptography service providers

1. – (1) It shall be the duty of the Secretary of State to establish and Register of

maintain a register of approved providers of cryptography support approved services. providers.

(2)The Secretary of State shall secure that the register contains particulars of every person who is for the time being approved under any arrangements in force under section 2.

(3)The particulars that must be recorded in every entry in the register relating to an approved person are-

(a)the name and address of that person;

(b)the services in respect of which that person is approved; and

(c)the conditions of the approval.

(4) It shall be the duty of the Secretary of State to ensure that such arrangements are in force as he considers appropriate for-

(a) allowing members of the public to inspect the contents of the register; and

(b) securing that such publicity is given to any withdrawal or modification of an approval as will bring it to the attention of persons likely to be interested in it.

Arrangements for approvals.

2. – (1) It shall be the duty of the Secretary of State to secure that there the grant of are arrangements in force for granting approvals to persons who-

(a) are providing cryptography support services in the United Kingdom or are proposing to do so; and

(b) seek approval in respect of any such services that they are providing, or are proposing to provide, whether in the United Kingdom or elsewhere.

(2) The arrangements must-

(a) allow for an approval to be granted either in respect of all the services in respect of which it is sought or in respect of only some of them;

(b) ensure that an approval is granted to a person in respect of any services only if the condition for the grant of an approval to that person is fulfilled in accordance with subsection (3);

(c) provide for an approval granted to any person to have effect subject to such conditions (whether or not connected with the provision of the services in respect of which the approval is granted) as may be contained in the approval;

(d) enable a person to whom the Secretary of State is proposing to grant an approval to refuse it if the proposal is in different terms from the approval which was sought;

(e) make provision for the handling of complaints and disputes which-

(i) are required by the conditions of an approved person’s approval to be dealt with in accordance with a procedure maintained by him in pursuance of those conditions; but

(ii) are not disposed of by the application of that procedure;

(f) provide for the modification and withdrawal of approvals.

(3) The condition that must be fulfilled before an approval is granted to any person is that the Secretary of State is satisfied that that person-

(a) will comply, in providing the services in respect of which he is approved, with such technical and other requirements as may be prescribed;

(b) is a person in relation to whom such other requirements as may be prescribed are, and will continue to be, satisfied;

(c) is, and will continue to be, able and willing to comply with any requirements that the Secretary of State is proposing to impose by means of conditions of the approval; and

(d) is otherwise a fit and proper person to be approved in respect of those services.

(4) Regulations made by virtue of paragraph (a) or (b) of subsection (3) may frame a requirement for the purposes of that subsection by reference to the opinion of a person specified in the regulations, or of a person chosen in a manner determined in accordance with the regulations.

(5) The requirements which (subject to subsection (6)) may be imposed by conditions contained in an approval in accordance with the arrangements include-

(a) requirements to provide information to such persons, in such form, at such times and in response to such requests as may be specified in or determined under the terms of the condition;

(b) requirements that impose obligations that will continue or recur notwithstanding the withdrawal (in whole or in part) of the approval;

(c) requirements framed by reference to the opinion or directions of a person specified in or chosen in accordance with provision contained in the conditions.

(6) Nothing in the arrangements shall authorise the imposition, by conditions contained in an approval, of any requirements for-

(a) the provision of information, or

(b) the maintenance of a procedure for handling complaints or disputes,

in relation to any matter other than one appearing to the Secretary of State to be relevant to the matters mentioned in subsection (3)(a) to (d).

(7) Any requirement to provide information that is imposed in accordance with the arrangements on any person by the conditions of his approval shall be enforceable at the suit or instance of the Secretary of State.

(8) Where any arrangements under this section so provide, a person who-

(a) seeks an approval under the arrangements,

(b) applies for a modification of such an approval,

(d) has his approval under the arrangements modified wholly or partly in consequence of an application made by him,
shall pay to the Secretary of State, at such time or times as may be prescribed, such fee or fees as may be prescribed in relation to that time or those times.

(9) Sums received by the Secretary of State by virtue of subsection (8) shall be paid into the Consolidated Fund.

(10) For the purposes of subsection (1) cryptography support services are provided in the United Kingdom if-

(a) they are provided from premises in the United Kingdom;

(b) they are provided to a person who is in the United Kingdom when he makes use of the services; or

(c) they are provided to a person who makes use of the services for the purposes of a business carried on in the United Kingdom or from premises in the United Kingdom.

3.- (1) The Secretary of State may appoint any person to carry out, in Delegation of his place, such of his functions under the preceding provisions of this Part approval (other than any power of his to make regulations) as may be specified in functions. The appointment.

(2) An appointment under this section-

(a) shall have effect only to such extent, and subject to such conditions, as may be set out in the appointment; and

(b) may be revoked or varied at any time by a notice given by the Secretary of State to the appointed person.

(3) A person appointed under this section shall, in the carrying out of the functions specified in his appointment, comply with all such general directions as may be given to him from time to time by the Secretary of State.

(4) Subject to any order under subsection (5) and to any directions given by the Secretary of State, where a body established by or under any enactment or the holder of any office created by or under any enactment is appointed to carry out any functions of the Secretary of State under this Part-

(a) the enactments relating to the functions of that body or office shall have effect as if the functions of that body or office included the functions specified in the appointment; and

(b) the body or office-holder shall be taken to have power to do anything which is calculated to facilitate, or is incidental or conducive to, the carrying out of the functions so specified.

(5) The Secretary of State may, by order made by statutory instrument, provide for enactments relating to any such body or office as is mentioned in subsection (4) to have effect, so far as appears to him appropriate for purposes connected with the carrying out of functions that have been or may be conferred on the body or office-holder under this section, with such modifications as may be provided for in the order.

(6) An order shall not be made under subsection (5) unless a draft of it has first been laid before Parliament and approved by a resolution of each House.

(7) It shall be the duty of the Secretary of State to secure-

(a that any appointment made under this section is published in such manner as he considers best calculated to bring it to the attention of persons likely to be interested in it;

(b) that any variation or revocation of such an appointment is also so published; and

(c) that the time fixed for any notice varying or revoking such an appointment to take effect allows a reasonable period after the giving of the notice for the making of any necessary incidental or transitional arrangements.

(8) Nothing in this section, or in anything done under this section, shall prejudice-

(a) any power of the Secretary of State, apart from this Act, to exercise functions through a Minister or official in his department;

(b) any power of any person by virtue of subsection (4), or by virtue of an order under subsection (5), to act on behalf of a body or office-holder in connection with the carrying out of any function;

(c) any provision by virtue of section 2(4) or (5)(c) that imposes a requirement by reference to the opinion of any person or determines the manner of choosing a person whose opinion is to be referred to.

4.- (1) Subject to the following provisions of this section, no Restrictions on information which- disclosure of information.

(a) has been obtained under or by virtue of the provisions of this Part, and

(b) relates to the private affairs of any individual or to any particular business,
Shall, during the lifetime of that individual or so long as that business continues to be carried on, be disclosed without the consent of that individual or the person for the time being carrying on that business.

(2) Subsection (1) does not apply to any disclosure of information which is made-

(a) for the purpose of facilitating the carrying out of any functions under this Part, or any prescribed functions, of the Secretary of State or a person appointed under section 3;

(b) for the purpose of facilitating the carrying out of any functions of a local weights and measures authority in Great Britain;

(d) in connection with the investigation of any criminal offence or for the purposes of any criminal proceedings;

(e) for the purposes of any civil proceedings which-

(i) relate to the provision of cryptography support services; and

(ii) are proceedings to which a person approved in accordance with arrangements under section 2 is a party; or

(f) in pursuance of a Community obligation.

(3) In subsection (2)(a) the reference to functions under this Part does not include a reference to any power of the Secretary of State to make regulations.

(4) In subsection (2)(c) “public functions” includes any function conferred by or in accordance with any provision contained in or made under any enactment or Community legislation.

(5) If information is disclosed to the public in circumstances in which the disclosure does not contravene this section, this section shall not prevent its further disclosure by any person.

(6) Any person who discloses any information in contravention of this section shall be guilty of an offence and liable-

(a) on summary conviction, to a fine not exceeding the statutory maximum;

(b) on conviction on indictment, to imprisonment for a term not exceeding two years or a fine, or to both.

5.- (1) In this Part “prescribed” means prescribed by regulations made by the Secretary of State, or determined in such manner as may be provided for in any such regulations.

(2) The powers of the Secretary of State to make regulations under this Part shall be exercisable by statutory instrument, which (except in the case of the initial regulations) shall be subject to annulment in pursuance of a resolution of either House of Parliament.

(3) The initial regulations shall not be made unless a draft of them has been laid before Parliament and approved by a resolution of each House.

(4) In this section “the initial regulations” means the regulations made on the first occasion on which the Secretary of State exercises his powers to make regulations under this Part.

(5) Before making any regulations by virtue of section 2(3)(a) or (b) the Secretary of State shall consult-

(a) such persons appearing to him to be likely to be affected by those regulations, and

(b) such persons appearing to him to be representative of persons likely to be so affected, as he thinks fit.

(6) Regulations made by the Secretary of State under any provision of this Part-

(a) may make different provision for different cases; and

(b) may contain such incidental, supplemental, consequential and transitional provision as the Secretary of State thinks fit.

6. (1) In this Part “cryptography support service” means any service which is provided to the senders or recipients of electronic communications, or to those storing electronic data, and is designed to facilitate the use of cryptographic techniques for the purpose of-

(a) securing that such communications or data can be accessed, or can be put into an intelligible form, only by certain persons; or

(b) securing that the authenticity or integrity of such communications or data is capable of being ascertained.

(2) References in this Part to the provision of a cryptography support service do not include references to the supply of, or of any right to use, computer software or computer hardware except where the supply is integral to the provision of cryptography support services not consisting in such a supply.

Part II

Facilitation of electronic commerce, data storage, etc.

Data Protection Act, 1998

admin — Thu, 20 Nov 2008 13:08:59 +0000

Data Protection Act, 1998

An Act to make new provision for the regulation of the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information.

[16th July 1998]

Part I

Preliminary

1. Basic interpretative provisions.

- (1) In this Act, unless the context otherwise requires-

“data” means information which-

(a) is being processed by means of equipment operating automatically in response to instructions given for that purpose,

(b) is recorded with the intention that it should be processed by means of such equipment,

(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, ^F1 . . .

(d) does not fall within paragraph (a), (b) or (c) but forms part of an accessible record as defined by section 68; [^F2 or

(e) is recorded information held by a public authority and does not fall within any of paragraphs (a) to (d);]

“data controller” means, subject to subsection (4), a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed;

“data processor”, in relation to personal data, means any person (other than an employee of the data controller) who processes the data on behalf of the data controller;

“data subject” means an individual who is the subject of personal data;

“personal data” means data which relate to a living individual who can be identified-

(a) from those data, or

(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,

and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual;

“processing”, in relation to information or data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including-

(a) organisation, adaptation or alteration of the information or data,

(b) retrieval, consultation or use of the information or data,

(d) alignment, combination, blocking, erasure or destruction of the information or data;

[^F3 "public authority" means a public authority as defined by the Freedom of Information Act 2000 or a Scottish public authority as defined by the Freedom of Information (Scotland) Act 2002;]

“relevant filing system” means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible.

(2) In this Act, unless the context otherwise requires-

(a) “obtaining” or “recording”, in relation to personal data, includes obtaining or recording the information to be contained in the data, and

(b) “using” or “disclosing”, in relation to personal data, includes using or disclosing the information contained in the data.

(3) In determining for the purposes of this Act whether any information is recorded with the intention-

(a) that it should be processed by means of equipment operating automatically in response to instructions given for that purpose, or

(b) that it should form part of a relevant filing system,

it is immaterial that it is intended to be so processed or to form part of such a system only after being transferred to a country or territory outside the European Economic Area.

(4) Where personal data are processed only for purposes for which they are required by or under any enactment to be processed, the person on whom the obligation to process the data is imposed by or under that enactment is for the purposes of this Act the data controller.

[ ^F4 (5) In paragraph (e) of the definition of "data" in subsection (1), the reference to information "held" by a public authority shall be construed in accordance with section 3(2) of the Freedom of Information Act 2000 [^F5 or section 3(2), (4) and (5) of the Freedom of Information (Scotland) Act 2002.]

(6) Where

[�^F6 (a)]

section 7 of the Freedom of Information Act 2000 prevents Parts I to V of that Act [^F7 or]

[^F7 (b)

section 7(1) of the Freedom of Information (Scotland) Act 2002 prevents that Act,]

from applying to certain information held by a public authority, that information is not to be treated for the purposes of paragraph (e) of the definition of “data” in subsection (1) as held by a public authority.]

2. Sensitive personal data.

In this Act “sensitive personal data” means personal data consisting of information as to-

(a) the racial or ethnic origin of the data subject,

(b) his political opinions,

(d) whether he is a member of a trade union (within the meaning of the ^M1 Trade Union and Labour Relations (Consolidation) Act 1992),

(e) his physical or mental health or condition,

(f) his sexual life,

(g) the commission or alleged commission by him of any offence, or

(h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings.

3. The special purposes.

In this Act “the special purposes” means any one or more of the following-

(a) the purposes of journalism,

(b) artistic purposes, and

4. The data protection principles.

- (1) References in this Act to the data protection principles are to the principles set out in Part I of Schedule 1.

(2) Those principles are to be interpreted in accordance with Part II of Schedule 1.

(3) Schedule 2 (which applies to all personal data) and Schedule 3 (which applies only to sensitive personal data) set out conditions applying for the purposes of the first principle; and Schedule 4 sets out cases in which the eighth principle does not apply.

(4) Subject to section 27(1), it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller.

5. Application of Act.

- (1) Except as otherwise provided by or under section 54, this Act applies to a data controller in respect of any data only if-

(a) the data controller is established in the United Kingdom and the data are processed in the context of that establishment, or

(b) the data controller is established neither in the United Kingdom nor in any other EEA State but uses equipment in the United Kingdom for processing the data otherwise than for the purposes of transit through the United Kingdom.

(2) A data controller falling within subsection (1)(b) must nominate for the purposes of this Act a representative established in the United Kingdom.

(3) For the purposes of subsections (1) and (2), each of the following is to be treated as established in the United Kingdom-

(a) an individual who is ordinarily resident in the United Kingdom,

(b) a body incorporated under the law of, or of any part of, the United Kingdom,

(d) any person who does not fall within paragraph (a), (b) or (c) but maintains in the United Kingdom-

(i) an office, branch or agency through which he carries on any activity, or

(ii) a regular practice;

and the reference to establishment in any other EEA State has a corresponding meaning.

Computer Misuse Act ,1990

admin — Thu, 20 Nov 2008 13:04:40 +0000

Computer Misuse Act ,1990

An Act to make provision for securing computer material against unauthorised access or modification; and for connected purposes.

[29th June 1990]

Computer misuse offences

1. Unauthorised access to computer material.

- (1) A person is guilty of an offence if-

(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;

(b) the access he intends to secure is unauthorised; and

(2) The intent a person has to have to commit an offence under this section need not be directed at-

(a) any particular program or data;

(b) a program or data of any particular kind; or

(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.

2. Unauthorised access with intent to commit or facilitate commission of further offences.

- (1) A person is guilty of an offence under this section if he commits an offence under section 1 above ( “the unauthorised access offence”) with intent-

(a) to commit an offence to which this section applies; or

(b) to facilitate the commission of such an offence (whether by himself or by any other person);

and the offence he intends to commit or facilitate is referred to below in this section as the further offence.

(2) This section applies to offences-

(a) for which the sentence is fixed by law; or

(b) for which a person of twenty-one years of age or over (not previously convicted) may be sentenced to imprisonment for a term of five years (or, in England and Wales, might be so sentenced but for the restrictions imposed by section 33 of the ^M1 Magistrates’ Courts Act 1980).

(3) It is immaterial for the purposes of this section whether the further offence is to be committed on the same occasion as the unauthorised access offence or on any future occasion.

(4) A person may be guilty of an offence under this section even though the facts are such that the commission of the further offence is impossible.

(5) A person guilty of an offence under this section shall be liable-

(a) on summary conviction, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum or to both; and

(b) on conviction on indictment, to imprisonment for a term not exceeding five years or to a fine or to both.

3. Unauthorised modification of computer material.

- (1) A person is guilty of an offence if-

(a) he does any act which causes an unauthorised modification of the contents of any computer; and

(b) at the time when he does the act he has the requisite intent and the requisite knowledge.

(2) For the purposes of subsection (1)(b) above the requisite intent is an intent to cause a modification of the contents of any computer and by so doing-

(a) to impair the operation of any computer;

(b) to prevent or hinder access to any program or data held in any computer; or

(3) The intent need not be directed at-

(a) any particular computer;

(b) any particular program or data or a program or data of any particular kind; or

(4) For the purposes of subsection (1)(b) above the requisite knowledge is knowledge that any modification he intends to cause is unauthorised.

(5) It is immaterial for the purposes of this section whether an unauthorised modification or any intended effect of it of a kind mentioned in subsection (2) above is, or is intended to be, permanent or merely temporary.

(6) For the purposes of the ^M2 Criminal Damage Act 1971 a modification of the contents of a computer shall not be regarded as damaging any computer or computer storage medium unless its effect on that computer or computer storage medium impairs its physical condition.

(7) A person guilty of an offence under this section shall be liable-

(a) on summary conviction, to imprisonment for a term not exceeding six months or to a fine not exceeding the statutory maximum or to both; and

(b) on conviction on indictment, to imprisonment for a term not exceeding five years or to a fine or to both.

Jurisdiction

4. Territorial scope of offences under this Act.

- (1) Except as provided below in this section, it is immaterial for the purposes of any offence under section 1 or 3 above-

(a) whether any act or other event proof of which is required for conviction of the offence occurred in the home country concerned; or

(b) whether the accused was in the home country concerned at the time of any such act or event.

(2) Subject to subsection (3) below, in the case of such an offence at least one significant link with domestic jurisdiction must exist in the circumstances of the case for the offence to be committed.

(3) There is no need for any such link to exist for the commission of an offence under section 1 above to be established in proof of an allegation to that effect in proceedings for an offence under section 2 above.

(4) Subject to section 8 below, where-

(a) any such link does in fact exist in the case of an offence under section 1 above; and

(b) commission of that offence is alleged in proceedings for an offence under section 2 above;

section 2 above shall apply as if anything the accused intended to do or facilitate in any place outside the home country concerned which would be an offence to which section 2 applies if it took place in the home country concerned were the offence in question.

(5) This section is without prejudice to any jurisdiction exercisable by a court in Scotland apart from this section.

(6) References in this Act to the home country concerned are references-

(a) in the application of this Act to England and Wales, to England and Wales;

(b) in the application of this Act to Scotland, to Scotland; and

5. Significant links with domestic jurisdiction.

- (1) The following provisions of this section apply for the interpretation of section 4 above.

(2) In relation to an offence under section 1, either of the following is a significant link with domestic jurisdiction-

(a) that the accused was in the home country concerned at the time when he did the act which caused the computer to perform the function; or

(b) that any computer containing any program or data to which the accused secured or intended to secure unauthorised access by doing that act was in the home country concerned at that time.

(3) In relation to an offence under section 3, either of the following is a significant link with domestic jurisdiction-

(a) that the accused was in the home country concerned at the time when he did the act which caused the unauthorised modification; or

(b) that the unauthorised modification took place in the home country concerned.

6. Territorial scope of inchoate offences related to offences under this Act.

- (1) On a charge of conspiracy to commit an offence under this Act the following questions are immaterial to the accused’s guilt-

(a) the question where any person became a party to the conspiracy; and

(b) the question whether any act, omission or other event occurred in the home country concerned.

(2) On a charge of attempting to commit an offence under section 3 above the following questions are immaterial to the accused’s guilt-

(a) the question where the attempt was made; and

(b) the question whether it had an effect in the home country concerned.

(3) On a charge of incitement to commit an offence under this Act the question where the incitement took place is immaterial to the accused’s guilt.

(4) This section does not extend to Scotland.